Critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619)

Incident Report for Trackunit

Resolved

On October 21, 2026, two critical vulnerabilities were publicly disclosed in the PHP programming language (CVE-2026-109618 and CVE-2026-109619). They can allow unauthenticated remote code execution in affected PHP environments.

Our security team began assessing our exposure. We have taken the necessary actions. No action is required from our customers.

We will continue to monitor the situation. If anything changes, we will update this page.

Posted Oct 22, 2026 - 09:19 CEST

This incident affected: Trackunit Manager, Trackunit Verify, Trackunit Raw, Manager Classic, Onei3, Trackunit Website, Trackunit Community, and Trackunit Help Center.