PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619): update for customers

Last updated: 23/10/2026, 13:30

This week, two security vulnerabilities were disclosed in PHP. We know many of you will want to know whether your backups are affected, so here is what we know so far about each platform we provide.

Our own systems

The BackupVault website is hosted by WP Engine, which has applied the PHP security update.

Acronis

Acronis has confirmed that Acronis Cyber Protect Cloud, the Acronis Agent and Acronis Cloud Manager are not affected. Neither are Cyber Protect 15, 16 and 17, True Image or the Acronis Support Portal. The issue affects two of its support resources: the Acronis Forum and file uploads in its support forms. Acronis has turned both off until the update is applied. Read Acronis’s statement or see its security advisory for the latest information.

N-able

N-able has confirmed that the issue affected a small number of its products: Take Control (session routing only), N-sight, Mail Assure / Spam Experts and Passportal. It says all its other products are not affected. N-able declared emergency maintenance, put extra protective controls and monitoring in place, and as of 22 October had finished patching all affected products except Take Control standalone, which was nearly complete. N-able says it has found no evidence of exploitation in its products. Read N-able’s update.

AvePoint

AvePoint has confirmed that its SaaS services and customer data are not affected. The issue only affects some of its legacy informational websites and its Japan website. These are hosted separately from its SaaS platform and don’t store or process customer data. AvePoint took those sites offline as a precaution while it applies the fix. It describes this as a precaution, not an incident.

Redstor

Redstor has confirmed that its backup and recovery solutions are not affected, because they don’t use PHP. No update or configuration change is needed for these solutions.

Do you need to do anything?

You don’t need to do anything with your BackupVault services. If we hear otherwise from any vendor, we’ll contact affected customers directly as well as updating this page. If your organisation runs PHP on its own web servers, ask your IT team or provider to check that the latest PHP security updates have been applied.

If you have any questions, contact our support team at support@backupvault.co.uk