![Stratus LOGO nbg.png]](https://kb.stratusgroup.com.au/hs-fs/hubfs/Stratus%20LOGO%20nbg.png?height=50&name=Stratus%20LOGO%20nbg.png)
PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619: impact on MYOB Acumatica
Stratus has confirmed that MYOB Acumatica and all Stratus-delivered solutions are not affected.
Last reviewed: 26 October 2026
Summary
The Australian Cyber Security Centre (ACSC) recently issued a critical alert about two vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. Many customers have asked whether their MYOB Acumatica environment, or the solutions Stratus provides, are exposed.
We have reviewed the platform, every customisation and integration we have developed, and the services we host. None of them use PHP. These vulnerabilities do not affect MYOB Acumatica or any solution delivered or managed by Stratus, and no patching is required on our side.
About the vulnerabilities
- Both are memory-handling flaws in the core PHP language engine, rated critical (CVSS v4.0 score 9.2).
- Successful exploitation could allow an attacker to run code on a web server that runs PHP, without needing to log in.
- The PHP project has released fixed versions (8.5.12, 8.4.27, 8.3.36 and 8.2.35).
- Only systems running PHP are affected. Systems built on other technologies, such as Microsoft .NET, are not affected.
Our assessment
| Component | Uses PHP | Notes |
|---|---|---|
| MYOB Acumatica platform | No | Built on Microsoft .NET, hosted and operated by MYOB |
| Stratus customisations | No | Built in C#/.NET and standard Acumatica formats |
| Custom reports and inquiries | No | Run inside the Acumatica reporting engine |
| Stratus-built integrations | No | Built in C#/.NET and TypeScript |
| Stratus website and support portal | No | Does not use PHP |
Answers to common questions
Do any components supporting our MYOB Acumatica system run PHP?
No. The platform and all Stratus-developed customisations, reports and integrations are built on Microsoft .NET.
What PHP version is in use?
None. PHP is not installed or used in any component we manage.
Is any affected component internet-facing?
No. There is no PHP component, internet-facing or otherwise, in the environment we manage.
Is the environment affected by either CVE?
No. Neither CVE-2026-109618 nor CVE-2026-109619 applies.
Have patches been applied or scheduled?
Not required. There is nothing to patch for these vulnerabilities in the environment we manage.
Systems outside our management
This article covers MYOB Acumatica and the solutions Stratus delivers and manages. For completeness, we recommend reviewing the following with the relevant provider:
- Third-party add-ons with their own cloud services (for example reporting, payments or expense management tools). Any component installed inside Acumatica is a .NET component, but the vendor should confirm the status of its own hosted service.
- Websites and online stores. Platforms such as WordPress, WooCommerce and Magento commonly run on PHP. If your website or online store is connected to Acumatica, please check with your web host or agency.
- Other systems your organisation operates directly.
This article applies to MYOB Acumatica environments hosted by MYOB. If your organisation hosts Acumatica itself or with another provider, please contact Stratus support for a tailored response.
Further information
If you need this confirmation in a different format for your security register, or have any questions, please contact Stratus support and we will be happy to assist. A PDF copy of this statement is attached to this article.
For the latest information on these vulnerabilities, refer to the ACSC website at cyber.gov.au.
This article reflects our assessment as at 26 October 2026. Vulnerability details referenced are drawn from public advisories and may change as more information becomes available.