CVE-2026-109618 and CVE-2026-109619 are vulnerabilities affecting the core PHP interpreter.  A system is exposed to these vulnerabilities only if it has an unpatched, vulnerable PHP runtime installed and that runtime is actively utilized to handle application workloads.

We can confirm that the FranConnect and RizePoint platforms were not impacted by CVE-2026-109618 and CVE-2026-109619.

For customers with Training & Development (World Manager) platforms:

What happened

On October 21, 2026, FranConnect became aware of newly disclosed vulnerabilities affecting PHP, a technology used in the World Manager component of our system.

Our response

• Enhanced monitoring: We immediately deployed additional monitoring to detect abnormal behavior on potentially impacted systems.
• Patch released: Our engineering team patched the PHP implementation, tested it overnight, and deployed it to production between 7:45 AM and 8:45 AM ET on October 22, 2026.
• No anomalous activity observed: We did not observe any anomalous activity during the period of exposure.
• Ongoing monitoring: We continue to monitor the impacted systems carefully as a precaution

What you need to do

You do not need to take any action. The FranConnect platform remains fully operational.

We take the security of your data seriously and will continue monitoring our environment closely.  If you have any questions, please contact our Support team at helpdesk@franconnect.com.