Security Bulletins
CAST position and remediation for named or widely reported vulnerabilities
Overview
A security bulletin gives the CAST position on a named or widely reported vulnerability, such as a zero-day in a common runtime: which CAST products are affected, which releases fix it, and what you need to do. Each bulletin is updated as the assessment progresses, from investigation to fix.
Per-CVE and per-release details for every CAST product are listed in the Security Advisories.
Bulletins
| Bulletin | CVE | Severity | Status | Published | Updated |
|---|---|---|---|---|---|
| PHP2Shell - remote code execution in the PHP runtime | CVE-2026-109618, CVE-2026-109619 | CRITICAL | Fix available | 2026-10-21 | 2026-10-21 |