Security Bulletins

CAST position and remediation for named or widely reported vulnerabilities

Overview

A security bulletin gives the CAST position on a named or widely reported vulnerability, such as a zero-day in a common runtime: which CAST products are affected, which releases fix it, and what you need to do. Each bulletin is updated as the assessment progresses, from investigation to fix.

Per-CVE and per-release details for every CAST product are listed in the Security Advisories.

Bulletins

BulletinCVESeverityStatusPublishedUpdated
PHP2Shell - remote code execution in the PHP runtimeCVE-2026-109618, CVE-2026-109619CRITICALFix available2026-10-212026-10-21