# PHP security status for OpenRefine

**URL:** <https://forum.openrefine.org/t/php-security-status-for-openrefine/3030>\
**Category:** Support and Helpdesk\
**Created:** [October 26, 2026, 5:31pm UTC](https://forum.openrefine.org/t/php-security-status-for-openrefine/3030 "2026-10-26T17:31:48Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![abie](https://avatars.discourse-cdn.com/v4/letter/a/a3d4f5/32.png) [@abie](https://forum.openrefine.org/u/abie)\
**Post date:** [October 26, 2026, 5:31pm UTC](https://forum.openrefine.org/t/php-security-status-for-openrefine/3030/1 "2026-10-26T17:31:48Z")

</div>

Hello!

As you are all aware, there are two recently disclosed critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) which can allow for unauthenticated remote code execution. I am using **OpenRefine** on my system. Please confirm:

1. Is this version vulnerable to CVE-2026-109618 or CVE-2026-109619?
2. If yes, what patch or upgrade fixes it, when will it be available, and how do I obtain it?

Thank you!

---

<div class="post-metadata">

**Author:** ![ostephens](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.openrefine.org/ostephens/32/8_2.png) [@ostephens](https://forum.openrefine.org/u/ostephens)\
**Post date:** [October 26, 2026, 5:35pm UTC](https://forum.openrefine.org/t/php-security-status-for-openrefine/3030/2 "2026-10-26T17:35:40Z")

</div>

Openrefine doesn’t use PHP and so is not affected by these vulnerabilities as far as I am aware