TL;DR

  • AppWizzy is rolling out security updates to templates and infrastructure after two serious PHP CVEs were disclosed.
  • The issues can enable remote code execution, including via unauthenticated HTTP requests in certain Apache setups.
  • Engineers are patching PHP packages, rebuilding images, and testing startup, DB connections, and auth flows.
  • New projects will use updated, tested environments; existing deployments may need separate runtime updates.
  • Security fixes are being built into the project creation process to keep generated environments current.

Fact Box

  • AppWizzy is updating templates and infrastructure after disclosure of PHP CVE-2026-109618 and CVE-2026-109619.
  • The disclosed PHP vulnerabilities can allow remote code execution under certain conditions.
  • In affected Apache configurations, the vulnerabilities can be triggered via unauthenticated HTTP requests.
  • AppWizzy is rebuilding and testing environments, verifying startup, database connections, and authentication.
  • New AppWizzy projects will use updated environments as the rollout is completed; existing deployments may need separate updates.

We’re rolling out security updates across AppWizzy’s application templates and infrastructure following the disclosure of two serious PHP vulnerabilities: CVE-2026-109618 and CVE-2026-109619.

These vulnerabilities can allow remote code execution under certain conditions, including through unauthenticated HTTP requests in affected Apache configurations.

Our goal is simple: new AppWizzy projects should run on updated, tested environments.

What We’re Updating

Our engineering team is:

  • Checking template images for vulnerable PHP packages.
  • Updating affected components to patched versions.
  • Rebuilding and testing application environments.
  • Verifying application startup, database connections, and authentication.
  • Replacing outdated pre-provisioned machines with updated images.

We also review installed dependencies beyond each application’s primary technology stack.

New projects will use the updated environments as the rollout is completed. Existing deployments have their own runtime versions and may require separate security updates.

Security maintenance doesn’t stop when an application is generated. Runtime environments, dependencies, and infrastructure need regular updates.

We’re making these fixes part of the AppWizzy project creation process, so you can focus on building applications while we maintain the environments behind them.