PHP security vulnerabilities
- monitoring
Geocodio runs on PHP, and PHP has announced two critical security vulnerabilities. We have seen no sign of exploitation, and all services are running normally. Patches are expected today at 14:00 UTC (10AM US Eastern). We will deploy the patch as soon as it's available. To protect customer data, there is a chance we may temporarily pause spreadsheet uploads in the dashboard and through the Lists API until the patch is in place. Geocoding API requests will not be affected. We'll update this page if we pause uploads.
- resolved
We have completed patching our Enterprise and Self-Serve infrastructure for CVE-2026-109618 and CVE-2026-109619. We were able to do so without any disruptions to the service. We continue to monitor our infrastructure. We can confirm that between the time we sent the email and the patch being fully deployed, we saw no signs that they were exploited against Geocodio.