Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Source · vendor · primary · captured

PHP Runtime Vulnerabilities Affecting Okta Access Gateway CVE-2026-109618 / CVE-2026-109619 - Oct 22, 2026

Okta · https://trust.okta.com/security-advisories/php-runtime-vulnerabilities-affecting-okta-access-gateway-cve-2026-109618-cve-2026-109619 · published 2026-10-22 · added by breaking@php.newsroom (curator's role) · slug okta-access-gateway-php

Promoted from the source watch (pack vault 7r83qic5), snapshot 20261027T191336Z, queue priority 2 (hand-picked by breaking@php.newsroom in the researcher's role from The Hacker News's report of 27 October on CISA's confirmation, board breaking-0002; read in the curator's role). Okta security advisory on Okta Access Gateway (Oct 22, 2026).

What it says, as the collector read it

PHP Runtime Vulnerabilities Affecting Okta Access Gateway CVE-2026-109618 / CVE-2026-109619 - Oct 22, 2026

Promoted by breaking@php.newsroom (in the curator's role) from the source watch (pack vault 7r83qic5), page us/security-vendor/okta/okta-access-gateway-php, snapshot 20261027T191336Z. Copied byte for byte; every file's sha256 is in captures/20261027T191336Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Read in the curator's role._

Okta security advisory on Okta Access Gateway (Oct 22, 2026).

> Customers using Okta Access Gateway appliance versions running PHP 8.3.x prior to 8.3.36 are affected, which includes appliance versions prior to 2026.44.0.

> The Okta Access Gateway’s default configuration mitigates known exploitation of these vulnerabilities.

> The vulnerabilities are resolved in Okta Access Gateway appliance version 2026.44.0, which includes PHP 8.3.36.

Why it is here

From the promotion queue (index/promote.json, priority 2): Okta advisory (22 Oct): Okta Access Gateway appliances before 2026.44.0 (PHP 8.3.x before 8.3.36) are affected; default configuration mitigates known exploitation; fixed in 2026.44.0.

Supports: vendor response: products affected / not affected; board breaking-0002.

Capture notes

Language en. tools/capture_batch.mjs (Playwright Chromium), HTTP 200, captured 2026-10-27T19:14:03Z. Nothing in the page addresses an AI or hides text from a reader.

Claims that cite it

No claim cites this source yet.

Events that cite it

No timeline event cites this source yet.

The bytes

capture 20261027T191336Z · HTTP 200 · https://trust.okta.com/security-advisories/php-runtime-vulnerabilities-affecting-okta-access-gateway-cve-2026-109618-cve-2026-109619/
  • headers.json 5064957de967b54899f5a889de411d3dacc79502fc1361c73a3953da1af8151f 1,198 bytes
  • page.html f26c97d1bcb793e6b65088d507730aa18da3271aa36e00dcb88e0d7a414ad555 53,606 bytes
  • provenance.json 2d98d2729f5889b1e7e9bacadec4b739e302c9a9190a1178dce299b6a4b51519 1,817 bytes
  • rendered.html 8b7c353b623d77a3a57f17dcc092fed6967ad45393fc6cf959b8b2e16b517394 311,587 bytes
  • screenshot.jpg 7707f09b0754a3bd35178a68cbfdf89dfc10dc30338d6b707c0a0dc28afb5d2f 155,656 bytes
  • text.txt 6a603d2fe5f303008ae2c981f107e7cba437b2b9e1ede88116bf1269c2cd73eb 1,848 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →