# Source: PHP Runtime Vulnerabilities Affecting Okta Access Gateway CVE-2026-109618 / CVE-2026-109619 - Oct 22, 2026

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Okta: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · vendor · primary · captured

# PHP Runtime Vulnerabilities Affecting Okta Access Gateway CVE-2026-109618 / CVE-2026-109619 - Oct 22, 2026

**Okta** · [https://trust.okta.com/security-advisories/php-runtime-vulnerabilities-affecting-okta-access-gateway-cve-2026-109618-cve-2026-109619](https://trust.okta.com/security-advisories/php-runtime-vulnerabilities-affecting-okta-access-gateway-cve-2026-109618-cve-2026-109619) · published 2026-10-22 · added by `breaking@php.newsroom (curator's role)` · slug `okta-access-gateway-php`

Promoted from the source watch (pack vault 7r83qic5), snapshot 20261027T191336Z, queue priority 2 (hand-picked by breaking@php.newsroom in the researcher's role from The Hacker News's report of 27 October on CISA's confirmation, board breaking-0002; read in the curator's role). Okta security advisory on Okta Access Gateway (Oct 22, 2026).

## What it says, as the collector read it

#### PHP Runtime Vulnerabilities Affecting Okta Access Gateway CVE-2026-109618 / CVE-2026-109619 - Oct 22, 2026

Promoted by breaking@php.newsroom (in the curator's role) from the source watch (pack vault `7r83qic5`), page `us/security-vendor/okta/okta-access-gateway-php`, snapshot `20261027T191336Z`. Copied byte for byte; every file's sha256 is in `captures/20261027T191336Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Read in the curator's role._

Okta security advisory on Okta Access Gateway (Oct 22, 2026).

> Customers using Okta Access Gateway appliance versions running PHP 8.3.x prior to 8.3.36 are affected, which includes appliance versions prior to 2026.44.0.

> The Okta Access Gateway’s default configuration mitigates known exploitation of these vulnerabilities.

> The vulnerabilities are resolved in Okta Access Gateway appliance version 2026.44.0, which includes PHP 8.3.36.

#### Why it is here

From the promotion queue (`index/promote.json`, priority 2): Okta advisory (22 Oct): Okta Access Gateway appliances before 2026.44.0 (PHP 8.3.x before 8.3.36) are affected; default configuration mitigates known exploitation; fixed in 2026.44.0.

Supports: vendor response: products affected / not affected; board breaking-0002.

#### Capture notes

Language `en`. tools/capture_batch.mjs (Playwright Chromium), HTTP 200, captured 2026-10-27T19:14:03Z. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261027T191336Z · HTTP 200 · https://trust.okta.com/security-advisories/php-runtime-vulnerabilities-affecting-okta-access-gateway-cve-2026-109618-cve-2026-109619/- `headers.json` 5064957de967b54899f5a889de411d3dacc79502fc1361c73a3953da1af8151f 1,198 bytes
- `page.html` f26c97d1bcb793e6b65088d507730aa18da3271aa36e00dcb88e0d7a414ad555 53,606 bytes
- `provenance.json` 2d98d2729f5889b1e7e9bacadec4b739e302c9a9190a1178dce299b6a4b51519 1,817 bytes
- `rendered.html` 8b7c353b623d77a3a57f17dcc092fed6967ad45393fc6cf959b8b2e16b517394 311,587 bytes
- `screenshot.jpg` 7707f09b0754a3bd35178a68cbfdf89dfc10dc30338d6b707c0a0dc28afb5d2f 155,656 bytes
- `text.txt` 6a603d2fe5f303008ae2c981f107e7cba437b2b9e1ede88116bf1269c2cd73eb 1,848 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.49 · data as of 2026-10-27T19:13Z · vault commit 6f0d5c50bf12 · https://refs.php.oct.2026.newsroom.sgit.ai/sources/okta-access-gateway-php/index.html