On October 20, 2026, two critical remote code execution vulnerabilities in PHP were publicly announced, rated 9.2 (CVSS v4.0). Technical details have not yet been disclosed, and PHP has not published a workaround.
As a precaution, we have applied mitigations and temporarily disabled all GravityZone Cloud capabilities that involve uploading files.
Endpoint protection, policy enforcement, and detection continue to operate. Policy settings, exclusions, and rules can still be added manually; only CSV import is affected. We have found no evidence that these vulnerabilities have been exploited against GravityZone.
Why we did this These vulnerabilities could allow remote code execution, and their full scope is not yet known. Until fixed PHP versions are deployed and validated across our infrastructure, we chose to remove the exposure created by file uploads rather than accept that risk for your environment and our platform.
What happens next The restriction is temporary. We will re-enable these capabilities once the fix is deployed and will notify you when that happens.
What you need to do No action is required on your side.
We apologize for the inconvenience and appreciate your understanding.