Trust Center
Trust Center Updates
PHP Vulnerability - Elliott Davis Response
On October 21, 2026, the PHP development team disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could allow unauthenticated remote code execution in affected PHP environments.
Elliott Davis has reviewed its environment to assess potential exposure. We do not develop or host web applications built on PHP. Our externally facing infrastructure is limited in scope, and we have not identified exposure to these vulnerabilities within the Elliott Davis-managed environment. We have also not received notification from any of our service providers indicating that these vulnerabilities have resulted in a compromise affecting Elliott Davis or our data.
We are continuing to monitor applicable security advisories and communications from our technology providers. We will take appropriate action and update this notice if our assessment changes or if we identify any impact to systems or data associated with client engagements.