Freja eID Group AB (”Freja”) hereby confirms that its identity services are not affected by the critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. These services do not use PHP. 

PHP is used only on Freja’s two public websites. Both were updated to the patched PHP version on 21 October 2026 at 16:15 CEST, fifteen minutes after the PHP project released the fix. 

 Background 

On 20 October 2026 the PHP security team gave advance notice of a critical security release, scheduled for Wednesday 21 October 2026 at 14:00 UTC (16:00 CEST). Both vulnerabilities* are rated CVSS v4.0 9.2 and can allow unauthenticated remote code execution on PHP installations serving web requests. 

*CVE-2026-109618 – remote code execution via out-of-memory corruption. 

*CVE-2026-109619 – remote code execution via stale global state. 

The fixes are included in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. 

Scope of PHP use at Freja 

PHP is installed only on the servers hosting Freja’s public websites: 

frejaeid.com 

org.frejaeid.com 

These websites are separate from the systems that delivers Freja’s identity and authentication services. 

Services not affected 

The following services do not use PHP and are therefore not affected by CVE-2026-109618 or CVE-2026-109619: 

Freja eID as an approved Swedish e-identification (Godkänd svensk e-legitimation) 

Freja eID as an approved Swedish organisational e-identification (Godkänd svensk tjänstelegitimation) 

Services that Freja provides on behalf of banks 

No customer action is required for these services. 

Remediation of the public websites 

Freja prepared in advance after PHP’s notice and applied the update as soon as it was released. 

Date and time (CEST)  Event 
21 October 2026, 16:15  Freja’s public websites updated to the patched PHP version 
21 October 2026, 16:00  PHP releases the security fix (14:00 UTC) 
20 October 2026  PHP publishes advance notice of a critical security release 

Conclusion 

Freja’s identity services, Godkänd svensk e-legitimation, Godkänd svensk tjänstelegitimation and services delivered on behalf of banks, are not affected by CVE-2026-109618 or CVE-2026-109619. The only PHP installations at Freja were patched within fifteen minutes of the fix becoming available. 

Freja continuously monitors security advisories for all components in its environment. Questions about this statement can be directed to info@frejaeid.com

Sources 

PHP: Upcoming Critical PHP Security Release, 20 October 2026 

PHP: Security advisory – Critical remote code execution vulnerabilities, 21 October 2026