Chameleon response to PHP CVE-2026-109618 and CVE-2026-109619

Incident Report for Chameleon

Resolved

Chameleon does not use PHP in our stack that supports Chameleon customers and end-users. Chameleon does use PHP in conjunction with Statamic CMS for our marketing site and we have upgraded to the patched PHP version 8.2.35 as of 2026-10-22T17:35:00 UTC.

Posted Oct 22, 2026 - 13:30 EDT