PHP vulnerability

October 22, 2026

ADP is aware of the following PHP vulnerabilities:

CVE-2026-109618
CVE-2026-109619

ADP is aware of recent reports regarding a vulnerability in PHP, a scripting language used to build and run web applications and websites. Upon receiving reports regarding this vulnerability, ADP’s Global Security Organization began an investigation to determine any potential impacts to our systems. At this time, we can confirm that none of our systems have been accessed due to this vulnerability.

ADP takes security matters of this nature very seriously and worked quickly to implement protective measures and apply the recommended patches as they are being made available to all applicable systems.

To learn more about how ADP protects data and how clients can help protect themselves, we encourage you to visit ADP’s Security page at www.adp.com/trust.

If you have any further questions, please reach out to your ADP service representative.