PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
Astronomer has conducted a thorough internal review of its code and container images and confirmed that Astro and Astro Private Cloud do not include PHP and are therefore not affected by the recently disclosed PHP vulnerabilities.

Customer action: Customers should review their own code and any modifications they have made to Astronomer-provided runtime images (for example, custom-installed packages or system dependencies) to determine whether PHP is present and whether they may be impacted. Please follow the guidance in the NCSC advisory and the PHP project’s security update to remediate any affected components.