18.78.3
October 22nd, 2026
General
Security update: PHP vulnerability patched
On 21 October 2026, two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were publicly disclosed. As a precaution, we temporarily restricted potentially vulnerable functionality while applying patches.
By that evening, we had patched all Piwik PRO environments and restored full functionality. Tracking was unaffected, and no data was lost. No action is required from customers.