Are Any Atlassian Cloud Apps Affected by PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619?

Question

Hi everyone,

I’m checking whether any installed Atlassian Cloud apps could be affected by the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619.

The apps I’m reviewing include:

* Confluence Cloud for Microsoft Teams and Slack
* Jira Cloud for Microsoft Teams, Outlook, Slack, and Spreadsheets
* Atlascode Integration
* Atlassian Assist
* Atlassian Cloud for Google Workspace
* Atlassian Home for Jira Cloud
* Atlassian MCP
* Automation for Jira
* GitHub for Atlassian
* Opsgenie
* Statuspage for Jira
* Jira Service Management Widget
* Mermaid Diagrams Viewer

Could anyone confirm the following?

* Are any of these apps, or their supporting infrastructure, using PHP?
* If so, are they affected by either vulnerability, and is any action required from site administrators?

If there’s an official Atlassian security advisory or resource covering this, please share the link.

Thanks for your help!

Sascha H. · Answer

Hi @Nor Azmira Doman,

could you give an idea of the actions you'd take if any of them were affected, other than not using them?

With regard to @Nikola Perisic's answer, what levers do we have regarding the deployment architecture on cloud instances? I’d expect this to be Atlassian’s responsibility too, as it is for all its core apps.

Cheerio,

Sascha

Arkadiusz Wroblewski · Answer

Hello @Nor Azmira Doman

Adding to Nikola's answer, Atlassian stated on October 22 that its investigation found no evidence of impact to its products or customer data. Announcement:

https://customertrust.atlassian.com/

For third-party Marketplace apps, it’s still a good idea to check with each vendor, since Atlassian's statement may not cover every app individually.

Cheers

Arek🤠🧙‍♂️

Nikola Perisic · Answer

Welcome @Nor Azmira Doman

Atlassian Cloud’s core services (Jira Cloud, Confluence Cloud, Bitbucket Cloud) do not run on PHP and are not directly vulnerable to CVE-2026-109618 (OOM memory corruption) or CVE-2026-109619 (cross-request use-after-free / stale global state). However, whether any installed Atlassian Cloud apps/add-ons are affected depends entirely on their deployment architecture