We have received enquiries regarding CVE-2026-109618 and CVE-2026-109619, which affect the PHP runtime.

We would like to clarify that ManageEngine Applications Manager and the APM Insight PHP Agent do not bundle the PHP runtime or its components. The reported CVEs are related to the PHP runtime and are therefore not directly applicable to Applications Manager or the APM Insight PHP Agent.

However, these vulnerabilities may affect customers who have installed a vulnerable PHP runtime on their machines or are running PHP-based applications in their environment. Such customers should assess their PHP installations and apply the relevant security updates as recommended by the PHP project.