1. Are MyGeotab and MyAdmin affected?

No. Neither platform uses PHP, so these vulnerabilities do not affect MyGeotab or MyAdmin. No action is needed for these platforms.

2. Is other Geotab software affected?

Geotab is continuing to review its environment. The review includes applying vendor fixes or mitigations in line with the vulnerability management process. This assessment is ongoing.

3. What should I do if I run PHP in my environment?

Update to a fixed release: PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. If you receive PHP through a Linux distribution or other vendor, check with that vendor for an updated package that includes the fixes.

Compliance

Geotab's Response to PHP Vulnerabilities (CVE-2026-109618, CVE-2026-109619)

The US Cybersecurity and Infrastructure Security Agency (CISA) recommends taking immediate action on the PHP vulnerabilities.

By Geotab Incident Response Team

Oct 28, 2026

On October 21, 2026, the PHP team disclosed two vulnerabilities, CVE-2026-109618 Open in new window and CVE-2026-109619 Open in new window. Geotab is aware of both vulnerabilities and is assessing potential exposure across its environment.

Current Status

MyGeotab, MyAdmin, and the Geotab Video Platform do not use PHP and are not affected by these vulnerabilities. No action is needed for these platforms.

Geotab is continuing to review the rest of its environment and apply vendor fixes or mitigations in line with its vulnerability management process. The security team monitors threat intelligence and assesses new vulnerabilities as they are disclosed.

For technical details and additional guidance, read the PHP security advisory for CVE-2026-109618 and CVE-2026-109619 Open in new window.

For any questions or concerns that are not covered in this FAQ, please reach out to us at security@geotab.com.

Learn more about Geotab’s security and privacy policies at the Geotab Security Center.