Branch | Trust Center

We are aware of the critical PHP remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) disclosed on October 21, 2026. We completed a full impact assessment and confirmed these issues do not affect Branch.

Branch does not run PHP, PHP-FPM, or any PHP-based web interfaces or APIs in product systems or systems that process, store, or handle customer data. Our production platforms and customer-facing services are built on modern technology stacks that do not rely on PHP.

In addition, Branch maintains and strictly adheres to a defined patching cadence for all systems, including any systems that touch or process customer data. Critical and high-severity vulnerabilities are prioritized and remediated according to established service levels, with ongoing monitoring and verification.

No customer action is required.

Protecting the confidentiality, integrity, and availability of customer data is a core priority. We continuously monitor the threat landscape, assess emerging vulnerabilities, and maintain layered controls designed to reduce risk across our environment. We will continue monitoring this situation and will provide further updates if needed.

If you have questions, please contact your Branch account team or our security team at security@branch.io.

Branch Security Team
October 22, 2026