Security notice: PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619
TomorrowX technology does not use PHP. Following the disclosure on 21 October 2026 of two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which allow unauthenticated remote code execution against PHP installations serving web requests, we want to provide clarity to our customers and partners.
The Composable Agentic Platform (CAP), including Data Mediation, the Programmable Data Agent runtime, the Console, AI Data Guard and all TomorrowX extensions, is written in Java and runs on the Java Virtual Machine with an embedded Jetty server. No PHP interpreter or PHP runtime is present in any TomorrowX distribution, container image or machine image, and tomorrowx.com is a static site with no server-side scripting. Consequently, TomorrowX products are not exposed to these PHP-specific vulnerabilities and no customer action is required for CAP.
For organisations operating PHP-based systems, we strongly encourage reviewing your exposure, including third-party dependencies, and applying the latest security updates. The PHP project has released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 and states that there are no complete mitigations short of updating.
Security requires continuous visibility, independent controls and the ability to respond quickly to emerging threats. Official advisory: PHP security advisory, 21 October 2026 ↗.
AWS Foundational Technical Review
The Composable Agentic Platform (CAP) has passed the AWS Foundational Technical Review and carries the AWS Qualified Software designation. The FTR assesses software against AWS Well-Architected practices for security, reliability and operational excellence.
Open source compliance — OpenChain ISO/IEC 5230
TomorrowX is an OpenChain conformant organisation ↗. Our open source licence compliance program conforms to ISO/IEC 5230:2020, the international standard for open source licence compliance.
Every CAP distribution ships with generated LICENSE and NOTICE attribution, verbatim licence texts, and a written source offer for LGPL components fulfilled through our public LGPL source repository ↗. Our open source policy is published in the product documentation.
Software bill of materials
Every CAP release includes a complete Software Bill of Materials in CycloneDX format, generated at build time and shipped inside the distribution — compliant with the 2026 Minimum Elements for a Software Bill of Materials (CISA and partner agencies, 2026) and signed in our build pipeline with Sigstore, so signatures verify offline against public roots. Every extension package carries its own signed SBOM. Customers can inventory and verify every component we ship — direct and transitive — without asking us.
Secure development
CAP is developed against the NIST Secure Software Development Framework (SSDF, SP 800-218). We maintain a practice-by-practice evidence map and can provide a CISA Secure Software Development Attestation on request. Our pipeline runs static analysis (CodeQL), dependency vulnerability scanning, container scanning and licence gates on every build, and our security baseline is maintained at zero open high or critical findings.
Platform hardening is aligned to the controls of the Australian Government Information Security Manual (ISM) at PROTECTED level, including AES-256-GCM authenticated encryption of credentials at rest with per-installation keys.
Release integrity
Published releases include SHA-256 checksums for all artifacts. Container images are delivered through digest-verified registries; machine images are distributed through the AWS Marketplace and Google Cloud Marketplace with pinned image identifiers.
Reporting a vulnerability
Email notices@tomorrowx.com with details of the product, version and steps to reproduce. We acknowledge reports within 5 business days and deliver fixes through our standard release channels. See our responsible disclosure policy and the security policy published with our public repositories ↗.
Licensing
CAP is commercial software licensed under the TomorrowX End User Subscription Licence Agreement, available through selected Cloud Marketplaces. Third-party software disclosures are published in the product documentation and shipped with every distribution.