Overview 

Pentaho is aware of the recently disclosed critical vulnerabilities affecting PHP, identified as CVE-2026-109618 and CVE-2026-109619, which could potentially allow unauthorized remote code execution on affected systems.

Following a review of our products and associated technologies, we can confirm that Pentaho products do not utilize PHP and are therefore not directly affected by these vulnerabilities. No product updates or customer remediation actions are required in relation to these vulnerabilities.

As part of our ongoing security management activities, we have also assessed our supporting infrastructure for potential exposure. Where vulnerable components have been identified, appropriate security controls are in place to reduce exposure while remediation activities are undertaken.

Pentaho continues to monitor emerging security threats and takes appropriate action to protect its products, infrastructure and customer information.

Customers requiring further information are encouraged to contact their Pentaho representative or the Pentaho Support team.