Security Advisory: CAST Highlight Is Not Impacted by CVE-2026-109618 and CVE-2026-109619

Summary

CAST is aware of two recently disclosed vulnerabilities affecting PHP, referenced as CVE-2026-109618 and CVE-2026-109619. After review, we confirm that CAST Highlight products are not impacted by these vulnerabilities, and no action is required from our customers.

Product impact

No CAST Highlight component relies on PHP technology. This includes:

The CAST Highlight SaaS platform
CAST Highlight Code Reader
CAST Highlight Command Line
All other CAST Highlight binaries and tools

These products are therefore not exposed to CVE-2026-109618 or CVE-2026-109619.

Documentation website

The CAST Highlight Documentation Website (https://doc.casthighlight.com) uses PHP. As a precaution, it was upgraded to safe PHP versions immediately after the vulnerabilities were disclosed. No impact has been observed.

Customer action required

None. Customers can keep using CAST Highlight and its documentation as usual.

Our commitment

CAST monitors newly disclosed vulnerabilities on an ongoing basis and assesses their potential impact on our products and services. We will publish an update if any new information changes this assessment.

For any questions, please contact CAST Support.