Response to PHP security vulnerabilities

Incident Report for Benevity

Monitoring

On Oct. 21, 2026, the PHP project released fixes for two critical security vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP, a programming language used by parts of the Benevity platform. We have found no evidence that any Benevity system or client data has been compromised, and there is no confirmed impact to clients.

Our team put mitigations in place shortly after the announcement and have applied updates to the affected components. We continue to monitor our systems for signs of attempted exploitation. No further action required at this time. More updates will follow as they become available.

Posted Oct 22, 2026 - 14:50 MDT

This incident affects: Donate and Volunteer (formerly Benevity Spark) (Donate and Volunteer Core Services), Grants (Grants Essential (formerly Benevity Grants)), and Benevity Causes and Nonprofits Portal.