The Workiva platform does not utilize any version of PHP and is therefore not vulnerable to the attacks described in CVE-2026-109618 or CVE-2026-109619.
Some internal systems utilize PHP and Workiva has taken appropriate actions to successfully mitigate and patch all applicable systems.
We will continue to monitor the situation for any new developments and take action as appropriate. If any future impact is identified, we will notify any impacted customers as soon as possible.