PHP CVE-2026-109618 && CVE-2026-109619

Atempo teams are aware of those CVEs that severely impact previous PHP versions.

Atempo teams have completed the verifications and were able to conclude that Miria and Lina are not impacted by those vulnerabilities, as they do not use PHP.

The main impact is on ARRS, a discontinued report tool that was once provided aside or along with Tina. Beginning with Tina 4.9.4, “ARRS Light” is no longer installed along with Tina and is even uninstalled when upgrading.

Hence, only the standalone ARRS installation, or Tina versions up to 4.9.3, may be subject to those vulnerabilities. Their PHP version may be safely upgraded to PHP 8.3.36, which fixes those vulnerabilities.

Recommanded action plan:

• For 4.9.4 and above, the customer doesn’t need to worry. ARRS is not installed.
• For 4.9.4 below, the customer can upgrade to 4.9.4 or above to have ARRS uninstalled. 
• If not upgrading & they are not using ARRS, they can remove tina_Arrs installed directory as a fix.   
• If not upgrading & they are using ARRS, they have to upgrade their PHP to the recommended patch release by PHP. 

Please refer to https://www.php.net/index.php#2026-10-21-2 for PHP instructions on the upgrade process.