Keeping up with vulnerabilities and dependency updates takes a lot of engineering teams’ time.

Recently, two critical remote code execution vulnerabilities were disclosed in PHP: CVE-2026-109618 and CVE-2026-109619 . Around the same time, teams were also responding to the eMudhra private key compromise , which required updating root certificates across base images and system packages.

Issues that impact both root certificates and language runtimes usually require separate patching workflows. Because Heroku manages your runtime images and base stacks, the update process is much more straightforward for our users. You can deploy the language runtime updates with a standard rebuild and the root certificates patch in Heroku-22, Heroku-24, and Heroku-26 required no action on your part.

More details on the recent security updates

Two security issues recently prompted updates:

The PHP Foundation released patches for CVE-2026-109618 and CVE-2026-109619 .…