Workflow Companion and the PHP and Node.js security releases of 21 October 2026

On 21 October 2026 the PHP project and the Node.js project each published security releases. This note says where Workflow Companion stands on both.

PHP: not used

Workflow Companion does not use PHP, neither in the app nor on the servers it runs on. The two vulnerabilities in the PHP security advisory, CVE-2026-109618 and CVE-2026-109619, do not affect it.

Node.js: on the fixed release

The app's servers run on Node.js. On 21 October 2026 we moved them to Node.js 24.22.1, the release that fixes the vulnerabilities listed in the Node.js security advisory. We have found no sign that any of them was exploited against Workflow Companion.

Questions

Write to us at support@mivicle.com.