Onetime Secret is not affected by PHP vulnerabilities

If you're checking whether the recent PHP vulnerabilities affect the services you rely on, we can reassure you: Onetime Secret is not affected.

Onetime Secret does not use PHP. Neither the open-source application nor our hosted service is affected by CVE-2026-109618 CVE-2026-109618 RCE via OOM corruption PHP uses longjmp() to abort requests on out-of-memory errors, which can leave request memory uninitialized in some contexts. Cleanup may then read that memory or use it to make control-flow decisions, potentially allowing remote code execution. or CVE-2026-109619 CVE-2026-109619 RCE via stale global state PHP global state can retain pointers to freed request memory when it is not correctly reset. Subsequent requests may read or branch on this stale state before it is fully initialized, potentially allowing remote code execution. .

The application is written in Ruby with a Vue frontend. See the source code and language breakdown of our GitHub repository:

Commits

21,523

Latest commit

Oct 22, 2026

Codebase languages

• Ruby 63.3%
• TypeScript 23.8%
• Vue 8.83%
• Shell 1.84%
• Python 1.65%

• JavaScript 0.23%
• HTML 0.129%
• Dockerfile 0.0987%
• CSS 0.0457%
• PLpgSQL 0.0266%
• HCL 0.0142%