TL;DR: Our systems are unaffected at this time. We will continue monitoring.

We are aware of ongoing and widespread security incidents reported over the last week. The most serious are two remote code execution vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619), which are being actively exploited. The same period also saw a malicious release of the LiteLLM software package, credential breaches at several cloud hosting providers, and weak signing keys at a certificate authority.

What We Checked

Parallax was not affected by any of the documented exploits. We reviewed our production environment against each one:

PHP. Parallax does not run PHP anywhere in production.
Software packages. We do not use LiteLLM or the other packages that were tampered with.
Hosting providers. We do not use the platforms whose credentials were exposed.
Certificates. Our TLS certificates are not issued by the affected certificate authority.

The same period also brought security fixes for nginx, the web server in front of our API. None of them apply to our configuration, and we will apply the operating system's security update as soon as it is released.

What Happens Next

We are applying all relevant security updates to protect our systems. We will continue to monitor our systems and regularly survey all of our vendors, and we will advise should anything change.

Please feel free to reach out to us at info@prx.vision with any questions or concerns.