We are aware of two recently announced critical security vulnerabilities affecting PHP, CVE-2026-109618 and CVE-2026-109619.

The vulnerabilities have been rated 9.2 (Critical) and may, under affected conditions, allow unauthenticated remote code execution. Updated versions of PHP addressing the vulnerabilities were released on 21 October 2026.

The UK’s National Cyber Security Centre has advised organisations to identify PHP installations within their infrastructure and apply the appropriate security updates.

Following a review of our applications and their underlying technologies, we have determined that our applications are not affected by these vulnerabilities.

As a result, no remedial action or emergency release is required and there is no action required from our customers.

We recognise the importance of keeping customers informed when significant cyber security vulnerabilities are publicly disclosed. We will continue to monitor relevant security advisories and assess emerging vulnerabilities through our established information security and vulnerability management processes.