This week, a critical security vulnerability was disclosed in PHP, a programming language that runs a large share of the world’s websites and web applications. National cybersecurity agencies, including the UK’s NCSC and the US agency CISA, have urged organisations everywhere to act quickly.
We want to reassure you that we have not been affected, and our teams are continuing to work as normal. As a precaution, we have temporarily switched off some services across the broader Hubexo group of companies, and are bringing them back online step-by-step, but this doesn’t impact services in the UK.
What happened
On 21 October 2026, the PHP project released a security update for two vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Under certain conditions, these flaws could let an attacker run commands on a web server running PHP without needing to log in. The vulnerabilities affect PHP across all versions, so organisations worldwide are reviewing their systems.
What we have done
As soon as the vulnerability was disclosed, our security team:
Identified every system in our environment that uses PHP
Checked those systems for any signs of unauthorised access, and found none
Applied the security fixes and protective measures recommended by the PHP project
Switched off some global services as a precaution while we complete our checks
What happens next
We are bringing global services back online incrementally. Each one is restored only once we have confirmed it is fully patched and secure.
What this means for you
We have not been affected. We have found no evidence that any of our systems or customer data have been accessed or compromised. Existing customer subscription remains intact. You don’t need to do anything.
Questions?
If you have any questions or concerns, please contact us, or speak to your account manager.
