This week, a critical security vulnerability was disclosed in PHP, a programming language that runs a large share of the world’s websites and web applications. National cybersecurity agencies, including the UK’s NCSC and the US agency CISA, have urged organisations everywhere to act quickly.
We want to reassure you that we have not been affected, and our teams are continuing to work as normal. As a precaution, we have temporarily switched off some services across the broader Hubexo group of companies, and are bringing them back online step-by-step, but this doesn’t impact services in the UK.
On 21 October 2026, the PHP project released a security update for two vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Under certain conditions, these flaws could let an attacker run commands on a web server running PHP without needing to log in. The vulnerabilities affect PHP across all versions, so organisations worldwide are reviewing their systems.
As soon as the vulnerability was disclosed, our security team:
Identified every system in our environment that uses PHP
Checked those systems for any signs of unauthorised access, and found none
Applied the security fixes and protective measures recommended by the PHP project
Switched off some global services as a precaution while we complete our checks
We are bringing global services back online incrementally. Each one is restored only once we have confirmed it is fully patched and secure.
We have not been affected. We have found no evidence that any of our systems or customer data have been accessed or compromised. Existing customer subscription remains intact. You don’t need to do anything.
If you have any questions or concerns, please contact us, or speak to your account manager.