NCSC alert on critical PHP security issue (CVE-2026-109618 / CVE-2026-109619)

You may have seen the NCSC alert about a critical security issue affecting PHP. This note explains what we have done. What the issue is: Two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, could allow an attacker to trigger an out-of-memory condition in PHP that corrupts memory. Under certain conditions, this could be exploited to run code remotely without logging in. The issue affects all supported versions of PHP. The PHP project has now released a fix. What we have done: • Audit and interim measures: On the morning of 21 October, as soon as we learned of the vulnerabilities, we audited every Simwood service that uses PHP. Where the PHP project recommended interim mitigations, we applied them, so affected services were protected before a fix existed. • Patching: The fix was released at 15:00 (UK time) on 21 October. We treated it as urgent and updated every affected service to the fixed version. • Verification: We then checked each service to confirm the fixed version was running and the service was working normally. Current position: Based on these actions, we believe our services are protected against these vulnerabilities and customer data remains secure. We will keep watching guidance from the NCSC and the PHP project, including any updates to products that bundle PHP, and act on it promptly. Do you need to do anything? You don't need to do anything about the Simwood services we provide. If you run PHP on your own systems, we recommend following the NCSC's advice: • find every PHP installation, internet-facing ones first; • update to the latest fixed version; • if you can’t update straight away, apply the PHP project’s temporary mitigations or take the application offline. If you have any questions, please contact our support team.