This announcement does not apply to our clients who are using the Odoo ERP system as Odoo does not run on PHP, and so is not affected.
Remain calm, we've got you covered
Every system we host and manage, including our clients' systems, is now running a secure version of PHP. We have found no sign that any of our systems, or any of our clients' systems, were compromised.
Yesterday the PHP project released emergency fixes for two critical security flaws. You may have seen the news, and we want you to hear directly from us about what it means for you: in short, you are protected and there is nothing you need to do.
What was announced
On 21 October 2026 the PHP project published fixes for two critical vulnerabilities in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed "PHP2Shell". PHP is the programming language behind a large share of the world's websites and web applications.
Both flaws are rated 9.2 out of 10 for severity. On an unpatched server, they could let an attacker run their own code remotely without needing to log in. They affect almost every version of PHP in use, from 5.4 up to 8.5.11.
The fix is to upgrade to one of the patched releases (8.5.12, 8.4.27, 8.3.36 or 8.2.35) or to the equivalent update from an operating system vendor. Details leaked a day before the official release, so organisations everywhere have treated patching as urgent. So did we.
What we have done
All updates are complete. We acted as soon as the fixes were available, in two parts.
- Standard systems were updated automatically. Our hosting infrastructure is built to apply security updates quickly and consistently, so most systems moved to a secure version of PHP without any manual work or downtime.
- Bespoke systems were updated by hand. Applications we have custom-built for clients were updated individually by our team and checked to confirm they are working normally.
This is exactly the situation our infrastructure is designed for. When a serious vulnerability is announced, speed matters, and being able to patch at scale meant our team could give its full attention to the systems that needed individual care.
No signs of compromise
Alongside the updates, we checked for any sign that these flaws had been used against us or our clients. We found none, on our own systems or on any client system.
We will keep watching closely over the coming days as more information about these vulnerabilities emerges, and we will contact you directly if anything changes.
What you need to do
Nothing, for any system we host or manage. Your services are already running on secure versions and no action is required on your part.
If you also run websites or applications on servers that we do not manage, check with whoever looks after them that PHP has been updated to a patched release.
Questions?
Keeping your systems secure is a core part of what we do, and this week showed that investment paying off. If you have any questions about these vulnerabilities or your systems, please get in touch with your account manager or our support team.