News
Update on the global PHP security vulnerability
23/10/2026
Last updated: 22 October 2026, 21:10 CEST
This week, a critical security vulnerability was disclosed in PHP, a programming language that runs a large share of the world’s websites and web applications. National cybersecurity agencies, including the UK’s NCSC and the US agency CISA, have urged organisations everywhere to act quickly.
We want to reassure you that we have the situation under control.
What happened
On 21 October 2026, the PHP project released a security update for two vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Under certain conditions, these flaws could let an attacker run commands on a web server running PHP without needing to log in. The vulnerabilities affect PHP across all versions, so organisations worldwide are reviewing their systems.
What we have done
As soon as the vulnerability was disclosed, our security team:
- Identified every system in our environment that uses PHP
- As a precaution, briefly took some applications offline while we assessed them
- Applied the security fixes and protective measures recommended by the PHP project
- Checked our systems for any signs of unauthorised access, and found none
- Restored applications as each one is confirmed secure. Some remain offline as a precaution while our investigation continues.
What this means for you
- Your data is safe. We have found no evidence that any customer data was accessed or compromised.
- You don’t need to do anything.
Questions?
If you have any questions or concerns, please contact your account manager or our support team at contacto@construdata21.com. We will update this page if anything changes.
Thank you for your trust.
The Hubexo Team