How we ensured your services were protected from the recent PHP security risk
When a new cyber security risk emerges, receiving the right information quickly helps you take action. That is why we use MyNCSC, and why we encourage other UK organisations to do the same.
Following the disclosure of PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, we want to explain how we responded and reassure customers about their services.
Our tracking platforms were not exposed
Our tracking platforms were not exposed to the risk posed by these two vulnerabilities.
We also patched all our other services on 21 October 2026, addressing these vulnerabilities across those services.
Customers can be reassured that our tracking platforms were not exposed and our other services have been patched against CVE-2026-109618 and CVE-2026-109619.
What was the risk?
The vulnerabilities affected PHP, a technology used to run websites and online applications. They could allow attackers to execute code remotely on vulnerable systems.
The PHP team released security updates on 21 October and urged users to update immediately.
This highlights why staying informed matters. A security issue can require urgent attention even when a website or service appears to be working normally.
How MyNCSC helped us respond
We use MyNCSC, which notified us of the emerging risk. This helped us respond promptly and complete patching across our other services on 21 October.
MyNCSC provides access to services from the National Cyber Security Centre, including its free Early Warning service for UK organisations. Early Warning can notify organisations about potential threats, malicious activity and vulnerable services associated with their registered network details.
Our main message to other businesses is simple: make use of this free support.
Receiving an alert is only the first step
An alert needs someone ready to act on it.
Ensure notifications reach the right person, that they understand which services your organisation uses, and that they can arrange updates with your IT team or provider.
Early Warning works alongside your existing security measures, helping you make informed decisions and respond to potential problems.
A free service worth signing up for
Whether you run a small business, a charity or a larger organisation, we encourage you to explore MyNCSC and register for the services available to you.
We use it ourselves, and this recent alert demonstrates the value of staying informed and being ready to respond.
Check out our range of Complexus Trackers here.
For more information visit:
- our website  https://complexus.uk
- or email us at info@complexus.uk
When a new cyber security risk emerges, receiving the right information quickly helps you take action. That is why we use MyNCSC, and why we encourage other UK organisations to do the same.
Following the disclosure of PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, we want to explain how we responded and reassure customers about their services.
Our tracking platforms were not exposed
Our tracking platforms were not exposed to the risk posed by these two vulnerabilities.
We also patched all our other services on 21 October 2026, addressing these vulnerabilities across those services.
Customers can be reassured that our tracking platforms were not exposed and our other services have been patched against CVE-2026-109618 and CVE-2026-109619.
What was the risk?
The vulnerabilities affected PHP, a technology used to run websites and online applications. They could allow attackers to execute code remotely on vulnerable systems.
The PHP team released security updates on 21 October and urged users to update immediately.
This highlights why staying informed matters. A security issue can require urgent attention even when a website or service appears to be working normally.
How MyNCSC helped us respond
We use MyNCSC, which notified us of the emerging risk. This helped us respond promptly and complete patching across our other services on 21 October.
MyNCSC provides access to services from the National Cyber Security Centre, including its free Early Warning service for UK organisations. Early Warning can notify organisations about potential threats, malicious activity and vulnerable services associated with their registered network details.
Our main message to other businesses is simple: make use of this free support.
Receiving an alert is only the first step
An alert needs someone ready to act on it.
Ensure notifications reach the right person, that they understand which services your organisation uses, and that they can arrange updates with your IT team or provider.
Early Warning works alongside your existing security measures, helping you make informed decisions and respond to potential problems.
A free service worth signing up for
Whether you run a small business, a charity or a larger organisation, we encourage you to explore MyNCSC and register for the services available to you.
We use it ourselves, and this recent alert demonstrates the value of staying informed and being ready to respond.
Check out our range of Complexus Trackers here.
For more information visit:
- our website  https://complexus.uk
- or email us at info@complexus.uk