A critical vulnerability in PHP was disclosed this month (CVE-2026-109618 and CVE-2026-109619), which could allow an attacker to run code on an affected server. We want to let our customers know where we stand.
Our products were not affected
BookingMachine, DirectoryLab and MentionMachine don't use PHP. They're built on Node.js and Python, so this vulnerability doesn't apply to them. We confirmed this by checking every service running on every one of our servers, not by assumption.
One separate system has been patched
Some DirectoryLab apps run their blogs on WordPress, which uses PHP. We have updated it to the patched version of PHP. These blog runs on its own isolated environment with no access to any of our products or any customer data.
You don't need to do anything
No customer data, accounts or passwords were involved, and there is nothing to change on your side.
How we approach security:
- Isolation by default. Each product and each client site runs in its own container on its own network. A problem in one can't reach another.
- Nothing exposed that doesn't need to be. Databases and internal services are never open to the internet. All public traffic goes through a single encrypted entry point.
- Least privilege. Services run with the minimum permissions they need, and application code is mounted read-only wherever possible.
- Continuous monitoring. We run our own operations platform that watches every server around the clock and alerts us immediately to problems.
- Tested backups. Backups run nightly and are checked by restoring them, not just by confirming they were written.
When a vulnerability like this is announced, we check the whole estate the same day and report back. If you have any questions, get in touch.