PHP critical security vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
Incident
Report for Evolve IP UK
Resolved
This will now be closed off since all vendors have confirmed they are secure
Monitoring
Evolve IP have now completed a full review of their vendors, and we are happy to confirm that all vendors whose services we utilise have taken the mitigating actions for this vulnerability and are now secure.
Thank you for your patience during this time.
Thank you for your patience during this time.
Update
Following the notification of the PHP vulnerability, Evolve IP has been reviewing their internal systems and taken the required measures.
Evolve IP has also been liaising with our vendors to check if any services utilised by Evolve IP and its customers are exposed to the PHP vulnerability.
Our vendor review is ongoing. We only have one vendor affected by this vulnerability and they are currently working on a plan to mitigate the vulnerability. We are still working with some of our vendors to get a complete picture of potential exposure, but as it currently stands, the exposure is very low.
We will provide a further update once we get a response from all our vendors and get a complete picture of any exposure to this vulnerability.
Evolve IP has also been liaising with our vendors to check if any services utilised by Evolve IP and its customers are exposed to the PHP vulnerability.
Our vendor review is ongoing. We only have one vendor affected by this vulnerability and they are currently working on a plan to mitigate the vulnerability. We are still working with some of our vendors to get a complete picture of potential exposure, but as it currently stands, the exposure is very low.
We will provide a further update once we get a response from all our vendors and get a complete picture of any exposure to this vulnerability.
Update
Further Update:
Halo have confirmed they do not use PHP and is not affected by these vulnerabilities.
Halo have confirmed they do not use PHP and is not affected by these vulnerabilities.
Investigating
On 20 October 2026, the PHP Foundation announced two critical vulnerabilities affecting PHP. The UK National Cyber Security Centre (NCSC) has advised organisations to prepare to update affected systems. A security patch is due for release at 15:00 BST today.
We can confirm that the Anywhere portal is not built on PHP and is not affected by these vulnerabilities.
We are continuing to review this issue with each of our vendors to confirm whether any other EvolveIP services are affected and whether patching is required. We will provide further updates as we get further information.
For further information, see the NCSC guidance: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php
We can confirm that the Anywhere portal is not built on PHP and is not affected by these vulnerabilities.
We are continuing to review this issue with each of our vendors to confirm whether any other EvolveIP services are affected and whether patching is required. We will provide further updates as we get further information.
For further information, see the NCSC guidance: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php