We understand that you may be worried about the PHP vulnerability reported recently for CVE-2026-109618 and CVE-2026-109619. This statement is published by CraignDave Ltd:
- We have assessed the impact for our own environment and all our relevant third party dependencies including hosting providers, cloud services, software components and subcontractors.
- No exploits have been identified in our systems or those of our third parties.
- No product, platform, hosted service, website, application, appliance or integration has been compromised.
- Smart Revise is unaffected by PHP exploits as it does not use PHP in any way.
- Security patches were applied by our hosting provider addressing both CVE-2026-109618 and CVE-2026-109619 on 21/10/2026.
- Our servers are protected by Imunify360 Web Application Firewall rules specifically designed to mitigate exploitation of these CVEs, providing an additional layer of protection alongside the patched PHP packages.
- Our servers are running PHP 8.3.36 containing the required security fixes.
- Our overall assessment of the risk to schools is low. This conclusion is based on the points above. There could be further vulnerabilities that have not been found or disclosed to the public.
- Should any vulnerabiltiies be discovered that compromise data we would inform schools.