Security notice: critical PHP vulnerability (CVE-2026-109618 and CVE-2026-109619)
Two security vulnerabilities affecting PHP have recently been disclosed. Hellenic’s web-based products use PHP, so we want customers to know about them.
The UK National Cyber Security Centre (NCSC) has published guidance on the issue, which you can read here: Critical security issue affecting PHP – NCSC.
Whether a system is affected depends on the PHP version installed and the version of Hellenic software in use. We do not have direct access to customer systems, so we cannot check installations remotely.
What you should do
If you use a Hellenic web product and are unsure whether your installation is affected, please email our software support team at softwaresupport@hellenic.co.uk as soon as possible, with:
- Your PHP version
- Your Hellenic software version(s)
- Your site name or customer reference
We will advise you on the next steps and, where needed, arrange a time to review your setup with you.
Before updating PHP on a system that runs Hellenic software, please contact us so we can confirm the update is compatible with your version.
Security updates
To get future security notices from Hellenic by email, please sign up here.