PHP security update: FMIS software is unaffected
FMIS software and application hosting environments do not use PHP and are unaffected by these vulnerabilities.
Written by: John de Robeck • Published: October 22, 2026 • Updated: October 22, 2026
FMIS software does not use PHP and is unaffected by the PHP vulnerabilities reported in October 2026. Our technical team has also confirmed that FMIS application hosting environments do not use PHP.
What does this mean for FMIS customers?
- FMIS software and application hosting are unaffected by CVE-2026-109618 and CVE-2026-109619 because they do not use PHP.
- No PHP-specific update is required for FMIS software in response to these two vulnerabilities.
This confirmation is specific to FMIS software and application hosting. It does not cover separate systems or third-party services that customers operate, which should be assessed by their respective technical owners.
What has been reported?
On 21 October 2026, the PHP project released security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. PHP is a server-side scripting language used by many websites and web applications.
The flaws concern memory handling and internal state retained between requests. Under certain conditions, they can allow an attacker to run code on an affected server without authenticating. Further technical details and fixed versions are available in the PHP security announcement and the advisories for CVE-2026-109618 and CVE-2026-109619.
Guidance for other PHP-based systems
Organisations using PHP elsewhere should follow the NCSC’s PHP guidance on identifying affected systems and applying vendor updates. Where immediate patching is not possible, consult its qualified advice on temporary mitigations, taking systems offline and checking for compromise. PHP cautions that temporary measures do not provide complete protection.
Further security information
The FMIS Trust Centre provides further information about our approach to security, data protection and service assurance.
This update records the position on 21 October 2026. Refer to the linked PHP and NCSC advisories for subsequent changes.
Share this update
SOLUTIONS
Market Sectors
FOLLOW US
CONTACT US
FMIS Ltd
167b John Wilson Business Park
Whitstable
Kent
CT5 3RA
United Kingdom
Phone:+44 (0) 1227 773003
Fax:+44 (0) 1227 773005
Sales:sales@fmis.co.uk
Support:support@fmis.co.uk
