We can confirm that our customers data was not affected by the recently identified PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619).

As soon as the advisories were published on 21st October 2026, our team immediately checked all codebases and server configurations across our environments. Our production application environments and systems do not use PHP, meaning these vulnerabilities pose no risk to our customers data or our platforms.

For reference, our public ‘brochure’ website, www.sardjv.co.uk, uses PHP, but this is in an entirely separate environment from our production systems and has no connection to our customers provisioned services or data. Our brochure site was also patched prior to the event by the hosts.

In addition, all of our services are further protected by Cloudflare, which already had updated blocking rules in place before the vulnerabilities were made public.