Firstup is not impacted by PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619

Firstup is not impacted by the recently disclosed PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. No action is required from customers in relation to their use of Firstup.

These vulnerabilities affect PHP web runtimes and could allow an unauthenticated attacker to execute code on affected systems. More information on these vulnerabilities can be found in the links below:

• CISA: Critical vulnerabilities in PHP require immediate patching
• NCSC: Critical security issue affecting PHP

This confirmation applies to Firstup. If your organisation uses PHP in other systems, consult the relevant vendor guidance to assess those systems separately.

If you have questions regarding this announcement, please contact Firstup Support.