It was recently announced that two critical security vulnerabilities were discovered within PHP, a programming language that is used to power a large number of websites and online services, including parts of our eyworks platform. This pair of vulnerabilities has been referred to as "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619).

Some of our customers have understandably expressed concern about the affect this might have on their data, so in this article we've detailed what actions we've taken in response, and what we will do moving forward.

• Upon learning about the vulnerabilities, we added extra protections across our systems to block known methods of attack.

• Shortly after announcing the vulnerabilities, the PHP Foundation released a patch to fix the issue. We have since applied the security fix across our platform, after testing it carefully with our quality assurance team.

• We have reviewed our systems and found no evidence that any customer data has been accessed or affected.

Security is an ongoing process, not a one-off fix. We will:

• continue to monitor our systems closely for any unusual activity;

• keep track of security advisories from our technology suppliers and the wider security community;

• review and apply further security updates as they become available;

• keep our protective measures under regular review and strengthen them where needed.

Nothing. There is no action required from you or your team, and no changes have been made to functionality of the eyworks system.

We know how much trust you place in us to look after information about the children, families and staff in your care. Protecting that information is a responsibility we take very seriously.

If you have any questions, please contact our support team at support@eyworks.co.uk.