Earlier this week, the PHP Security Team announced the discovery of two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619), which can be exploited to allow unauthenticated remote attackers to execute arbitrary code on vulnerable servers. PHP, an open-source programming language used in web development, is present in many popular software platforms, including Wordpress, Drupal, Adobe Commerce, Joomla and phpMyAdmin. All PHP installations service web requests are considered at risk.
Sybiz is not affected by this recently discovered vulnerability. We do not utilise PHP in any part of the Sybiz applications, nor any websites or services that we host.
SuperChoice, who provide Single Touch Payroll and Sybiz Super services through the Sybiz Employer Portal, does not use PHP to deliver those services. The portal, API and gateway services are not impacted by the vulnerabilities.
No action is required of customers of Sybiz or SuperChoice with respect to the products of Sybiz or SuperChoice and the PHP vulnerabilities. Customers utilising third-party technologies integrated into Sybiz Vision should check with their relevant providers.
