Skip to main content
OneAdvanced Software (return to the home page)

PHP Investigation Updates

PHP Investigation Update: 22 October 2026, 18:45 

Our approach 

As soon as the vulnerability was disclosed, we used live data from our security vulnerability management tooling to prioritise patching and mitigation, and we continue to validate the results through ongoing scanning. 

Status of OneAdvanced products containing PHP code 

Across our estate 5 software products contained PHP code: 

  • Governance & Risk: all systems patched as of 21/10. 
  • Virtual Smartcard: core application patched as of 21/10. Non-essential services, including analytics, are being restored, with no impact to the core service. 
  • Job Manager: only the SMS server was affected, and it has been patched. All hosted systems patched as of 21/10. 
  • Time & Attendance: legacy terminal firmware (such as that running in the MF prefixed clocking devices) contains a PHP component that customers were advised to disable using the "Disable web server" option (this option is available from firmware v7.48.5).  Disabling this component completely removes any PHP vulnerabilities from the device without impacting normal functionality. Guidance for customers who are yet to disable PHP on their devices can be found here: Deactivate and Reactivate the terminal webpage - HelpDocs. Please contact the Service Centre for assistance.
  • DRS: patches are available for all Limited and Active versions, and hosted patching is under way. Customers on retired versions are being contacted directly. 

Status of OneAdvanced products containing no PHP code 

All other software products developed by OneAdvanced and not listed above contain no PHP code. They were therefore, not impacted by the reported vulnerability and no further action is required to be taken by OneAdvanced or our customers.

PHP Investigation Update: 22 October 2026, 13:00 

On 21 October 2026 an exposure to technology containing PHP code was identified and has been widely reported in the media. 

We are currently undergoing active investigation and, where required, remediation.   

As part of our investigation, we are: 

  • Working through where PHP is used across our products and supporting infrastructure
  • Reviewing the full advisory as soon as it is published and assessing our exposure against it
  • Prioritising remediation or mitigation in line with our vulnerability management process
  • Monitoring for any indication of exploitation 

We will provide regular updates regarding this incident here, including any notable changes and our confirmed position. 

Existing customers should contact our Service Centre with any further questions. 

PHP Investigation Updates