Your data is safe: our response to the October 2026 PHP vulnerabilities

On 21 October 2026, the PHP project released security updates for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619). These flaws affect PHP installations worldwide and could allow an attacker to run code remotely on unpatched servers. Security agencies, including CERT-EU, advised organisations to update immediately.

We know many of you store sensitive client information in SimplyBook.me, so we want to tell you clearly what we did.

What we did

We acted in two steps on 21 October 2026:

• Before the fix was available: that morning, our technical team applied the temporary protective measures recommended by the PHP project on all our servers, reducing exposure to the confirmed attack path while the official fix was pending.
• As soon as the fix was released: the official PHP updates came out that afternoon, and all SimplyBook.me production servers were updated within about three hours.

We have also reviewed our systems for any signs of exploitation and found no evidence that users data was accessed. We continue to monitor our infrastructure closely and have additional protective measures in place.

What this means for you

You do not need to take any action. Your SimplyBook.me account and the data stored in it remain protected, and the service continues to run as normal. Protecting your data is a priority for us. We follow security advisories continuously and apply critical updates as soon as they are released.

If you have any questions, please contact our support team.