Following the recent NCSC advisory concerning critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), we have reviewed all our systems and suppliers. Our exposure was limited to the hosting provider for our public WordPress website, www.matrixbooking.com. The Matrix Booking platform was not affected and no client data was at risk.
Our website hosting provider has confirmed that its infrastructure team applied security fixes covering both CVE-2026-109618 and CVE-2026-109619. They have also advised that they will deploy the official security update, but we are still awaiting confirmation that this has been completed.
We are following up for confirmation of the permanent fix and the PHP version or patched package. Until then, we are treating remediation as pending verification.
This update relates specifically to the public website only. It does not have any impact on the Matrix Booking application or customer environments or customer data.