In relation to the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, we can confirm that we do not use PHP internally, and so our services are not directly affected.
We are querying each of our own suppliers to determine their level of exposure.
The critical suppliers in our case are our infrastructure providers. AWS, used for the majority of Safelink instances, have confirmed that their services are unaffected. Calligo, used for Channel Islands instances, are reviewing their various services and are providing updates to us as they become available.
Update as at 22 October, 18:20 BST
Our supplier review revealed that our DNS provider presented an unacceptable risk due to the use of PHP in a control panel. We migrated to an alternative DNS provider this afternoon, with all domain transfers complete except for .je and .gg domains, which are administered by channelisles.net, who have taken their systems down as a preventative action due to their own exposure. DNS changes will propagate over the coming 48 hours. There is no currently no sign that an attack was attempted through our DNS provider.
Calligo, the underlying infrastructure provider for our Channel Islands instances, are continuing to review their systems and are providing us with updates. There is no indication that any of the infrastructure we rely upon has been affected at this stage.
We will continue to update this post as we learn more.
