Statement on the PHP security vulnerabilities

On 21 October, the PHP project disclosed two critical vulnerabilities in PHP, the programming language that underpins a large share of the web. The UK's National Cyber Security Centre and CISA in the US both issued guidance urging organisations to update immediately.

Iris runs on PHP, so we want to tell you directly where we stand.

We applied the prescribed security updates to our servers overnight. Iris is fully patched and operating normally, with no interruption to service at any point.

Our monitoring has shown no evidence of unauthorised access or unusual activity on our systems. We extended our log review to cover the days before the vulnerabilities were made public, and we are continuing to monitor closely.

There is nothing you need to do. No action is required from you, and there is no need to change your Iris login details.

If you have questions, or your own security team would like more detail for their records, contact us at [email protected] and we will come back to you.