Update on PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619)

The Investor Compass platform runs on PHP, hosted on AWS. Our technology team assessed both vulnerabilities (CVE-2026-109618 and CVE-2026-109619) on the afternoon they were disclosed. Our assessment was that they affect our platform, but the exposure threat level is low. The Investor Compass API and web-apps are externally facing.

Mitigations and Remediation
A few hours after the vulnerabilities were exposed we applied a mitigation to the platform that blocks the type of request that one of the vulnerabilities relies on before it can reach PHP. Our assessment is that this reduces the exposure to close to zero, but not to zero.

The next day we upgraded the PHP version that supports the platform, which closed both vulnerabilities. This update was rolled out to all of our customers with zero downtime and zero disruption.

As ever, if you have any questions, comments or concerns with our platforms or service, please raise a support request or contact your account manager and we'll be happy to help!