On 21 October 2026, two critical vulnerabilities were disclosed in PHP: CVE-2026-109618 and CVE-2026-109619. We're aware that many organisations are reviewing their supply chains, and we want to give our customers a clear answer.
The RightCheck platform is not affected. Our candidate applications, HR portal, APIs and integrations do not use PHP anywhere.
Exposure: None. No RightCheck service runs PHP.
Connected services: Some of our services connect to national data sources and screening partners, such as the Home Office, DBS and credit reference agencies. These organisations operate their own independent systems. We are seeking confirmation from them and from our hosting provider, and will update this page once we have their responses.
Remediation: No patching is needed because the affected software is not part of our platform.
Security review: Because PHP is not part of our platform, these vulnerabilities cannot be exploited against our services. Our standard security monitoring continues as normal.
Customer impact: None. Your data, your candidates' data and your integrations are unaffected, and you don't need to do anything.
If you need formal confirmation for your supplier assurance records, please contact your Account Manager.
