Status: RESOLVED
Updated: 23 October 2026, 14:41 BST
Summary
Arbor MIS was running a version of PHP affected by two recently disclosed critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The official security patches have been applied.
What we can confirm
We prepared for the upgrade as soon as PHP gave advance warning of a critical fix. Before the fix was available, we put protective measures in place, including temporarily pausing file uploads. We have applied the fix to Arbor MIS and restored file uploads. Our investigation has concluded and found no evidence of compromise. No customer data was accessed.
What we are doing
The fix is in place. We do not expect to publish further updates to this notice.
What you need to do
No action is required.
Update log
- 23 October 2026, 14:41 BST: Statement published.
For additional questions or information contact: myteam@arbor-education.com