PHP security update: information for BlueSky customers

BlueSky is taking urgent action following the disclosure of two critical PHP security vulnerabilities: CVE-2026-109618 and CVE-2026-109619. These vulnerabilities could allow attackers to execute unauthorised code on affected servers. PHP has released security patches to address both issues.

Our website has already received the relevant PHP security patches. BlueSky cloud services are not affected.

Our on-site servers use PHP to deliver user and administrator web pages. We are therefore undertaking an urgent programme of updates for affected customer installations.

Most customers have followed our installation guidance by placing their BlueSky Messaging System and data collection interfaces on a dedicated, restricted-access VLAN protected by a firewall. These measures significantly reduce the potential attack surface, but they do not eliminate the risk. Applying the security updates remains essential.

Our engineering team will be working intensively over the coming days to update every affected system covered by a current maintenance contract. Healthcare installations will receive priority because of the potential consequences for patient safety and critical clinical communications.

We support hundreds of installations across healthcare, industrial and hospitality facilities. Every customer matters to us, and we will complete the updates as quickly as physically possible while taking appropriate care to protect operational continuity.

Customers without a current maintenance contract will receive a quotation through their usual supply chain.

While awaiting an update, please ask your IT team to confirm that access to your BlueSky system remains restricted to authorised users and systems. If your BlueSky web interface is accessible from the internet, please contact us urgently so that we can assess the exposure and agree appropriate action. Please coordinate any proposed configuration changes with BlueSky to avoid disrupting critical messaging services.

Technical information is available in the PHP security advisory and the CVE records linked above.

For further information, or to discuss access arrangements for your system, please contact support@bluesky-wireless.co.uk or +44 (0) 1833 600336.