Skip to main content
OneAdvanced Software (return to the home page)

PHP Investigation Updates

PHP Investigation Update: 23 October 2026, 17:00

Our position

We have mitigated all risks identified across our estate. Details of the products affected, and the actions taken are in our update of 22 October 2026, 18:45, below.

Ongoing vigilance

Our security resilience work continues:

  • Vulnerability scanning: we continue to use our vulnerability management tools to monitor our estate. This confirms that our patching and mitigation remain effective.
  • Threat monitoring: we are actively and proactively monitoring for known indicators of compromise (IoCs) regarding the reported PHP vulnerability.  
  • Third parties: we continue to work with our third-party suppliers and partners to maintain security resilience across our supply chain.

What this means for customers

The required actions for Time & Attendance and DRS customers are outlined in the update below (PHP Investigation Update: 22 October 2026, 18:45).

Existing customers should contact our Service Centre with any further questions. We will update this page if our position changes.

 

PHP Investigation Update: 22 October 2026, 18:45 

Our approach 

As soon as the vulnerability was disclosed, we used live data from our security vulnerability management tooling to prioritise patching and mitigation, and we continue to validate the results through ongoing scanning. 

Status of OneAdvanced products containing PHP code 

Across our estate 5 software products contained PHP code: 

  • Governance & Risk: all systems patched as of 21/10. 
  • Virtual Smartcard: core application patched as of 21/10. Non-essential services, including analytics, are being restored, with no impact to the core service. 
  • Job Manager: only the SMS server was affected, and it has been patched. All hosted systems patched as of 21/10. 
  • Time & Attendance: legacy terminal firmware (such as that running in the MF prefixed clocking devices) contains a PHP component that customers were advised to disable using the "Disable web server" option (this option is available from firmware v7.48.5).  Disabling this component completely removes any PHP vulnerabilities from the device without impacting normal functionality. Guidance for customers who are yet to disable PHP on their devices can be found here: Deactivate and Reactivate the terminal webpage - HelpDocs. Please contact the Service Centre for assistance.
  • DRS: patches are available for all Limited and Active versions, and hosted patching is under way. Customers on retired versions are being contacted directly. 

Status of OneAdvanced products containing no PHP code 

All other software products developed by OneAdvanced and not listed above contain no PHP code. They were therefore, not impacted by the reported vulnerability and no further action is required to be taken by OneAdvanced or our customers.

 

PHP Investigation Update: 22 October 2026, 13:00 

On 21 October 2026 an exposure to technology containing PHP code was identified and has been widely reported in the media. 

We are currently undergoing active investigation and, where required, remediation.   

As part of our investigation, we are: 

  • Working through where PHP is used across our products and supporting infrastructure
  • Reviewing the full advisory as soon as it is published and assessing our exposure against it
  • Prioritising remediation or mitigation in line with our vulnerability management process
  • Monitoring for any indication of exploitation 

We will provide regular updates regarding this incident here, including any notable changes and our confirmed position. 

Existing customers should contact our Service Centre with any further questions. 

PHP Investigation Updates