22/10/2026
We know about the critical PHP vulnerability recently highlighted by the UK’s National Cyber Security Centre (NCSC) [CVE-2026-109618 and CVE-2026-109619]¹. Protecting our customers and their data is our top priority, so we acted on it straight away.
Bud is not affected
We have audited our entire estate. Bud does not use PHP anywhere in its products or supporting infrastructure, so this vulnerability does not directly affect Bud.
Further protection
Bud’s services sit behind Cloudflare, an enterprise-grade web application firewall. Cloudflare has updated its managed rule set to detect and block attempts to exploit this vulnerability². This adds a further layer of protection on top of our own controls.
Our supply chain
We are also talking to our suppliers to confirm that any who are affected are taking the necessary steps to fix the issue, in line with NCSC guidance. We will keep monitoring the situation and will update this statement if anything changes.
If you have any questions, please contact us via the usual channels or visit the Bud Trust Portal.
Sources
- NCSC, Critical security issue affecting PHP: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php
- Cloudflare, PHP vulnerabilities: WAF protection: https://blog.cloudflare.com/php-vulnerabilities-waf-protection/
Related to