Following the recent NCSC advisory concerning two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), we wanted to reassure you that the Thrive platform does not use PHP.
We've also reviewed the advisory as a precaution and confirmed that the platform is not affected. There is no impact to your environment, data or users, and no action is required on your part.
Our security team continues to monitor emerging vulnerabilities as part of our standard security processes, and we'll let you know if anything changes.
Posted Oct 21, 2026 - 17:38 UTC
This incident affects: UK Platform - Prod, UK Platform - Staging, Mobile App, Content Hub, Thrive Help, Thrive Support, and Thrive Insights.