SpacetoCo is not affected by the critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, and our customers don't need to take any action.
Keeping your account and your data safe is our top priority. When security alerts like these appear, we know the first question many of our customers ask is simple: are we exposed? We want to answer that clearly and quickly.
Two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, have recently been disclosed. PHP is a widely used programming language, so these alerts have a broad reach.
In response, many IT and security teams are auditing their software vendors to check for potential exposure. If your organisation is doing the same, this post is for you.
No. SpacetoCo does not use PHP anywhere within our platform. That includes:
Because PHP isn't part of our technology stack, SpacetoCo is completely unaffected by these vulnerabilities.
Nothing. No action is required on your end regarding your use of SpacetoCo. You can keep managing your venues and bookings as normal.
If your security team is compiling a vendor exposure list, you can record SpacetoCo as not affected and link to this post.
If you or your security team would like further reassurance, or have questions about how we protect your account, please get in touch at info@spacetoco.com. We're always happy to help.
Thank you for helping us keep your account secure.