Security Advisory: PHP Remote Code Execution Vulnerabilities (CVE-2026-109618 / CVE-2026-109619)
Overview
On 21 October 2026, critical vulnerabilities were disclosed affecting certain versions of the PHP runtime.
While the core youX platform does not use PHP, we identified one supporting microservice operating on an affected version.
In line with our security response procedures, we proactively disabled the service while remediation and additional security checks are undertaken.
Our response
Following disclosure of the vulnerabilities, our technology and security teams initiated the following actions:
- Immediate containment: The affected microservice was disabled as a precaution to prevent potential exploitation.
- Remediation: The service is being updated to a patched PHP version and will undergo testing before being restored to production.
- Independent security review: We are working with Triskele Labs, our CREST-accredited security operations partner, to review relevant activity for any indicators of exploitation.
- Customer communication: A notification has been published within the youX platform advising users of the temporary service interruption to the affected microservice.
Customer impact
The affected microservice supports electronic submissions to certain lenders.
While remediation is underway, some users may experience temporary interruptions when submitting applications electronically to these lenders.
All other platform functionality remains operational.
Where an electronic submission is unavailable, users can continue to submit applications through the relevant lender’s alternative submission channels.
Next steps
Our priority is to complete remediation, validate the updated service and restore normal functionality as quickly and safely as possible.
We are targeting restoration by the end of 22 October 2026, subject to successful testing and security validation.
We will publish a further update once the service has been restored and our security review is complete.
Do customers need to take action?
No security-related action is required from youX customers at this stage.
Customers experiencing difficulties with electronic lender submissions should use the relevant lender’s alternative submission channel or contact youX Support for assistance.
Further information
For questions or assistance, please contact your youX account manager or support@youxpowered.com.au.
youX remains committed to maintaining a secure, reliable platform and providing transparent communication on matters affecting our services.