Security Advisory: PHP Remote Code Execution Vulnerabilities, Update 2

Summary

On Friday 23 October 2026, the affected microservice was updated to a patched version of PHP, validated, and restored to service.

Electronic submissions to all affected lenders are available again.

What was done

• The microservice was updated to a PHP version that fixes both vulnerabilities.
• The updated service was tested and passed security validation before it was re-enabled.
• Triskele Labs, our CREST-accredited security operations partner, reviewed activity on the service. The review found no indicators of exploitation.

Customer impact

Electronic submissions to a limited number of lenders were unavailable from 22 October until the service was restored on 23 October.

Throughout this period, the rest of the youX platform remained fully operational.

Customer action

No action is required. Applications that were submitted through lenders’ alternative channels during the disruption do not need to be resubmitted.

For further assistance, please contact support@youxpowered.com.au.