Skip to content
English
Technical Support
  • There are no suggestions because the search field is empty.

Is Halo affected by PHP vulnerabilities? 

You may have seen reports this week of two critical security vulnerabilities in PHP, a programming language used by a large number of websites and web applications. We can confirm that the Halo System is not affected, and there is nothing you need to do.

At Halo, we take our motto 'let's protect everyone' literally. Meaning we care just as much about protecting you as we do your public. Protecting the people who rely on Halo means taking the security of our own platform just as seriously, and we want to be open with you whenever an issue in the wider industry could raise questions about it.

You may have seen reports this week of two critical security vulnerabilities in PHP, a programming language used by a large number of websites and web applications. We can confirm that the Halo System is not affected, and there is nothing you need to do.

We’ve set out the detail below in case it’s useful for your own information security or assurance teams.

Does the Halo System use PHP?
No. The Halo System, including HaloHub, HaloDashboard and HaloApp, is not built on PHP. It runs on a serverless architecture within Amazon Web Services, so the platform that processes and stores your data has no PHP runtime.

Is any part of Halo affected?
The only PHP component we operate is our public marketing website, halosolutions.com, which is built on WordPress. It is entirely separate from the Halo System and holds no customer data.

The website is hosted by WP Engine, a managed WordPress hosting provider. WP Engine applied protective measures at both the network and hosting layers before the PHP patches were released. It then completed deployment of the patched PHP versions across its platform at 02:19am (UK time) on 22 October 2026. No further action is required.

Has there been any indication of compromise?
No. We have found no indication of compromise or suspicious activity associated with these vulnerabilities.

How we manage vulnerabilities more broadly
We continuously scan the Halo System’s infrastructure and code dependencies with automated security tools, and we commission regular independent penetration testing. Each issue we find is rated by severity and fixed within defined timescales under our ISO 27001-certified information security management system.

Halo holds ISO 27001, Cyber Essentials Plus and IASME Gold GDPR certifications. Our full security documentation is available through the Halo Trust Centre.