PHP Vulnerability - Xero Maintenance

Update timeline

1. identified Oct 22, 2026, 12:46 PM UTC

   Dear Customer, We would like to provide a further update on the global PHP vulnerability issue. We have previously established that Access PaySuite does not use PHP in any of our product codebases, features or functions, so the vulnerability has no effect on the products and services you use. However, the third-party Xero connector for DDCMS does require patching. The connector is protected by Cloudflare, but a patch is necessary. To apply it successfully, we have temporarily closed the connector. We will let you know when this is back online. This may be several days and lead into next week. If you use the Xero connector for DDCMS, please note the following impacts during the downtime: Invoice updates will not be saved. Requests made through the connector while it is closed, including invoice updates, will not be applied. Please complete any invoice changes after the connector is back online and check your invoices once the connector has been restored. If you find an error, amend and re-save the affected invoice to update it through the connector. Payment links will be unavailable. Payment links on invoices will not work while the connector is closed. We are reaching out to Xero to understand if the links will still work once the connector is back online. In the interim, you may need to take payments by other means. We will communicate to you once it is back online. We apologise for any inconvenience this may cause. We’re here to help To contact our support team, use the live chat feature in DDCMS (chat bubble, bottom right) or call 01206 675847 (option 1), Monday to Friday, 8:00am–5:30pm. For 24/7 support, visit our knowledge base with over 400 articles or use our AI Assistant for instant answers. Kind regards, Access PaySuite

2. identified Oct 23, 2026, 10:04 AM UTC

   Dear Customer, We would like to provide a further update on the global PHP vulnerability issue. As previously confirmed, Access PaySuite does not use PHP in any of our product codebases, features or functions, so the vulnerability has no effect on the products and services you use. However, the third-party Xero connector for DDCMS required patching. The connector is protected by Cloudflare, but a patch is still necessary. Our team has worked hard to develop a solution that patches the connector as quickly as possible. The solution is now entering testing, and we expect to push the updated connector live on Monday 26 October 2026. To apply the patch safely, the connector will remain closed. Until it is back online, the following impacts apply to users of the Xero connector for DDCMS: Invoice updates will not be saved. Requests made through the connector while it is closed, including invoice updates, will not be applied. Please complete any invoice changes after the connector is back online, then check your invoices. If you find an error, amend and re-save the affected invoice to update it through the connector. Payment links will be unavailable. Payment links on invoices will not work while the connector is closed. In the meantime, you may need to take payments by other means. These impacts remain in place until the updated connector is live. We will update you again once it is in place. We apologise for any inconvenience this may cause. We’re here to help To contact our support team, use the live chat feature in DDCMS (chat bubble, bottom right) or call 01206 675847 (option 1), Monday to Friday, 8:00am–5:30pm. For 24/7 support, visit our knowledge base with over 400 articles or use our AI Assistant for instant answers. Kind regards, Access PaySuite