Central 1 incident
INC230293 -- PHP Zero-Day Vulnerability Security Threat
Resolved after 1 hour 46 minutes, affecting Digital Banking Services, on October 22, 2026.
Central 1 recently completed an assessment of the newly disclosed zero-day vulnerabilities affecting PHP, a widely used technology that underpins many web-based platforms, including WordPress. We are aware that clients may have concerns regarding the potential impact to Forge online banking services. As part of our investigation, Central 1 reviewed the applicability of these vulnerabilities across our environment. The assessment determined that the identified PHP exposure was limited to a non-critical vanity URL redirect service used by a single client feature. As a precautionary measure, this service was taken offline. Additional housekeeping activities were also completed, including the removal of PHP from systems where it was not required and the removal of an obsolete service. As a result of these actions, the identified threat exposure has been contained, and no additional remediation activities are currently required. At this time, there is no evidence that Central 1 online banking services have been compromised or adversely affected by these vulnerabilities. We will continue to monitor the situation and follow our established security response processes should new information become available. [email protected] 1.888.889.7878 (option 2)
Affected components
Update timeline
- monitoring Oct 22, 2026, 06:25 PM UTC
Central 1 recently completed an assessment of the newly disclosed zero-day vulnerabilities affecting PHP, a widely used technology that underpins many web-based platforms, including WordPress. We are aware that clients may have concerns regarding the potential impact to Forge online banking services. As part of our investigation, Central 1 reviewed the applicability of these vulnerabilities across our environment. The assessment determined that the identified PHP exposure was limited to a non-critical vanity URL redirect service used by a single client feature. As a precautionary measure, this service was taken offline. Additional housekeeping activities were also completed, including the removal of PHP from systems where it was not required and the removal of an obsolete service. As a result of these actions, the identified threat exposure has been contained, and no additional remediation activities are currently required. At this time, there is no evidence that Central 1 online banking services have been compromised or adversely affected by these vulnerabilities. We will continue to monitor the situation and follow our established security response processes should new information become available. [email protected] 1.888.889.7878 (option 2)
Your product runs on more than Central 1
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services