Temporary unavailability of some Access services (PHP)

Update timeline

1. identified Oct 22, 2026, 08:31 AM UTC

   Dear customer, We are writing to let you know that Access Colins and Access Tonic are temporarily offline. We are checking with the application of the security update competed yesterday for the PHP vulnerabilities (PHP2Shell, CVE-2026-109618 and CVE-2026-109619) and as a precaution, and while we check the installation, we have taken the software offline. We have not taken this decision lightly. We recognise the disruption this causes and we apologise for the inconvenience. This issue affects companies across the world, and we are acting responsibly to keep our systems and our customers safe. We will restore service only once we are satisfied that it is safe to do so and will provide a further update in the next 2 hours. To confirm, we have no evidence that customer data has been affected. We continue to investigate and will update you if this changes. If you have any questions, please contact your support team, who will be happy to help. We apologise for the disruption and thank you for your patience. The Access Group

2. identified Oct 22, 2026, 10:55 AM UTC

   Dear Customer, We are writing with a further update on Access Collins and Access Tonic, which remain temporarily offline. While checking the installation of the security update for the PHP vulnerabilities (PHP2Shell, CVE-2026-109618 and CVE-2026-109619), we found that the patch needs to be re-applied to ensure it is fully installed. This has now been completed, and our teams are currently testing the update. Once testing has ben completed we will apply to live and restore service. We will provide a further update within the next hour. To confirm, we have no evidence that customer data has been affected. We continue to investigate and will update you if this changes. We apologise for the disruption and thank you for your patience. The Access Group

3. identified Oct 22, 2026, 12:19 PM UTC

   Dear customer, We are writing with a further update on Access Collins and Access Tonic, which remain temporarily offline. This is part of our response to two critical vulnerabilities in PHP, a widely used web technology. They were publicly disclosed (PHP2Shell, CVE-2026-109618 and CVE-2026-109619) and affect organisations worldwide. We are responding to information as quickly as we receive it. Our engineering team is testing the security update. We will restore service once testing is complete and we are satisfied that it is safe to do so. We will provide a further update in 1 hour. To confirm, we have no evidence that customer data has been affected. We continue to investigate and will tell you if this changes. If you have any questions, please contact your support team, who will be happy to help. We apologise for the inconvenience this is causing. The Access Group

4. identified Oct 22, 2026, 01:59 PM UTC

   Dear Customer, Thank you for your continued patience while we work to restore the Collins and Tonic service. We understand how disruptive this outage is for your bookings and day-to-day operations, and we are sorry for the inconvenience it is causing you and your guests. Our teams are currently testing the work carried out so far. Testing is ongoing, and we will update you as soon as it has been completed and plans to restore service. We appreciate that you may have questions about the incident, what it means for your bookings, and what happens next. We are currently preparing a frequently asked questions document, which we will share in our next update. We will provide a further update in the next hour Kind Regards The Access Group

5. identified Oct 22, 2026, 03:19 PM UTC

   Dear Customer, We have successfully completed testing of the security update for the PHP vulnerabilities (PHP2Shell, CVE-2026-109618 and CVE-2026-109619). The update is now being deployed to our live environment, and we will confirm when service has been restored. We will provide a further update within the next 30 minutes. To confirm, we have no evidence that customer data has been affected. We continue to investigate and will tell you if this changes. Kind Regards The Access Group

6. monitoring Oct 22, 2026, 03:29 PM UTC

   Dear Customer, We are writing to let you know that Access Collins and Access Tonic are back online. The security update for the PHP vulnerabilities (PHP2Shell, CVE-2026-109618 and CVE-2026-109619) has been applied to our live environment, and services have been restored. We are now monitoring the position closely. We will update you if anything changes. To confirm, we have no evidence that customer data has been affected. We apologise for the delay in our previous update and for the disruption this has caused. The Access Group

7. monitoring Oct 22, 2026, 07:43 PM UTC

   Dear Customers, We acknowledge the disruption PHP2Shell has caused your business, and the uncertainty it has created for your teams and your customers. Our first priority was to protect our customers' data. We put that ahead of everything else, and we acted early so that your business and your customers were kept safe. Our response is in line with the UK National Cyber Security Centre (NCSC Critical security issue affecting PHP), ENISA and several European governments, which are patching quickly or taking affected services offline until they can be secured. Our services were restored at 4:30 pm BST today and no customers have been compromised. We are now monitoring our services. Some secondary service issues, such as inbound email, are being addressed, and our team is working to resolve them. Further updates will be shared through this Status Hub at Hospitality.

8. monitoring Oct 23, 2026, 12:10 PM UTC

   Dear Customer, A new release has been applied to all customers today to address the processing of inbound email into Collins. Emails sent during this period may have been delayed. Customers do not need to take any action. We will keep this under monitoring until early next week and will update this page if anything changes. To confirm, we have no evidence that customer data has been affected. If you have any questions, please contact your support team, who will be happy to help. We apologise for the disruption this has caused. The Access Group