Thrive Learning incident
PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
Ongoing since 05:38 PM UTC, affecting UK Platform - Prod and UK Platform - Staging and 1 more.
Following the recent NCSC advisory concerning two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), we wanted to reassure you that the Thrive platform does not use PHP. We've also reviewed the advisory as a precaution and confirmed that the platform is not affected. There is no impact to your environment, data or users, and no action is required on your part. Our security team continues to monitor emerging vulnerabilities as part of our standard security processes, and we'll let you know if anything changes.
Affected components
Update timeline
- monitoring Oct 21, 2026, 05:38 PM UTC
Following the recent NCSC advisory concerning two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), we wanted to reassure you that the Thrive platform does not use PHP. We've also reviewed the advisory as a precaution and confirmed that the platform is not affected. There is no impact to your environment, data or users, and no action is required on your part. Our security team continues to monitor emerging vulnerabilities as part of our standard security processes, and we'll let you know if anything changes.
Your product runs on more than Thrive Learning
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services