22nd October 2026

We are aware of the recently disclosed critical PHP vulnerabilities and can confirm that the XMA Group reviewed its environment and on the 21st October 2026 applied the necessary security updates to affected systems where remediation was required. We are also updating our position within Risk Ledger for partners with existing access to ensure up to date visibility of our assessment and response to this emerging threat.

At this time, we have identified no evidence of compromise relating to these vulnerabilities within XMA-managed systems. We will continue to monitor the situation and apply any further mitigations or security updates as required and update this statement as changes are made.

As part of our established Vulnerability Management and Patch Management processes, critical and high-risk security vulnerabilities are treated as a priority, with remediation activities assessed, tested and deployed in accordance with defined security procedures and change controls. This approach aligns with our wider security governance framework and supports our ongoing Cyber Essentials Plus certification requirements, including the timely remediation of high and critical vulnerabilities.

Our response includes continuous monitoring of vendor advisories, threat intelligence sources, vulnerability scanning, security monitoring, controlled testing, accelerated deployment of security updates, and ongoing validation of remediation effectiveness.
Security remains a key priority for XMA, and we are committed to maintaining robust technical, operational and governance controls to protect customer data, systems and services.

Charlotte King

Group Head of IT Security & Compliance & Deputy SIRO

XMA Group