On October 20, 2026 the PHP team announced the discovery of two critical vulnerabilities. Booked runs on PHP, meaning the infrastructure that Booked runs on was vulnerable. Due to the exploit path, the Booked application is not affected by either of these vulnerabilities and does not require any updates.
Booked Cloud Customers
Within hours of details being published, our team began implementing recommended mitigation actions including firewall rules and PHP configuration adjustments. Patching for PHP began shortly after the updates were made available from the PHP team.
We have been continuously monitoring our servers and are happy to report that we have no evidence that any customer was affected by either of these vulnerabilities.
Booked On-Prem Customers
Please install the latest versions of PHP as soon as possible. We also recommend applying the suggested PHP configuration changes to further mitigate any risk.