Skip to content
  • There are no suggestions because the search field is empty.

PHP security vulnerabilities: Information for iAM Compliant Customers

We understand that schools and trusts need clear information from their software suppliers after the recent PHP security alert. The DfE may have asked you to confirm this information with us, so this article answers your questions.

Is iAM Compliant affected?

No. iAM Compliant does not use PHP and is therefore not affected by the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619.


Have the necessary security updates been applied?

No PHP patches are required for iAM Compliant, because it does not use PHP. We regularly update the programming language and framework the platform uses.


Has iAM Compliant reviewed the relevant security guidance?

Yes. We have reviewed the communications from PHP and the National Cyber Security Centre (NCSC) relating to these vulnerabilities.


Does our school or trust need to do anything?

No. Your school or trust does not need to take any action. The iAM Compliant system is safe and robust.

You can retain this article for your school or trust’s records. If you need further information or a written response to a specific question, please contact our support team as usual.

For more information about the vulnerabilities, please see the NCSC security advisory.

Article Last updated: 23/10/26