When critical cybersecurity vulnerabilities emerged in October 2026, BookingLive acted within hours to protect customer systems, implement emergency security measures and restore services - ahead of much of the wider industry attention that followed.

At BookingLive, protecting our customers' systems, services and data is a fundamental responsibility. Cybersecurity threats are constantly evolving and even widely adopted technologies can be affected by newly discovered vulnerabilities.

October 2026 was a particularly significant period for cybersecurity, with several serious vulnerabilities disclosed across widely used web technologies and infrastructure.

Our technical team responded immediately, assessing potential exposure, implementing precautionary measures and communicating directly with affected customers.

Here, we explain what happened, the vulnerabilities we investigated and the actions we took to protect the organisations that depend on BookingLive.

The PHP2Shell vulnerabilities: What happened?


On 21 October 2026, critical security vulnerabilities affecting PHP were formally disclosed and security updates were released.

The two vulnerabilities, collectively known as PHP2Shell, were identified as:

  • CVE-2026-109618

  • CVE-2026-109619


Both received critical severity ratings of 9.2 out of 10 under the Common Vulnerability Scoring System (CVSS 4.0).

PHP is a widely used programming language that powers web applications and online services worldwide, including systems used for bookings, appointments, transactions and customer interactions.

The vulnerabilities involved weaknesses in PHP's internal memory management. Under certain conditions, attackers could potentially exploit these weaknesses to execute malicious code remotely without authentication.

Successful exploitation could allow attackers to compromise affected systems, access sensitive information or disrupt services.

Given the widespread use of PHP and the severity of the vulnerabilities, immediate action was essential.

BookingLive's response: From identification to restoration within hours


Following the security disclosures on 21 October, our technical and management teams immediately assessed the potential impact across BookingLive's hosted customer environments.

Rather than waiting for further developments, we took the precautionary decision to temporarily suspend affected services while the necessary security work was undertaken.

21 October, 8:00 pm - 8:30 pm: Precautionary shutdown


Between approximately 8:00 pm and 8:30 pm UK time, BookingLive temporarily took affected customer services offline.

This was a deliberate security measure intended to minimise potential exposure while remediation was completed.

We recognise that service availability is critical to our customers, particularly those delivering essential public services and managing high volumes of appointments and bookings.

However, we considered a short, controlled interruption preferable to leaving potentially vulnerable systems exposed.

Emergency security updates and remediation


Our technical team worked throughout the evening to implement security updates and appropriate protective measures across affected environments.

The response included:

  • Assessing affected services and their potential exposure

  • Prioritising business-critical customer environments

  • Implementing security updates and mitigations

  • Conducting technical checks before restoring services

  • Monitoring systems following restoration


Where necessary, remediation was tailored to the technologies and configurations used by individual customer environments.

Customer communication


Throughout the response, BookingLive issued notifications to customers explaining the vulnerabilities, the precautionary measures being taken and the steps required to restore services.

Additional communications were provided to customers operating particularly time-sensitive and business-critical systems.

Our priority was to ensure customers understood the situation and remained informed throughout the process.

Services restored the same evening


Following remediation and technical verification, affected customer services were restored later that evening.

Our team continued monitoring the platform following restoration to ensure services remained operational.

By acting promptly, BookingLive was able to complete its emergency response and restore affected services within hours rather than allowing the disruption to extend into subsequent days.

Further vulnerabilities: Our security response continued


The PHP2Shell disclosures were not the only security concerns requiring attention during this period.

In the days that followed, our team continued reviewing additional security advisories and responding to customer enquiries concerning other potential vulnerabilities.

These assessments were an important part of our broader approach to vulnerability management: identifying emerging threats, determining whether our systems were exposed and taking proportionate action where required.

Additional PHP vulnerability - CVE-2026-115560


On 23 October, a further PHP vulnerability was disclosed involving session handling and file upload progress functionality.

Identified as CVE-2026-115560, this issue could potentially allow remote code execution under a specific and uncommon combination of PHP configuration and application behaviour.

Unlike the initial PHP2Shell vulnerabilities, this issue required particular application settings and was not considered universally exploitable across PHP installations.

The PHP development team recommended disabling the affected session upload progress functionality as a precautionary mitigation until the relevant security update became available.

BookingLive included this additional advisory in its ongoing security review, assessing the relevance of the vulnerability and the applicable protective measures.

Brotli and Node.js vulnerabilities


We also received customer enquiries concerning vulnerabilities affecting Brotli and Node.js.

Brotli is a data compression technology used to improve web performance, while Node.js is a JavaScript runtime used to support server-side applications.

Both technologies are widely used across modern web infrastructure and security advisories relating to them can generate alerts from automated vulnerability scanning tools.

Our technical team investigated the reported concerns and confirmed that neither technology was used by the relevant BookingLive customer applications.

Consequently, those particular vulnerabilities did not affect the services under review and no related remediation was required.

This illustrates an important distinction in cybersecurity: the existence of a critical vulnerability does not automatically mean that every application or service is exposed.

Understanding the technologies actually deployed is essential to making accurate, proportionate security decisions.

Linux kernel vulnerability - CVE-2026-46300


Our wider security review also considered a reported vulnerability affecting the Linux kernel, the core component of many server operating systems.

Operating system vulnerabilities require careful assessment because their potential impact depends on the affected software versions, system configurations and the conditions necessary for exploitation.

Our approach involves reviewing relevant security advisories, determining potential exposure and identifying appropriate remediation or mitigation where required.

SSL/TLS security findings


Alongside these vulnerabilities, BookingLive continued reviewing SSL/TLS-related security findings.

SSL/TLS technologies protect communications between users and online services through encryption, helping safeguard information transmitted over the internet.

Security scanning tools can identify potential concerns relating to encryption configurations, software components and reported vulnerabilities.

However, not every automated finding represents an exploitable weakness.

For example, operating system vendors may incorporate security fixes into existing software versions without changing the main version number, a practice known as backporting.

This can result in vulnerability scanners reporting potential issues even when the relevant security fix has already been applied.

Our team investigates such findings to establish whether they represent genuine exposure, require corrective action or can be verified as false positives.

Why vulnerability assessment matters as much as remediation


One of the key lessons from October's events is that effective cybersecurity requires more than simply applying updates whenever a vulnerability is announced.

Organisations must be able to distinguish between:

  • Critical vulnerabilities requiring immediate intervention

  • Vulnerabilities affecting technologies that are not deployed

  • Issues requiring specific configurations to be exploitable

  • Automated scanner findings that require further investigation

  • Security advisories requiring continued monitoring or future remediation


Responding appropriately requires technical expertise, accurate infrastructure knowledge and effective communication between customers and service providers.

At BookingLive, our objective is to make informed security decisions based on the actual risks to our systems and customers, rather than treating every security alert in isolation.

Acting ahead of widespread attention


Perhaps the most significant aspect of BookingLive's October response was the speed at which our team acted.

On the evening of 21 October, we assessed the critical PHP vulnerabilities, took precautionary action, implemented emergency security measures and restored affected services within hours.

By the following day, as the vulnerabilities received further attention across the technology industry, our immediate response had already been completed.

We did not wait for the issue to become headline news before taking action.

Subsequent developments reinforced the importance of that decision. On 26 October, the US Cybersecurity and Infrastructure Security Agency (CISA) added both PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalogue following evidence of active exploitation.

Our response demonstrates why early identification, decisive intervention and coordinated technical action are essential components of effective cybersecurity management.

Our ongoing commitment to security and resilience




Cybersecurity is not a one-off exercise. It is an ongoing responsibility requiring vigilance, technical expertise and a willingness to act decisively when new threats emerge.

For organisations relying on BookingLive to manage appointments, bookings and customer interactions, platform reliability and information security are essential.

The events of October 2026 demonstrated our commitment to:

  • Proactive monitoring of emerging security threats

  • Rapid assessment and response to critical vulnerabilities

  • Appropriate precautionary action to protect customer services

  • Transparent communication throughout security incidents

  • Continued investment in platform security and operational resilience


We recognise that even temporary service interruptions can affect our customers and their users. However, protecting the integrity and security of the services entrusted to us must remain our priority.

We would like to thank our customers for their understanding during the temporary disruption and our technical team for its swift, coordinated response.

At BookingLive, security is not simply about reacting to threats. It is about identifying risks early, taking responsibility and acting before those risks become incidents.

To learn more about BookingLive's enterprise booking and appointment management solutions, visit www.bookinglive.com.