Published: 22 October 2026
Applies to: SmartSuite Library and TV4Education
Summary
FSI services are not affected by the critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619.
SmartSuite Library and TV4Education, including our hosting infrastructure and third-party components, do not use PHP.
About the vulnerabilities
On 21 October 2026, the PHP project released security updates for two critical vulnerabilities in the PHP runtime. Both have a CVSS score of 9.2 and could allow an unauthenticated attacker to run code remotely on servers that run PHP.
They only affect systems that run PHP.
What this means for your school
- No updates or interim protections are needed for FSI services.
- We have found no evidence of exploitation or impact on school information.
- Schools do not need to take any action while using SmartSuite Library or TV4Education.
Your other services
If your school uses other websites or platforms, we recommend checking with those providers, as many common web platforms run on PHP.
More information:
Questions
If you have any questions about this statement, please contact the FSI support team.