Critical PHP Security Issue: What it means for customers

A critical security issue affecting PHP has put website security firmly in the spotlight. The newly disclosed vulnerabilities could, under certain conditions, allow an attacker to execute code on a vulnerable server without authentication. Fixes have now been released, and the NCSC is encouraging organisations to identify affected systems and apply the latest security updates.

We are aware of recent questions regarding the critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, and whether they impact Microsoft Dynamics 365 environments or integrations.

The below FAQ provides our current assessment and recommendations.

Q: Are Dynamics 365 Business Central or Dynamics 365 CRM affected by these PHP vulnerabilities?

Based on our assessment, we have not identified any specific exposure to these PHP vulnerabilities within the Microsoft Dynamics 365 Business Central, Power Platform, or Dynamics 365 CRM solutions that we provide. Microsoft’s cloud-based Dynamics 365 and Power Platform services are hosted and managed entirely by Microsoft, and we have not identified any use of PHP within the components or services we manage on your behalf.

Q: Does this apply to Dynamics 365 Business Central SaaS (Cloud)?

Yes. Dynamics 365 Business Central SaaS is a Microsoft-managed cloud service. We have not identified any exposure to these PHP vulnerabilities within the Business Central cloud environment or any Microsoft-managed components that form part of the service.

Q: What if we use an on-premises version of Business Central?

We have not identified the use of PHP within the Business Central solutions or custom components developed and managed by our team. However, customers remain responsible for the maintenance and patching of their own infrastructure, operating systems, web servers, and any third-party applications that sit outside the scope of our managed solution.

Q: Are any integrations or connectors provided by your team affected?

Our review has not identified the use of PHP within the custom integrations, interfaces, or connectors that have been developed and are managed by our team. As such, we have not identified any exposure to these vulnerabilities within our integration code.

Q: Could our wider environment still be affected?

Potentially, yes. While we have not identified any impact to the Microsoft solutions or integrations we manage, your environment may include externally managed systems that utilise PHP.

Examples could include:

• Public websites
• E-commerce platforms
• Customer portals
• Third-party applications
• Externally hosted APIs

If any of these systems are built using PHP, they should be reviewed by the relevant provider.

Q: What actions should we take?

We recommend that you contact your website development partner, hosting provider, or internal IT team to confirm whether PHP is used within any systems connected to your Microsoft environment. Where PHP is present, the responsible provider should review the latest security guidance and apply any relevant security updates or patches.

Q: If I’m a ForGood.Tech customer, can you help us identify which systems connect to Dynamics 365 or Business Central?

Yes. If your technical team requires details of API endpoints, integration connections, or IP addresses associated with our integrations, please contact us and we will be happy to provide the relevant information to support your review.

Q: Should we be concerned about the security of our Microsoft solutions?

Based on the information currently available and our assessment of the solutions and integrations we manage, we have not identified any impact to Microsoft Dynamics 365 Business Central, Dynamics 365 CRM, Power Platform, or our associated custom integration components.

We will continue to monitor security updates and will communicate with customers should our assessment change.