22 October 2026 | Security Update
Following the announcement of two critical PHP security vulnerabilities on 21 October 2026, Chronicle Computing would like to reassure customers that appropriate security measures are in place across our services.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could potentially allow unauthorised attackers to execute malicious code on affected servers.
Chronicle Online Platform
Our Chronicle Online workforce management and time and attendance platform is developed using Microsoft’s .NET technology and hosted within Microsoft Azure.
The core application does not use PHP and is therefore not directly affected by these vulnerabilities.
Chronicle Computing Website
Our corporate website operates on WordPress, which uses PHP.
Following the release of the security updates, our website’s PHP environment has been upgraded to version 8.3.36, which includes fixes for both identified vulnerabilities.
Our Commitment to Security
Protecting customer information and maintaining the security of our services remains a priority for Chronicle Computing.
We continue to monitor emerging cybersecurity threats, maintain our infrastructure and apply relevant security updates to protect our systems.
No action is required from Chronicle Online customers in relation to these vulnerabilities.
Chronicle Computing Ltd — Workforce Management & Time and Attendance Software
