Argus update on the PHP security vulnerabilities
We have not identified any impact on customer data or service availability from the recently disclosed PHP vulnerabilities.
Status as at 23 Oct 2026, 09:00 NZDT
Our applications
Our web platform, reporting API and mobile apps are not affected by these vulnerabilities. They do not use PHP, so the affected software is not part of these applications.
Precautionary review
Safeguarding your data is our priority. As a precaution, our DevSecOps team is reviewing the wider infrastructure that supports our services for any use of PHP. Any affected components we identify will be patched urgently. Where an update cannot be applied immediately, we will apply PHP’s recommended interim measures to reduce exposure while completing the update.
What you need to do
You can continue using Argus as usual. No action is required from you in relation to your use of Argus at this time.
Our security controls
We use multiple layers of protection to help safeguard customer data:
- Network protection: Firewalls and network access controls restrict connections to our AWS-hosted systems, with separation between services.
- Vulnerability scanning: Our build pipeline automatically checks third-party software components for known vulnerabilities.
- Protected build systems: Our build systems have tightly restricted outbound network access.
- Prioritised patching: We assess our exposure to vulnerabilities and prioritise fixes according to severity.
- Incident response: Our defined process covers severity assessment, escalation to our DevSecOps lead and communication with affected customers.
Keeping you informed
If our review identifies any impact on your data or services, or any action you need to take, we will contact you directly and promptly with clear guidance.
For questions or further information, please contact security@argustracking.com.