We can confirm that there is no impact from recent PHP vulnerabilities with our services.

We are aware of the recent security advisories regarding critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) reported across the web.

We want to reassure all of our school partners, administrators, and users that none of our servers, applications, or services are affected by these security issues. All of our hosting infrastructure and software solutions are secure, fully updated, and actively monitored.

This protection applies across our entire platform:

• SchoolSite
• SchoolBridge
• SchoolPoint
• All custom hosted solutions and infrastructure managed for schools

Security Review

Inbox Design's team worked from the early hours following the announcement checking our services, confirming patch levels and applying the relevant protections. We have no evidence that any services have been compromised, and all of our systems are patched. 

For Inbox Design, security and data privacy remain primary to how we develop, maintain and support SchoolSite, SchoolBridge and SchoolPoint.

What Action Do You Need to Take?

None at all. Our team proactively reviews and applies necessary security mitigations, server updates, and hardening measures across our infrastructure to ensure your data remains completely safe. You can continue using all of your services as normal.