When suspected system vulnerabilities were thought to have the potential to affect the technology behind the FACT3 Hub, our team acted quickly to protect customers and their data. Head of Programme Delivery, James Firminger explains what happened, how the response was managed and what had to be checked before the platform could safely return online.
Act quickly to protect customers
When did you first realise there was a problem, and what did you do?
James: We became aware on 21 October 2026 that there were two critical security vulnerabilities affecting PHP, the technology behind our Hub platform. We didn’t want to take any chances, so we took the Hub offline straight away to protect our customers and their data.
What happened next?
James: It was very much a coordinated effort across several areas. The Hub was already running the best available version of PHP, but the risk was serious enough that we couldn’t simply wait and see. By suspending access immediately, we stopped potentially malicious requests from reaching the application while we worked on the response.
Apply the fix and checking the wider system
How quickly were you able to get the security fix in place?
James: We got it done the same day. As soon as the PHP patch was released publicly, we installed it and removed the vulnerabilities that had been identified.
Did you use the opportunity to check anything else?
James: Yes. We also applied some additional system updates and restarted the infrastructure so we could be sure the latest software was running throughout. At the same time, we reviewed server activity and logs for any signs of suspicious behaviour.
Restore the Hub safely
So, what did you need to check before bringing the Hub back online?
James: We carefully tested the key services, including authentication, single sign-on and document uploads. We only restored access once the security updates were in place and all the essential checks had been completed. Before bringing the Hub back online, we needed to be confident that it was secure and working exactly as it should. Protecting customer information will always remain a priority. We will continue to monitor security advisories and maintain appropriate safeguards across our infrastructure.