A security problem was found in PHP, software that many websites run on. The Lumary platform does not use PHP, so Lumary and your information are not affected. You do not need to do anything.
Status: Resolved
Last updated: 28/10/2027
What happened
PHP is a common piece of software that many websites are built with. On 20 October 2026, details of two serious weaknesses in PHP were made public earlier than planned. Together they are known as PHP2Shell. They could let a criminal take control of the computer that runs a website, without needing a password.
The makers of PHP released a fix on 21 October 2026.
Were Lumary customers affected?
No. Lumary is not built with PHP. We checked all of our systems to confirm this.
One of our marketing websites, the US Lumary ABA website, is run by an outside hosting company that uses PHP. This website only shares information about our services. It is separate from Lumary and does not hold any customer or client information. Messages sent through its contact forms go straight to a different system that is not affected. The hosting company installed the fix by 22 October 2026.
What we did
- Checked all Lumary systems to confirm that none of them use PHP.
- Confirmed with our hosting company that the marketing website has the fix installed.
- Checked the marketing website for anything unusual, as a precaution.
- Continuous monitoring for advice from technology companies and the Australian Cyber Security Centre.
What you need to do
No. You can keep using Lumary as normal. If your organisation has its own website, ask whoever looks after it to make sure it has the latest updates installed.
More Information
If you have questions, contact Lumary Support. We will update this article if anything changes.