Security update
We’ve completed a production update to address the risk associated with two recently disclosed PHP vulnerabilities affecting the CSO platform. The updated platform is now live.
What we changed
Upgraded the CSO runtime to PHP 8.3 and updated the CakePHP framework to version 4.6.5.
Moved the production service to Azure App Service on Linux.
Completed compatibility and deployment checks before switching production traffic to the updated environment.
Current status
Production traffic is routed across the Melbourne and Sydney environments. Both are online, and no errors have been recorded on these endpoints since the production switch at 5:44 am AEDT on 27 October 2026.
The PHP and CakePHP updates addressing this vulnerability are live. The environment logs were reviewed and show no record of any exploitation from these vulnerabilities during the past 30 days.
What you need to do
No customer action required, the updates have been completed and the platform is running as normal.
If you have any questions or concerns please reach out to our team who will be happy to assist.
