Critical PHP security vulnerability: action recommended

Incident Report for eSIM Go

Monitoring

The PHP project has disclosed critical security vulnerabilities in PHP that need immediate attention.

The eSIM Go platform is not affected. You don’t need to change anything in your eSIM Go account, API integration or configuration.

If any of the systems you use to connect to eSIM Go run on PHP, such as your storefront, backend or middleware, we strongly recommend updating to a patched version as soon as possible. Full details and fixed versions are available here:

PHP security advisory: https://www.php.net/archive/2026.php#2026-10-21-5
NCSC guidance: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php

If you see any activity in your eSIM Go account that you didn’t generate, such as unexpected orders, it may mean your systems have been compromised. If this happens:

1. Update PHP to a fixed version.
2. Rotate your eSIM Go API keys and account passwords.
3. Contact your account manager or our support team straight away.

Posted Oct 21, 2026 - 22:38 UTC

This incident affects: Travel Management Portal, Travel API, UK Domestic Management Portal, and UK Domestic API.