Important Security and Compatibility Update
Although PHP is only required for certain functionality, such as Invoice Manager and bespoke reports, the affected component may still be present on your server even if you do not use these features.
As a precaution, we recommend that all customers take the necessary action as soon as possible.
Cloud Hosted Coretime Customers:
If your organisation uses our cloud hosting solution, no action is required on your part. Our technical team is working to address the vulnerability across our hosted environments as quickly as possible.
Please be aware that you may experience a short period of downtime while these updates are carried out. We will endeavour to keep any disruption to a minimum.
On Premise Coretime Customers:
If your organisation hosts Coretime on its own server, please forward this communication to your IT administrator, who should review your PHP installation and take one of the following actions.
Option 1: Remove PHP if it is not required
If your organisation does not use Invoice Manager or bespoke PHP reports, your IT administrator should first check whether PHP is required by any other applications hosted on the server. If it is not required, the unnecessary PHP components should be removed. If PHP is required by other applications, it should instead be updated to a secure, supported version.
To do this, your IT administrator should:
- Log in to the server hosting Coretime and open Internet Information Services (IIS) Manager.
- Check whether PHP is configured under Handler Mappings and FastCGI Settings.
- Confirm that PHP is not required by Coretime or any other applications hosted on the server.
- If PHP is not required, remove the unused PHP handler mappings and FastCGI configuration, followed by the associated installation files.
- If PHP is required by another application, do not remove it. Instead, update PHP to a secure, supported version compatible with that application, following the instructions in Option 2.
- Verify that Coretime and any other hosted applications continue to function correctly.
Option 2: Update PHP if it is required
If your organisation uses Invoice Manager or bespoke PHP reports, your IT administrator should update PHP to a security-supported version compatible with the relevant functionality.
To do this, your IT administrator should:
- Visit https://windows.php.net/download/ and download an appropriate security-supported version of PHP.
- Install the updated version in a separate folder, retaining the existing installation for backup purposes.
- Update the relevant IIS configuration to use the new PHP installation.
- Recycle the associated IIS application pool and verify that the PHP-based functionality operates correctly.
Further technical guidance is available at https://www.php.net/manual/en/install.windows.iis.php.
Clients running Invoice Manager and certain custom reports on Coretime versions prior to 2025.1 will need to be upgraded to the latest version. In addition to ensuring full compatibility, upgrading provides access to the enhanced underlying security measures implemented following our recent security testing.
Is the standard Coretime application affected?
The standard Coretime application does not rely on PHP for its core functionality. However, outdated PHP components may still be present on your server and should be addressed regardless of whether they are actively used.
Thank you for your understanding and cooperation while we work to address this matter. We appreciate your patience and will do our best to minimise any disruption.
If you have any questions or require assistance during this rollout, please reach out directly to our Support team on 00 44 1423 653800 or email support@coretime.com