We have reviewed the recently disclosed PHP vulnerabilities and can confirm that the Manage My Health Patient Portal and Provider Portal are not affected, as none of our applications use PHP.
This follows a recent NCSC advisory regarding PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. Further information is available here: NCSC Security Advisory: https://www.ncsc.govt.nz/alerts/cve-2026-109618-and-cve-2026-109619-affecting-php/
No action is required from users, practices, providers, or partners, and services continue to operate as normal.
Kind regards,
Manage My Health
