GrowthInvest is a trading name of EIS Platforms Limited. EIS Platforms Limited (FRN: 694945) is an appointed representative of Sapphire Capital Partners LLP (FRN:565716) which is authorised and regulated by the Financial Conduct Authority in the UK. EIS Platforms Limited is a limited company registered in England and Wales (No. 08018312).
What happened: On 20 October the PHP project gave advance notice of two unauthenticated remote code execution vulnerabilities in PHP itself (CVSS 9.2; CERT-EU advisory 2026-018). Fixed releases, including PHP 8.5.12, were published on 21 October at around 14:35 BST. Exploitation attempts were reported in the wild before the fix was available.
What was affected: The GrowthInvest platform does not run PHP and was not affected at any point. Our corporate website, growthinvest.com, runs PHP. No client data is held on the website.
What we did: On the morning of 21 October, before the fix was released and before exploit details were public, we took the website offline behind a holding page so that no request could reach PHP. Rather than patch in place, we rebuilt the site on a freshly provisioned host running the latest patched version of PHP, with session upload progress disabled as an additional hardening step. We reviewed the previous host for any sign of exploitation during the period before it was taken offline, including file integrity, uploads, access logs, user accounts and scheduled tasks, and found no evidence that it was accessed or tampered with. All administrative and database credentials were rotated as a matter of course.
Impact: None to the platform, our operations or to client data. The corporate website was unavailable for approximately 27 hours which includes documentation in our Knowledge Centre.
This incident moved extremely quickly and our team reacted immediately to an early notification from the PHP project and security channels related to the issue. While we understand that the website being unavailable caused some disruption to customers, we felt that this was a necessary step to protect the integrity of our systems. We apologise if this caused any disruption and we thank you for your patience. The security and integrity of the data we hold and the operation of our platform is part of our critical operations and we hope the detail above demonstrates our commitment to your data and security. If you have any questions, please reach out to our client services team or your usual account contacts.
- Aled Treharne, CTO
