Following the disruption to myjobscotland on 21 October 2026, caused by global PHP security vulnerabilities, we would like to provide further information on the incident and the measures taken to protect the service.

The vulnerabilities affected the PHP technology used by the myjobscotland front-end website, which operates on Drupal and is hosted using Amazon Web Services (AWS) infrastructure. As a precautionary measure, the website was taken offline while the necessary security updates were implemented.

The issue was not related to the recent myjobscotland system update, and the TalentLink recruitment management system was not affected by the vulnerabilities.

You may want to share the following technical information with your organisation's IT/Cyber Security teams to support any internal security reviews and cyber resilience assessments.

Timeline of Events

Wednesday 21 October 2026
11.00am - myjobscotland Team Notified

Our web developers at Spider Online notified the myjobscotland team of the upcoming issue and we began planning downtime at 3pm.

11:20am - Downtime brought forward

Spider Online raised concerns that the vulnerability may be leaked earlier than 3pm and it was agreed the website would come down at 12:30pm - allowing candidates an opportunity to save their application progress.
 

12:15pm - myjobscotland Notified Users

• SnapShot email sent to subscribers regarding downtime including suggestion to extend closing dates.
• A site message was added to the website to alert active users it was about to go down.
• Information of the downtime was shared on our social media platforms.

12.30pm - myjobscotland taken offline

myjobscotland was taken offline as a precautionary measure ahead of the public disclosure of two PHP security vulnerabilities:

• CVE-2026-109618
• CVE-2026-109619

Access was blocked at the AWS load balancer, preventing PHP execution and protecting the service from potential exploitation.
 

3.00pm - PHP Security Patches Released

PHP released version 8.4.27 to address the identified vulnerabilities. Restoration of myjobscotland was dependent on Amazon Web Services (AWS) completing the necessary infrastructure updates.
 

9.00pm - AWS Progress and Closing Date Extensions

Our developers continued to monitor AWS availability and prepare for deployment throughout the evening and the website remained offline until the necessary updates could be safely implemented.

With no confirmed time for the website to return, we made the decision to extend remaining TalentLink vacancies which were due to close at 23:59:59 on 21 October 2026 to 22 October 2026 (23:59:59). This was to protect candidates with saved, incomplete applications who had been unable to complete and submit them due to the disruption.

Thursday 22 October 2026

12:20am - Service Restored

Shortly after midnight our developers were able to confirm updated AMI's had been verified by AMS prior to release which were successfully deployed, tested and verified internally. Only once this was confirmed was the myjobscotland website restored.

Security Assurances

• We have upgraded to the latest version of PHP as per PHP guidelines addressing both vulnerabilities so that no further remediation is required.
• No data breach or compromise of candidate or recruiting organisation data has been identified.
• There is no evidence of exploitation of these vulnerabilities within the myjobscotland environment.
• There are no reports of any data breach so far as a result of the vulnerabilities (Source: BBC)
• TalentLink does not use PHP and therefore was unaffected.

Current Status

The myjobscotland website is fully operational, and no action is required from recruiting organisations in relation to these security updates.