PHP Vulnerability - Xero Maintenance

Major · resolved · started 22 Oct 2026, 13:46 · resolved 26 Oct 2026, 11:52

Direct Debit Processing

resolved · 26 Oct 2026, 11:52
Dear Customer, We would like to provide a further update on the global PHP vulnerability issue. As previously confirmed, Access PaySuite does not use PHP in any of our product codebases, features or functions, so the vulnerability has no effect on the products and services you use. However, the third-party Xero connector for DDCMS required updating and patching. The connector is protected by Cloudflare, but an update and subsequent patch was still necessary. Our team has now successfully updated and patched the connector. Payment links Payment links on invoices are live again and will work as expected. Invoice updates Changes made through the connector during the downtime will be caught up automatically today. There is a small chance that some changes may not catch up as expected, so we encourage you to review your invoice updates tomorrow, Tuesday 27 October 2026. If you find an error, amend the invoice and save it again to push a new update to DDCMS. We apologise for any inconvenience this may cause. Our team did everything it could to prioritise security during this global PHP vulnerability issue. Kind regards, Access PaySuite
monitoring · 26 Oct 2026, 10:36
Dear Customer, We would like to provide a further update on the global PHP vulnerability issue. As previously confirmed, Access PaySuite does not use PHP in any of our product codebases, features or functions, so the vulnerability has no effect on the products and services you use. However, the third-party Xero connector for DDCMS required updating and patching. The connector is protected by Cloudflare, but an update and subsequent patch was still necessary. Our team has now successfully updated and patched the connector. Payment links Payment links on invoices are live again and will work as expected. Invoice updates Changes made through the connector during the downtime will be caught up automatically today. There is a small chance that some changes may not catch up as expected, so we encourage you to review your invoice updates tomorrow, Tuesday 27 October 2026. If you find an error, amend the invoice and save it again to push a new update to DDCMS. We apologise for any inconvenience this may cause. Our team did everything it could to prioritise security during this global PHP vulnerability issue. Kind regards, Access PaySuite
identified · 23 Oct 2026, 11:08
Dear Customer, We would like to provide a further update on the global PHP vulnerability issue. As previously confirmed, Access PaySuite does not use PHP in any of our product codebases, features or functions, so the vulnerability has no effect on the products and services you use. However, the third-party Xero connector for DDCMS required patching. The connector is protected by Cloudflare, but a patch is still necessary. Our team has worked hard to develop a solution that patches the connector as quickly as possible. The solution is now entering testing, and we expect to push the updated connector live on Monday 26 October 2026. To apply the patch safely, the connector will remain closed. Until it is back online, the following impacts apply to users of the Xero connector for DDCMS: <ul>
<li>
Invoice updates will not be saved. Requests made through the connector while it is closed, including invoice updates, will not be applied. Please complete any invoice changes after the connector is back online, then check your invoices. If you find an error, amend and re-save the affected invoice to update it through the connector.</li>
<li>
Payment links will be unavailable. Payment links on invoices will not work while the connector is closed. In the meantime, you may need to take payments by other means.</li>
</ul> These impacts remain in place until the updated connector is live. We will update you again once it is in place. We apologise for any inconvenience this may cause. We’re here to help To contact our support team, use the live chat feature in DDCMS (chat bubble, bottom right) or call 01206 675847 (option 1), Monday to Friday, 8:00am–5:30pm. For 24/7 support, visit our <a href="https://help-accesspaysuiteddcms.theaccessgroup.com/en/" target="_blank">knowledge base</a> with over 400 articles or use our AI Assistant for instant answers. Kind regards, Access PaySuite
identified · 23 Oct 2026, 10:16
Dear Customer, We would like to provide a further update on the global PHP vulnerability issue. We have previously established that Access PaySuite does not use PHP in any of our product codebases, features or functions, so the vulnerability has no effect on the products and services you use. However, the third-party Xero connector for DDCMS does require patching. The connector is protected by Cloudflare, but a patch is necessary. To apply it successfully, we have temporarily closed the connector. We will let you know when this is back online. This may be several days and lead into next week. If you use the Xero connector for DDCMS, please note the following impacts during the downtime: <ul>
<li>
Invoice updates will not be saved. Requests made through the connector while it is closed, including invoice updates, will not be applied. Please complete any invoice changes after the connector is back online and check your invoices once the connector has been restored. If you find an error, amend and re-save the affected invoice to update it through the connector.</li>
<li>
Payment links will be unavailable. Payment links on invoices will not work while the connector is closed. We are reaching out to Xero to understand if the links will still work once the connector is back online. In the interim, you may need to take payments by other means.</li>
</ul> We will communicate to you once it is back online. We apologise for any inconvenience this may cause. We’re here to help To contact our support team, use the live chat feature in DDCMS (chat bubble, bottom right) or call 01206 675847 (option 1), Monday to Friday, 8:00am–5:30pm. For 24/7 support, visit our <a href="https://help-accesspaysuiteddcms.theaccessgroup.com/en/" target="_blank">knowledge base</a> with over 400 articles or use our AI Assistant for instant answers. Kind regards, Access PaySuite
resolved · 23 Oct 2026, 10:15
Closed by an administrator.
identified · 22 Oct 2026, 13:56
Dear Customer, We would like to provide a further update on the global PHP vulnerability issue. We have previously established that Access PaySuite does not use PHP in any of our product codebases, features or functions, so the vulnerability has no effect on the products and services you use. However, the third-party Xero connector for DDCMS does require patching. The connector is protected by Cloudflare, but a patch is necessary. To apply it successfully, we have temporarily closed the connector. We will let you know when this is back online. This may be several days and lead into next week. If you use the Xero connector for DDCMS, please note the following impacts during the downtime: <ul>
<li>
Invoice updates will not be saved. Requests made through the connector while it is closed, including invoice updates, will not be applied. Please complete any invoice changes after the connector is back online and check your invoices once the connector has been restored. If you find an error, amend and re-save the affected invoice to update it through the connector.</li>
<li>
Payment links will be unavailable. Payment links on invoices will not work while the connector is closed. We are reaching out to Xero to understand if the links will still work once the connector is back online. In the interim, you may need to take payments by other means.</li>
</ul> We will communicate to you once it is back online. We apologise for any inconvenience this may cause. We’re here to help To contact our support team, use the live chat feature in DDCMS (chat bubble, bottom right) or call 01206 675847 (option 1), Monday to Friday, 8:00am–5:30pm. For 24/7 support, visit our <a href="https://help-accesspaysuiteddcms.theaccessgroup.com/en/" target="_blank">knowledge base</a> with over 400 articles or use our AI Assistant for instant answers. Kind regards, Access PaySuite