Booking website security record

The website reviewed is [website address]. The responsible website host is [provider and support reference]. The booking service is run by [provider and support reference]. The person keeping this internal record is [name], and the review began at [date, time and time zone].

The website host confirmed [whether CVE-2026-109618 and CVE-2026-109619 are fixed] in the actual running service at [date, time and time zone]. Its running package is [package identifier and provider evidence, including any backported fixes]. The booking provider confirmed [its affected service assessment and running fix, or why the warning does not apply] at [date, time and time zone]. Any answer still needed is [unresolved confirmation].

The agreed backup, compatibility and recovery arrangements are [provider confirmation and relevant record references]. The provider sanctioned booking check was [safe test method]. It was completed at [date and time] with [outcome for dates, price, checkout route and supported confirmation checks]. Real reservations, charges, availability and existing guest bookings were protected through [agreed arrangements].

The next unresolved action is [action], owned by [responsible person or provider], with the next update due at [date, time and time zone]. Keep the supporting provider response at [record reference]. Retain this privately with the website support records. Do not add guest details that are unnecessary for the technical confirmation. A patch confirmation alone does not establish that no compromise occurred.