Notice: Amplitude not impacted by recent PHP vulnerabilities

Incident Report for Amplitude

Resolved

Amplitude has confirmed that no first-party Amplitude services are impacted by the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 (PHP2Shell Advisory). We are working with an affected third-party vendor to establish security updates on their end; however, internal hardening efforts should prevent potential escalation.

No customer action is required at this time.

As this is a developing advisory, any further updates will be communicated appropriately via our Trust Center at https://trust.amplitude.com/updates?tab=updates&update=65d46972-f7ed-4f53-bccf-f86f1d18393e.

Please subscribe to our Trust Center for notification on updates as no further updates will be made on our Statuspage here.

Posted Oct 22, 2026 - 12:25 PDT