Trust Portal

Published: October 21, 2026
Status: Not affected
Severity of the vulnerability: Critical (CVSS v4.0 9.2)

Summary

On October 21, 2026, Wiz Research, together with Calif and OpenAI, disclosed PHP2Shell, two critical memory-safety vulnerabilities in the PHP runtime engine tracked as CVE-2026-109618 and CVE-2026-109619. According to Wiz Research, successful exploitation can lead to unauthenticated remote code execution, and every PHP version released in the last decade, going back to PHP 5.4, is affected by at least one of these flaws.

Videsk is not affected. None of Videsk's products, nor the services that deliver them, run on PHP. This applies both to services built and operated by Videsk and to the third-party services that are part of our product delivery path.

Scope of our assessment

Our review covered every component involved in delivering Videsk products to our customers:

• Videsk platform (video contact center, including web, SDK and agent console components).
• CIP - Conversation Intelligence Platform.
• Backend services, APIs, real-time media infrastructure and supporting workers operated by Videsk.
• Third-party services that process customer data or are part of the request path for our products.

No component in this scope uses the PHP language, the PHP runtime, or PHP-based server software (such as PHP-FPM, Apache mod_php, php-cgi, FrankenPHP or LiteSpeed PHP handlers). Because PHP2Shell is a flaw in the PHP runtime itself, it cannot be exploited against systems that do not execute PHP.

Action required from customers

None. No action is required from Videsk customers in relation to this vulnerability. Customers do not need to update integrations, rotate credentials or change configurations as a result of PHP2Shell.

If your own organization runs PHP-based applications (including WordPress, Drupal, Joomla, Magento or custom PHP software), we recommend reviewing the Wiz Research advisory and applying the patched PHP releases published by the PHP project as soon as possible.

Ongoing monitoring

Videsk continues to monitor this vulnerability and related disclosures. If our assessment changes, we will update this notice.

References

• Wiz Research — PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
• CVE-2026-109618 — RCE via out-of-memory corruption in the PHP runtime
• CVE-2026-109619 — RCE via stale global state in the PHP runtime

Contact

For questions about this notice or Videsk's security posture, please contact our security team through the Videsk Trust Center.

Dear customers, we are pleased to announce that we have improved how we store your passwords by switching from bcrypt to Argon2id (IETF RFC 9106). This change makes credential hashes significantly more resistant to offline attacks using specialized hardware (GPU/ASIC clusters), in line with current OWASP recommendations for password storage.

Why this change?

This update aligns with our roadmap of incremental improvements toward stronger information security against contemporary threats.

How does this affect me?

This change will be applied automatically the next time you log in, without the need to change your current password.

If any user associated with your account does not log in within the next 30 days, their password will be automatically changed, and at their next login, they will be prompted to restore access via your corporate email or by requesting a reset from your account administrator.

SSO users are not affected by this policy..

If you want more information, you can read our blog post or contact us at security@videsk.io.

Axios Supply Chain Attack — Security Notice

On March 31st, 2026, a supply chain attack targeting the Axios npm package was reported. Versions 1.14.1 and 0.30.4 were compromised through a hijacked maintainer account, injecting a malicious dependency (plain-crypto-js@4.2.1) that deployed a cross-platform Remote Access Trojan (RAT).

Videsk is not affected by this vulnerability.

We took immediate action on the same day the advisory was disclosed, reviewing all backend and frontend services using the following mechanisms:

• GitHub Security Advisory (GHSA) automated scanning
• Manual audit via regex pattern matching across all repositories

No compromised versions were found, nor were any dependencies associated with plain-crypto-js identified in any of our services.

Audit evidence

$ bash ./axios-vuln.sh

47 SAFE

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
AXIOS SUPPLY CHAIN ATTACK — INTERNAL AUDIT REPORT
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
📅 Scan date:        2026-04-01 22:55:25 UTC
🔍 Advisory:         axios npm supply chain compromise (UNC1069)
⚠️  Affected versions: 1.14.1, 0.30.4
🛡️  Malicious dep:    plain-crypto-js@4.2.1
📦 Projects scanned: 47
✅ Clean:            47
🚨 Compromised:      0
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
RESULT: NO AFFECTED SYSTEMS DETECTED
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

No customer data, services, or infrastructure were affected. No credentials were exposed and no remediation action is required on your part.

For further details on the advisory, refer to Google Threat Intelligence's analysis.

We want to reassure our enterprise customers regarding the 'MongoBleed' vulnerability CVE-2025-14847: Videsk and your data are not affected.

Because our platform uses MongoDB Atlas as a fully managed service, the provider automatically applied all necessary security patches before the issue was publicly disclosed. This proactive remediation effectively neutralized any infrastructure-level risks, ensuring that your sensitive information remains fully protected. No action is required from your team, as your environment is secure and up to date.

Dear customers, we have made changes to our subprocessors, the third parties we engage to process your data to provide the Videsk service.

Changes add the following new providers:

1. Postmark as primary transactional email service, maintaining Mailchimp as secondary
2. tl;dv.io as AI note taker as the primary service, migrating from read.ai

If you have any inquiries, please get in touch with us at security@videsk.io.