Trust Portal

November 5, 2026
Published: November 5, 2026
Severity: Low
Status: Resolved

Summary

On November 2, 2026, GitBook, the third-party platform that hosts Videsk's public documentation at docs.videsk.io, reported a security incident in which an attacker gained unauthorized access to parts of its infrastructure¹. GitBook has since secured its platform, rotated its credentials and published a post-mortem².

The Videsk platform and customer data were not affected. GitBook has no access to Videsk's production systems, customer accounts, video sessions or recordings. Its access to our source code is limited to the repositories that contain our public documentation.

Our response

When we learned of the incident, we reviewed every connection between GitBook and our systems:

• Documentation repositories: GitBook can only access the three repositories that contain our documentation. We reviewed them and found no unauthorized commits, branches or pull requests.
• Documentation content: We found no unauthorized changes to the content of docs.videsk.io. GitBook also reports no evidence that customer content was modified.
• Internal integrations: We removed GitBook's integration with our internal messaging workspace. We found no unauthorized activity from it.
• Credentials: GitBook revoked all API tokens on its platform and rotated the keys it uses to connect to code repositories.

While GitBook restored its services, docs.videsk.io may have been briefly unavailable or slow. It is now fully available.

Documentation assistant: According to GitBook, questions that visitors typed into the AI assistant on documentation sites may have been accessed. If you used the assistant on docs.videsk.io and included confidential information in a question, please contact us.

Customer action

None required. No Videsk API keys, credentials or webhook settings need to be changed because of this incident.

Contact

We are also reviewing every third-party integration that has access to our code repositories, and limiting each one to the minimum access it needs. If you have questions, contact our security team at security contact.

Published: October 21, 2026
Severity: High
Status: Mitigated

Summary

On October 21, 2026, the Node.js project released security updates for several vulnerabilities¹. The most relevant is CVE-2026-111497, a high-severity flaw in the Node.js Brotli decoder that could allow remote code execution.

Our response

Videsk reviewed its systems the same day. The services that send outbound requests to customer-configured endpoints, such as webhook delivery, were the ones that could be affected. We took these steps:

• Runtime upgraded: the affected services now run on the patched Node.js 24 LTS release¹. Future Node.js security patches will be applied automatically.
• Webhook delivery hardened: webhook delivery no longer decompresses Brotli or Zstandard responses from receiving endpoints. Gzip and deflate responses are still supported.

Customer action

None required. Webhooks keep working as before. The only difference: if your endpoint replies with a Brotli- or Zstandard-compressed body, that body won't be shown in delivery logs.

Contact

We will keep monitoring Node.js security advisories and apply updates as they are released. If you have questions, contact our security team at security contact.

References

Published: October 21, 2026
Status: Not affected
Severity of the vulnerability: Critical (CVSS v4.0 9.2)

Summary

On October 21, 2026, Wiz Research, together with Calif and OpenAI, disclosed PHP2Shell, two critical memory-safety vulnerabilities in the PHP runtime engine tracked as CVE-2026-109618 and CVE-2026-109619. According to Wiz Research, successful exploitation can lead to unauthenticated remote code execution, and every PHP version released in the last decade, going back to PHP 5.4, is affected by at least one of these flaws.

Videsk is not affected. None of Videsk's products, nor the services that deliver them, run on PHP. This applies both to services built and operated by Videsk and to the third-party services that are part of our product delivery path.

Scope of our assessment

Our review covered every component involved in delivering Videsk products to our customers:

• Videsk platform (video contact center, including web, SDK and agent console components).
• CIP - Conversation Intelligence Platform.
• Backend services, APIs, real-time media infrastructure and supporting workers operated by Videsk.
• Third-party services that process customer data or are part of the request path for our products.

No component in this scope uses the PHP language, the PHP runtime, or PHP-based server software (such as PHP-FPM, Apache mod_php, php-cgi, FrankenPHP or LiteSpeed PHP handlers). Because PHP2Shell is a flaw in the PHP runtime itself, it cannot be exploited against systems that do not execute PHP.

Action required from customers

None. No action is required from Videsk customers in relation to this vulnerability. Customers do not need to update integrations, rotate credentials or change configurations as a result of PHP2Shell.

If your own organization runs PHP-based applications (including WordPress, Drupal, Joomla, Magento or custom PHP software), we recommend reviewing the Wiz Research advisory and applying the patched PHP releases published by the PHP project as soon as possible.

Ongoing monitoring

Videsk continues to monitor this vulnerability and related disclosures. If our assessment changes, we will update this notice.

References

• Wiz Research — PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
• CVE-2026-109618 — RCE via out-of-memory corruption in the PHP runtime
• CVE-2026-109619 — RCE via stale global state in the PHP runtime

Contact

For questions about this notice or Videsk's security posture, please contact our security team through the Videsk Trust Center.

Dear customers, we are pleased to announce that we have improved how we store your passwords by switching from bcrypt to Argon2id (IETF RFC 9106). This change makes credential hashes significantly more resistant to offline attacks using specialized hardware (GPU/ASIC clusters), in line with current OWASP recommendations for password storage.

Why this change?

This update aligns with our roadmap of incremental improvements toward stronger information security against contemporary threats.

How does this affect me?

This change will be applied automatically the next time you log in, without the need to change your current password.

If any user associated with your account does not log in within the next 30 days, their password will be automatically changed, and at their next login, they will be prompted to restore access via your corporate email or by requesting a reset from your account administrator.

SSO users are not affected by this policy..

If you want more information, you can read our blog post or contact us at security@videsk.io.

Axios Supply Chain Attack — Security Notice

On March 31st, 2026, a supply chain attack targeting the Axios npm package was reported. Versions 1.14.1 and 0.30.4 were compromised through a hijacked maintainer account, injecting a malicious dependency (plain-crypto-js@4.2.1) that deployed a cross-platform Remote Access Trojan (RAT).

Videsk is not affected by this vulnerability.

We took immediate action on the same day the advisory was disclosed, reviewing all backend and frontend services using the following mechanisms:

• GitHub Security Advisory (GHSA) automated scanning
• Manual audit via regex pattern matching across all repositories

No compromised versions were found, nor were any dependencies associated with plain-crypto-js identified in any of our services.

Audit evidence

$ bash ./axios-vuln.sh

47 SAFE

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
AXIOS SUPPLY CHAIN ATTACK — INTERNAL AUDIT REPORT
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
📅 Scan date:        2026-04-01 22:55:25 UTC
🔍 Advisory:         axios npm supply chain compromise (UNC1069)
⚠️  Affected versions: 1.14.1, 0.30.4
🛡️  Malicious dep:    plain-crypto-js@4.2.1
📦 Projects scanned: 47
✅ Clean:            47
🚨 Compromised:      0
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
RESULT: NO AFFECTED SYSTEMS DETECTED
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

No customer data, services, or infrastructure were affected. No credentials were exposed and no remediation action is required on your part.

For further details on the advisory, refer to Google Threat Intelligence's analysis.