Trust Center
Fullstory’s behavioral data platform helps technology leaders make better, more informed decisions. By injecting digital behavioral data into their analytics stack, our patented technology unlocks the power of quality behavioral data at scale–transforming every digital visit into actionable insights.
With Fullstory, enterprise businesses move closer to their customers and closer to success. When organizations understand their customers like never before they’re able to create world-class experiences that increase funnel conversion, easily detect malicious behaviors and fraud, and identify their highest-value customers effortlessly.
Featured Documents
Zipcar
Sprout Social
The Farmer's Dog
Adobe
Fanatics
Pizza Hut
Caesars Entertainment
Carvana
Grammarly
Duolingo
KeyBank
CarMax
Trust Center Updates
Fullstory response to PHP Vulnerabilities
Response to customers
On October 21, 2026, the PHP project disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (known as “PHP2Shell”). Usetiful, the guides and surveys product Fullstory acquired, and the guides and surveys feature within the Fullstory app are built on PHP and were affected. We updated both upon learning of the vulnerabilities. To date, we have found no evidence of exploitation or unauthorized access to customer data. We continue to monitor the situation and will update this page if that changes. Below, you will find the background, our exposure, and the remediation steps we have taken.
PHP Vulnerability Background
CVE-2026-109618 and CVE-2026-109619 are unauthenticated remote code execution flaws in the core PHP engine, each rated CVSS v4.0 9.2. Because the flaws sit in PHP itself, an attacker can trigger them before any application code runs. They affect PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, and php-cgi.
- CVE-2026-109618: out-of-memory handling can leave request data partially initialized, which cleanup may then treat as valid. (advisory)
- CVE-2026-109619: request-owned state can outlive its memory and be reused by a later request on the same worker. (advisory)
To learn more, see the PHP security announcement.
Fullstory Response & Actions to the PHP Vulnerabilities
The core Fullstory platform, including session capture, data processing, and the Fullstory app, does not use PHP. PHP is only used by Usetiful, a legacy product that delivers in-app guides and surveys through an embedded widget.
Fullstory identified the disclosure on the morning of October 21, 2026, and opened a security incident the same day. Our Security Engineering and product teams completed the following steps:
What we did
- Rebuilt the affected Usetiful services on a non vulnerable version of PHP, which contains the fix, and deployed them to production.
- Patched the legacy Usetiful environment.
- Turned on additional WAF rules that detect attempts to exploit these vulnerabilities.
- Continue to review logs and runtime telemetry for signs of exploitation.
Customers do not need to take any action.
Conclusion
The core Fullstory platform was not affected by CVE-2026-109618 or CVE-2026-109619. One affected legacy product, Usetiful, has been patched, and we found no evidence of exploitation or unauthorized access to customer data. We will continue to monitor for new information and will update this post if anything changes. Questions can be directed to your Fullstory account team.
FullStory's 2025 SOC2, Type 2 and SOC3 Reports now available
Trust is one of our core watchwords and we hold our responsibility as protectors of our customers' information in the highest regard.
We are happy to say that our latest SOC2, Type 2, and our SOC3 reports are now available.
Our 2025 SOC2, Type 2 Report is available here
Our 2025 SOC3, Type 2 Report is available here
Fullstory's 2025 Penetration Test Executive Reports now available
Trust is one of our core watchwords and we hold our responsibility as protectors of our customers' information in the highest regard.
We are happy to say that our latest Penetration Test Executive Report and Addendum (our response to each finding along with their remediation status) is now available.
Our Penetration Test Executive Report is available here
Our Penetration Test Addendum is available here
FullStory is now ISO 42001 certified!
Trust is one of our core watchwords and we hold our responsibility as protectors of our customers' information in the highest regard.
We are happy to say that we are the first in our industry to achieve ISO 42001 certification! This is in addition to our other ISO certifications as well as our SOC2 attestation.
ISO/IEC 42001 is the world’s first international standard that specifies requirements for establishing, implementing, and maintaining an Artificial Intelligence Management System within an organization. It is designed to provide a structured framework for businesses to manage AI technologies responsibly, focusing on ethical considerations, transparency, and risk management.
Our ISO 42001 certificate is available here.
For more information, please see our official announcement.
FullStory's new SOC2, Type 2 and SOC3 Reports now available
Trust is one of our core watchwords and we hold our responsibility as protectors of our customers' information in the highest regard.
We are happy to say that our latest SOC2, Type 2, and our SOC3 reports are now available.
Our SOC2, Type 2 Report is available (here)[https://trust.fullstory.com/item/soc2]
Our SOC3, Type 2 Report is available (here)[https://trust.fullstory.com/item/soc3]