Trust Center

Over the past week, Fullstory has addressed four newly disclosed security vulnerabilities in widely used software. Some of them affect products and systems we run, and some affect the tools our engineers use to build and test. This update explains each issue, what we have done, and what is still in progress.

Web Scripting Vulnerability in Guides and Surveys (CVE-2026-109618, CVE-2026-109619)

This vulnerability affected the software behind our Guides and Surveys product (Usetiful). No other part of the FullStory platform uses that software. We deployed a fixed version to production in both the North America and EU regions on October 21, and we updated the legacy Usetiful environment as well. There has been no evidence of compromise.

A related follow-up issue (CVE-2026-115560) was disclosed on October 23. It requires an uncommon configuration and is being closely monitored in our environment. We will install the vendor's fix in its next regular update.

Compromised Certificate Authority (CVE-2026-111943)

A certificate authority used to verify secure connections was compromised, which put the trust settings on many computers, build systems, and servers at risk. We have merged fixes for our internal systems, and the affected production services have been redeployed. There has been no evidence of compromise.

Linux Operating System Vulnerability (ZDI-CAN-33367)

This vulnerability allows someone who already has access to a system to gain full control of it. It cannot be used by an outside attacker over the internet alone.

We have approved a protective configuration change on our Linux servers that blocks the publicly available method for using this vulnerability. That change is rolling out to all environments now. We will install the operating system vendor's full fix as soon as it is released, and we are addressing this as soon as possible. There has been no evidence of compromise.

Node.js Vulnerability (CVE-2026-111497)

This vulnerability affects Node.js, a common tool used to run web services. It can be triggered when a service requests data from a malicious source. Our own data processing is not affected.

We will continue to patch and monitor the web infrastructure for our Guides and Surveys product, and we are updating Node.js to a fixed version across our remaining services. There has been no evidence of compromise.

Our Commitment

We continuously monitor disclosed vulnerabilities in the software we depend on, and we prioritize fixes based on how exposed a system is and how easily it could be exploited. For questions about any of these issues, please contact your FullStory account team or reach out through the Trust Center.

Response to customers

On October 21, 2026, the PHP project disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (known as “PHP2Shell”). Usetiful, the guides and surveys product Fullstory acquired, and the guides and surveys feature within the Fullstory app are built on PHP and were affected. We updated both upon learning of the vulnerabilities. To date, we have found no evidence of exploitation or unauthorized access to customer data. We continue to monitor the situation and will update this page if that changes. Below, you will find the background, our exposure, and the remediation steps we have taken.

PHP Vulnerability Background

CVE-2026-109618 and CVE-2026-109619 are unauthenticated remote code execution flaws in the core PHP engine, each rated CVSS v4.0 9.2. Because the flaws sit in PHP itself, an attacker can trigger them before any application code runs. They affect PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, and php-cgi.

• CVE-2026-109618: out-of-memory handling can leave request data partially initialized, which cleanup may then treat as valid. (advisory)
• CVE-2026-109619: request-owned state can outlive its memory and be reused by a later request on the same worker. (advisory)

To learn more, see the PHP security announcement.

Fullstory Response & Actions to the PHP Vulnerabilities

The core Fullstory platform, including session capture, data processing, and the Fullstory app, does not use PHP. PHP is only used by Usetiful, a legacy product that delivers in-app guides and surveys through an embedded widget.

Fullstory identified the disclosure on the morning of October 21, 2026, and opened a security incident the same day. Our Security Engineering and product teams completed the following steps:

What we did

• Rebuilt the affected Usetiful services on a non vulnerable version of PHP, which contains the fix, and deployed them to production.
• Patched the legacy Usetiful environment.
• Turned on additional WAF rules that detect attempts to exploit these vulnerabilities.
• Continue to review logs and runtime telemetry for signs of exploitation.

Customers do not need to take any action.

Conclusion

The core Fullstory platform was not affected by CVE-2026-109618 or CVE-2026-109619. One affected legacy product, Usetiful, has been patched, and we found no evidence of exploitation or unauthorized access to customer data. We will continue to monitor for new information and will update this post if anything changes. Questions can be directed to your Fullstory account team.

Trust is one of our core watchwords and we hold our responsibility as protectors of our customers' information in the highest regard.
We are happy to say that our latest SOC2, Type 2, and our SOC3 reports are now available.

Our 2025 SOC2, Type 2 Report is available here

Our 2025 SOC3, Type 2 Report is available here

Trust is one of our core watchwords and we hold our responsibility as protectors of our customers' information in the highest regard.

We are happy to say that our latest Penetration Test Executive Report and Addendum (our response to each finding along with their remediation status) is now available.

Our Penetration Test Executive Report is available here

Our Penetration Test Addendum is available here

Trust is one of our core watchwords and we hold our responsibility as protectors of our customers' information in the highest regard.
We are happy to say that we are the first in our industry to achieve ISO 42001 certification! This is in addition to our other ISO certifications as well as our SOC2 attestation.

ISO/IEC 42001 is the world’s first international standard that specifies requirements for establishing, implementing, and maintaining an Artificial Intelligence Management System within an organization. It is designed to provide a structured framework for businesses to manage AI technologies responsibly, focusing on ethical considerations, transparency, and risk management.

Our ISO 42001 certificate is available here.

For more information, please see our official announcement.