DocuSign: Trust page changed

Trust / securityChanged (not classified) (rule)Changed 2026-10-23 08:45 UTCwww.docusign.com

Summary

DocuSign updated its PHP2Shell vulnerability alert to confirm that core services do not use PHP and are unaffected, and that its investigation found no indicators of compromise. A limited number of internal systems use PHP and are being remediated; the alert also links to PHP’s recommended mitigation measures.

Machine-written from the diff below (Sol; type: other). Check the diff before relying on it.

What changed

~~Struck in red~~ is what DocuSign removed; blue is what they added. Muted text is unchanged context.

Changed#1

…back here for any updates regarding the schedule. ~~Alert: PHP2Shell Vulnerability ‹date›~~ Docusign became aware of a critical vulnerability affecting…

…back here for any updates regarding the schedule. [UPDATED] Alert: PHP2Shell Vulnerability ‹date› [UPDATED: ‹date› ] On ‹date› , Docusign became aware of a critical vulnerability affecting…

Added#2

…vulnerability affecting PHP, known as PHP2Shell. Details regarding nothing here are available in the PHP project’s security advisory:…

…vulnerability affecting PHP, known as PHP2Shell. Details regarding this vulnerability and PHP’s recommended mitigation measures are available in the PHP project’s security advisory:…

Added#3

…PHP project’s security advisory: https://www.php.net/archive/2026.php# ‹date› -5 . nothing here On ‹date› Docusign became aware of a critical…

…PHP project’s security advisory: https://www.php.net/archive/2026.php# ‹date› -5 . We can confirm that our core services do not use PHP and are not affected by this vulnerability. The Docusign security and engineering teams have completed a comprehensive investigation into PHP2Shell and found no indicators of compromise in our environment. We have identified a limited number of internal Docusign systems that utilize PHP and we are actively remediating them. For developers, we are also updating our external integration documentation with an instruction to use a patched PHP version. We are continuing to monitor for any further changes or updates. The security of our products is a top priority. Docusign will continue to monitor the situation as it evolves. Please visit https://docusign.com/trust/alerts for the latest updates regarding this alert. [ORIGINAL: ‹date› ] On ‹date› Docusign became aware of a critical…

Compared with the previous archived version (#5228 to #6062). Text is normalized before comparing: dates, counters and tokens show as ‹date›, ‹count›, ‹tok›, and noise-only edits are hidden. Rewindex shows changed passages with a few words of context, not a copy of the page. View the live page (opens in new tab).

Archive proof

Rewindex commits each page capture it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves these records existed by then and have not been changed since, by anyone, Rewindex included.

How the archive is checked, and what it cannot prove.

Oct 22
Before captured 08:44 UTC
In the 2026-10-22 checkpoint, timestamped by FreeTSA and DigiCert on Oct 23, 11:49 UTC. Record hash 4a5d07b09e3951f4…
Download proof
Oct 23
After captured 08:45 UTC
In the 2026-10-23 checkpoint, timestamped by FreeTSA and DigiCert on Oct 24, 00:41 UTC. Record hash 1d9e31cf2b541907…
Download proof

History of this page

TodayWednesday, November 4Wed, Nov 4

1 page change

Content changed
08:44Page change
Trust pagechanged

Friday, October 30

1 page change

Content changed
08:45Page change
Trust pagechanged
DocuSign added planned CLM Prod EU S1 maintenance for Saturday, <date>, from 12AM UTC to 3AM UTC: UI previews, Workflow steps, Standard attributions and Party agreement may be unavailable for up to 10 minutes, with slower UI responses; workflow processing should continue normally. The eSignature Azure Australia and Canada Production disaster-recovery exercise notice was removed.

Saturday, October 24

1 page change

Content changed
08:45Page change
Trust pagechanged
DocuSign’s Trust page replaced “core services” with “Docusign-operated services and products utilized by our customers” in its statement that these do not use PHP and are not affected. This clarifies the wording of the assurance without announcing a product or service change.

Friday, October 23

1 page change

Content changed
08:45Page change
Trust pagechangedthis change
DocuSign updated its PHP2Shell vulnerability alert to confirm that core services do not use PHP and are unaffected, and that its investigation found no indicators of compromise. A limited number of internal systems use PHP and are being remediated; the alert also links to PHP’s recommended mitigation measures.

Thursday, October 22

1 page change

Content changed
08:44Page change
Trust pagechanged
DocuSign’s Trust page added an alert about PHP2Shell, a critical PHP vulnerability under active investigation; customer impact was not specified. It also removed the CLM Australia Production maintenance notice for CLM Prod AU S1 (4PM UTC to 7PM UTC), which warned of brief feature unavailability and slower UI responses.

Cite this

Trust page changed on DocuSign’s Trust page, changed 2026-10-23 08:45 UTC (change 2 of 5).

Title: Trust page changed
Vendor: DocuSign
Date: 2026-10-23 08:45 UTC
URL: https://rewindex.com/change/p6062

All DocuSign changes DocuSign profile Markdown JSON