Pendo: Trust page changed

Trust / securityChanged (not classified) (rule)Changed 2026-10-23 08:58 UTCtrust.pendo.io

Summary

Pendo added a security update about critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, stating that its Security team began assessing exposure upon disclosure. Pendo says its platform is not built on PHP, but the archived excerpt cuts off before its conclusion about products and customer data.

Machine-written from the diff below (Sol; type: other). Check the diff before relying on it.

What changed

~~Struck in red~~ is what Pendo removed; blue is what they added. Muted text is unchanged context.

Added#1

…Pendo slow down my application? Updates View all nothing here Incident Klue Compromise Published ‹date› Last week, an…

…Pendo slow down my application? Updates View all General Security Update: PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619) Published ‹date› We are aware of the recently disclosed critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. Pendo’s Security team began assessing our exposure as soon as the vulnerabilities were disclosed. The Pendo platform is not built on PHP, and we have confirmed that Pendo products and customer data are not impacted. We continue to monitor this issue closely, including our third-party services. We will provide updates here if our assessment changes. Questions can be sent to security@pendo.io or your Pendo account team. Read more Read more about Security Update: PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619) Incident Klue Compromise Published ‹date› Last week, an…

Compared with the previous archived version (#4558 to #6244). Text is normalized before comparing: dates, counters and tokens show as ‹date›, ‹count›, ‹tok›, and noise-only edits are hidden. Rewindex shows changed passages with a few words of context, not a copy of the page. View the live page (opens in new tab).

Archive proof

Rewindex commits each page capture it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves these records existed by then and have not been changed since, by anyone, Rewindex included.

How the archive is checked, and what it cannot prove.

Oct 21
Before captured 08:59 UTC
In the 2026-10-21 checkpoint, timestamped by FreeTSA and DigiCert on Oct 22, 00:41 UTC. Record hash 93857f7269c79ef9…
Download proof
Oct 23
After captured 08:58 UTC
In the 2026-10-23 checkpoint, timestamped by FreeTSA and DigiCert on Oct 24, 00:41 UTC. Record hash 9bc3edd0192e52dd…
Download proof

History of this page

Friday, October 23

1 page change

Content changed
08:58Page change
Trust pagechangedthis change
Pendo added a security update about critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, stating that its Security team began assessing exposure upon disclosure. Pendo says its platform is not built on PHP, but the archived excerpt cuts off before its conclusion about products and customer data.

Wednesday, October 21

1 page change

Content changed
08:59Page change
Trust pagechanged
Pendo’s Trust page changed the date beside AI Model Cards from September 2025 to October 2026 and specified that Cobalt.io performed its annual penetration test in September 2025. These are date and wording updates; the diff shows no change to service coverage or security commitments.

Cite this

Trust page changed on Pendo’s Trust page, changed 2026-10-23 08:58 UTC (change 2 of 2).

Title: Trust page changed
Vendor: Pendo
Date: 2026-10-23 08:58 UTC
URL: https://rewindex.com/change/p6244

All Pendo changes Pendo profile Markdown JSON