ActiveCampaign: Trust page changed

Trust / securityChanged (not classified) (rule)Changed 2026-10-23 08:57 UTCtrust.activecampaign.com

Summary

ActiveCampaign added a security notice for PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. Its Security team is reviewing them and taking measures where needed under its standard vulnerability management process; customers do not need to take action at this time.

Machine-written from the diff below (Sol; type: other). Check the diff before relying on it.

What changed

~~Struck in red~~ is what ActiveCampaign removed; blue is what they added. Muted text is unchanged context.

Added#1

…a mechanism for reporting vulnerabilities? Updates View all nothing here Compliance ActiveCampaign's Latest SOC 2 Type II Report…

…a mechanism for reporting vulnerabilities? Updates View all Security Security Notice: PHP Vulnerabilities (CVE-2026-109618, CVE-2026-109619) Published ‹date› ActiveCampaign is aware of the recently disclosed PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. Our Security team is reviewing them and taking measures where needed in line with our standard vulnerability management process. At this time, you do not need to take any action and we do not have evidence that this vulnerability has been exploited on our platform. Read more Read more about Security Notice: PHP Vulnerabilities (CVE-2026-109618, CVE-2026-109619) Compliance ActiveCampaign's Latest SOC 2 Type II Report…

Compared with the previous archived version (#5422 to #6255). Text is normalized before comparing: dates, counters and tokens show as ‹date›, ‹count›, ‹tok›, and noise-only edits are hidden. Rewindex shows changed passages with a few words of context, not a copy of the page. View the live page (opens in new tab).

Archive proof

Rewindex commits each page capture it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves these records existed by then and have not been changed since, by anyone, Rewindex included.

How the archive is checked, and what it cannot prove.

Oct 22
Before captured 09:01 UTC
In the 2026-10-22 checkpoint, timestamped by FreeTSA and DigiCert on Oct 23, 11:49 UTC. Record hash e1374252bd2162b5…
Download proof
Oct 23
After captured 08:57 UTC
In the 2026-10-23 checkpoint, timestamped by FreeTSA and DigiCert on Oct 24, 00:41 UTC. Record hash 720100ea6f798eaf…
Download proof

History of this page

YesterdaySunday, October 25Sun, Oct 25

1 page change

Content changed
08:59Page change
Trust pagechanged
ActiveCampaign’s Trust page added “about” to the controls update timestamp wording. This is a wording-only change with no shown change to controls or customer-facing functionality.

Friday, October 23

1 page change

Content changed
08:57Page change
Trust pagechangedthis change
ActiveCampaign added a security notice for PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. Its Security team is reviewing them and taking measures where needed under its standard vulnerability management process; customers do not need to take action at this time.

Thursday, October 22

1 page change

Content changed
09:01Page change
Trust pagechanged
ActiveCampaign’s trust page added Full Disk Encryption and Data Loss Prevention to its listed security controls, giving customers additional documented controls to review during security assessments.

All ActiveCampaign changes ActiveCampaign profile Markdown JSON