Typeform’s Trust page added a security update about critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, stating that its security and engineering teams began preparing after advance notice. An older compliance-update entry was removed; customers have a new advisory to review, but the excerpt does not establish Typeform’s exposure or completed remediation.
Machine-written from the diff below (Sol; type: other). Check the diff before relying on it.
What changed
Struck in red is what Typeform removed; blue is what they added. Muted text is unchanged context.
BeforeAfter
Added#1
Before: …a list of your subprocessors? Updates View all nothing here General 2026 Security & Compliance Updates Now Available…
After: …a list of your subprocessors? Updates View all Security Security update: PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) Published ‹date› On ‹date› , the PHP project published a security advisory Opens in new tab for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. They affect a wide range of web infrastructure across the industry. Our security and engineering teams began preparing as soon as the PHP project gave advance notice of the release. Before the fixes were available, we applied the interim mitigations recommended in the advisory and put additional protective measures in place across our environment. These included updated web application firewall rules and further security hardening, along with deploying the patched PHP releases, which address both vulnerabilities. At this time, we have no indication that customer data has been affected. No action is required from you. We’ll update this page if the situation changes. Read more Read more about Security update: PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) General 2026 Security & Compliance Updates Now Available…
Removed#2
Before: …Read more about HECVAT and Trust Centre Updates General Pleased to Share Our Latest Security & Compliance Updates Published ‹date› Maintaining a secure and trustworthy platform is at the core of what we do, and we're happy to report on our team's latest achievements in this ongoing effort. We have successfully completed our scheduled surveillance audit for ISO/IEC 27001 , 27017 , and 27018 . Alongside these, our new SOC 2 Type II and HIPAA compliance reports…
After: …Read more about HECVAT and Trust Centre Updates removed SOC 2 Type II and HIPAA compliance reports…
Removed#3
Before: …our new SOC 2 Type II and HIPAA compliance reports are also finalized and ready! We take pride in this consistent work and hope it provides you with continued confidence while making your own due diligence process a little smoother. You can find all our new reports waiting for you in our resources Opens in new tab . Read more Read…
After: …our new SOC 2 Type II and HIPAA removed Opens in new tab . Read more Read…
Removed#4
Before: …new tab . Read more Read more about Pleased to Share Our Latest Security & Compliance Updates Opens in new tab Ask Typeform a…
After: …new tab . Read more Read more about removed Updates Opens in new tab Ask Typeform a…
Removed#5
Before: …How does Typeform handle access controls and authentication? What are the key security controls mentioned in the Typeform Trust Center? What compliance frameworks and certifications does Typeform follow?…
After: …How does Typeform handle access controls and authentication? removed What compliance frameworks and certifications does Typeform follow?…
Compared with the previous archived version (#1049 to #6259). Text is normalized before comparing: dates, counters and tokens show as ‹date›, ‹count›, ‹tok›, and noise-only edits are hidden. Rewindex shows changed passages with a few words of context, not a copy of the page. View the live page (opens in new tab).
Archive proof
Rewindex commits each page capture it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves these records existed by then and have not been changed since, by anyone, Rewindex included.
Typeform’s trust page removed “Unique production database authentication enforced” and added “Unique network system authentication enforced” from its infrastructure security control listings. It also removed a question about listing subprocessors; these page-content changes do not establish changes to authentication enforcement or subprocessors.
Typeform’s Trust page removed the question “How does Typeform handle access controls and authentication?” This is a page-content change; the evidence does not show any change to access controls or authentication features.
Friday, October 23
1 page change
Content changed
Page change
Trust pagechangedthis change
Typeform’s Trust page added a security update about critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, stating that its security and engineering teams began preparing after advance notice. An older compliance-update entry was removed; customers have a new advisory to review, but the excerpt does not establish Typeform’s exposure or completed remediation.
Cite this
Trust page changed on Typeform’s Trust page, changed 2026-10-23 08:59 UTC (change 1 of 3).