rewindex

CompaniesAmplitudeIncidents

Amplitude: Notice: Amplitude not impacted by recent PHP vulnerabilities

No impact listedStatus: resolvedStarted Resolved (0 min)1 updatestatus.amplitude.com (opens in new tab)

CVEs mentioned

Only CVEs the vendor’s text names by id, or that its notice says it is not affected by. A mention is not a statement that the vulnerability caused this incident.

Timeline of updates

  1. resolved

    Amplitude has confirmed that no first-party Amplitude services are impacted by the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 (PHP2Shell Advisory). We are working with an affected third-party vendor to establish security updates on their end; however, internal hardening efforts should prevent potential escalation.
    No customer action is required at this time.
    As this is a developing advisory, any further updates will be communicated appropriately via our Trust Center at https://trust.amplitude.com/updates?tab=updates&update=65d46972-f7ed-4f53-bccf-f86f1d18393e (opens in new tab).
    Please subscribe to our Trust Center for notification on updates as no further updates will be made on our Statuspage here.

Archive proof

Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves this record existed by then and has not been changed since, by anyone, Rewindex included.

How the archive is checked, and what it cannot prove.

Impact, status and times are the vendor’s own, as last archived. View on status.amplitude.com (opens in new tab).

Amplitude profileRecent Amplitude incidentsMarkdownJSON