[UPDATED] Alert: PHP2Shell Vulnerability

[UPDATED: October 22, 2026] On October 21st, 2026, Docusign became aware of a critical vulnerability affecting PHP, known as PHP2Shell. Details regarding this vulnerability and PHP’s recommended mitigation measures are available in the PHP project’s security advisory: https://www.php.net/archive/2026.php#2026-10-21-5. 

We can confirm that our Docusign-operated services and products utilized by our customers do not use PHP and are not affected by this vulnerability. The Docusign security and engineering teams have completed a comprehensive investigation into PHP2Shell and found no indicators of compromise in our environment. 

We have identified a limited number of internal Docusign systems that utilize PHP and we are actively remediating them. For developers, we are also updating our external integration documentation with an instruction to use a patched PHP version. We are continuing to monitor for any further changes or updates.

The security of our products is a top priority. Docusign will continue to monitor the situation as it evolves. Please visit https://docusign.com/trust/alerts for the latest updates regarding this alert.

[ORIGINAL: October 21, 2026] On October 21st, 2026 Docusign became aware of a critical vulnerability affecting PHP, known as PHP2Shell. Details regarding the vulnerability are available in the PHP project’s security advisory: https://www.php.net/archive/2026.php#2026-10-21-5. An active investigation is underway, and we will share additional details as they become available. Please visit the Docusign Trust Center (https://www.docusign.com/trust) for the latest updates and information.