Notice: Amplitude not impacted by recent PHP vulnerabilities

What to do

• Check whether your product depends on Amplitude. Check your stack

  Paste a package.json, lockfile, Terraform or a list of domains at down.guide/stack to see every provider you depend on.

• Confirm your retries, queues and scheduled jobs caught up after the 0m it lasted.

  Anything that failed between 2026-10-22 19:25 UTC and 2026-10-22 19:25 UTC may need a replay.

• Subscribe to Amplitude's feed to hear about the next one first. RSS feed

  https://down.guide/feed?provider=amplitude works in Slack (/feed subscribe), Discord feed bots and any RSS reader.

Updates from Amplitude 1

1. resolvedOct 22, 2026, 7:25 PM UTC

   Amplitude has confirmed that no first-party Amplitude services are impacted by the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 (PHP2Shell Advisory). We are working with an affected third-party vendor to establish security updates on their end; however, internal hardening efforts should prevent potential escalation. No customer action is required at this time. As this is a developing advisory, any further updates will be communicated appropriately via our Trust Center at https://trust.amplitude.com/updates?tab=updates&update=65d46972-f7ed-4f53-bccf-f86f1d18393e. Please subscribe to our Trust Center for notification on updates as no further updates will be made on our Statuspage here.

   provider

Corrections

None so far.

Something wrong on this page? Report an error or send us a note. Every fix is listed here.