Subject: Security Notice: No Impact from PHPshell Zero-Day Vulnerability

What to do

• Check whether you use Chargebee Product Security. Check your stack

  Paste a package.json, lockfile, Terraform or a list of domains at down.guide/stack to see every provider you depend on.

• Confirm your retries, queues and scheduled jobs caught up after the 11d 15h it lasted.

  Anything that failed between 2026-10-22 15:43 UTC and 2026-11-03 07:07 UTC may need a replay.

• Subscribe to Chargebee's feed to hear about the next one first. RSS feed

  https://down.guide/feed?provider=chargebee works in Slack (/feed subscribe), Discord feed bots and any RSS reader.

Updates from Chargebee 2

1. monitoringOct 22, 2026, 3:43 PM UTC

   Chargebee is aware of the recently reported PHPshell zero-day vulnerability and has completed an initial assessment of its potential impact on our services. Chargebee does not use PHP in its customer-facing workflows. Based on our assessment, this vulnerability does not affect Chargebee’s services or customer integrations, and no action is required by our customers at this time. As an additional precaution, we are verifying with our subprocessors to confirm they are unaffected and to ensure appropriate safeguards remain in place across our service ecosystem. We will continue to monitor relevant security developments and provide updates if our assessment changes. If you have any questions, please contact Chargebee Support.

   provider

2. resolvedNov 3, 2026, 7:07 AM UTC

   This incident has been resolved.

   provider

Corrections

None so far.

Something wrong on this page? Report an error or send us a note. Every fix is listed here.