Update on PHP security vulnerability

What to do

• Check whether your product depends on HubSpot. Check your stack

  Paste a package.json, lockfile, Terraform or a list of domains at down.guide/stack to see every provider you depend on.

• Confirm your retries, queues and scheduled jobs caught up after the 1h 53m it lasted.

  Anything that failed between 2026-10-22 01:38 UTC and 2026-10-22 03:31 UTC may need a replay.

• Subscribe to HubSpot's feed to hear about the next one first. RSS feed

  https://down.guide/feed?provider=hubspot works in Slack (/feed subscribe), Discord feed bots and any RSS reader.

Updates from HubSpot 3

1. investigatingOct 22, 2026, 1:38 AM UTC

   HubSpot is aware of the recently disclosed PHP security vulnerability. PHP isn't part of HubSpot's infrastructure, and we are not aware of any impact to our platform or customers. We will continue to watch the situation and provide an update if our assessment changes.

   provider

2. monitoringOct 22, 2026, 2:00 AM UTC

   HubSpot is aware of the recently disclosed PHP security vulnerability. PHP isn't part of HubSpot's infrastructure, and we are not aware of any impact to our platform or customers. We will continue to watch the situation and provide an update if our assessment changes.

   provider

3. resolvedOct 22, 2026, 3:31 AM UTC

   HubSpot is aware of the recently disclosed PHP security vulnerability. PHP isn't part of HubSpot's infrastructure, and we are not aware of any impact to our platform or customers. We will continue to watch the situation and provide an update if our assessment changes.

   provider

Corrections

None so far.

Something wrong on this page? Report an error or send us a note. Every fix is listed here.