Snapshot 217542
Normalized text
Scripts and page chrome removed; this is what change detection compares.
SECURITY ADVISORY PHP Engine Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) Published on Oct 23, 2026 Executive Summary Two critical vulnerabilities affecting the PHP runtime, CVE-2026-109618 and CVE-2026-109619 (collectively referred to as PHP2Shell), were publicly disclosed on 21 October 2026. Both vulnerabilities are rated CVSS 9.2 and may allow unauthenticated remote code execution (RCE) on vulnerable PHP-based web servers. The disclosed vulnerabilities impact the PHP runtime itself rather than specific PHP applications. Successful exploitation could allow an unauthenticated attacker to achieve remote code execution before application-level authentication or business logic is processed. Following a review of the Powtoon application architecture, Powtoon is not affected by these vulnerabilities because Powtoon does not utilize PHP in its application stack, services, infrastructure components, or customer-facing applications. Therefore, the vulnerable PHP runtime is not present within the Powtoon production environment. Technical Justification Powtoon’s cloud-native web platform, video generation rendering pipeline, backend APIs, and supporting infrastructure do not use PHP in any capacity. Powtoon’s architecture is built strictly on non-PHP tech stacks running within containerized environments. Dependency & Subprocessor Check: All third-party libraries, container base images, and external subprocessors used within the production platform were scanned and confirmed free of PHP runtime dependencies. Required Actions For Powtoon Users & Enterprise Clients: No action is required. Your account data, content, and integrations remain fully secure. For questions or security inquiry submissions, contact the Powtoon Security Team at Field-security@powtoon.com. Compliance Powtoon goes to great lengths ensuring best-in-class security and privacy for its users worldwide. Policies Continuous monitoring App Security Annual Penetration Test Code Review Process Quarterly Vulnerability Scan Software Development Lifecycle Vulnerability Management Data Security Daily Database Backups Encryption at Rest Security Policy SSL/TLS Enforced Organization Security Acceptable Use Policy BCDR Plan Disaster Recovery Plan Incident Response Plan Security Training Subprocessors D-iD Generative AI avatars and synthetic video creation Data location: AWS USA Open AI AI integration for generating voiceovers Data location: USA Sentry Application monitoring service Data location: USA Elevenlabs AI integration for generating voiceovers Data location: USA Azure AI integration for generating voiceovers Data location: USA Fastly IaaS - cache and proxy service & Web Application Firewall Data location: USA AI Impact Assessment 2 As Powtoon develops and ships features that utilize AI to provide huge value to its customers, it is of utmost importance to understand and mitigate risks inherent in the use of such models. We are also faced with concerns of prospects and customers who want to be informed on Powtoon's approach to making these features safe for their businesses and organizations. Script writer: Script writer is a feature that creates a text only script for a Powtoon video that describes the visuals for each scene, the text and the voiceover for each scene of the script. This feature utilizes off the shelf LLM models and prompt engineering as well as prompt chaining to generate video scripts. Video Assistant: Our Video Assistant is a software wizard that uses off-the-shelf LLMs and prompt engineering to create simple Powtoon videos. Users input the video subject, optional key points/call to action, audience, and desired tone. The LLMs generate the video script, metadata for stock image selection, text overlays, and voiceover text. Video footage is chosen from Powtoon's stock media library based on LLM-provided keywords. Voiceover Creation: Our Text to Voice feature converts user-entered text into narrated spoken words using natural-sounding synthetic voices that resemble professional human voice talents. Although Text to Voice conversion has existed for decades, recent massive improvements are due to advances in deep learning, particularly generative AI. Human Avatar Creation: This Powtoon feature enables users to have text spoken by a human presenter avatar, with a user-selected voice. These avatars are based on real actors supplied by a third-party vendor. Custom avatars can also be created from user-provided video footage, processed by the third party. Text to Image and Text to Video (Image/Video generation): Text-to-image AI can generate realistic images from prompts, potentially revolutionizing media, entertainment, and design. Caption generation and Powtoon translation: Caption generation utilizes Automatic Speech Recognition (ASR) models like OpenAI's Whisper or Google's Speech-to-Text, often based on deep learning or transformer architectures. Translation employs Neural Machine Translation (NMT) models, such as Transformer-based architectures like Google's T5 or Meta’s NLLB, for accurate, context-aware multilingual output. AI Governance: Powtoon has established a framework for the responsible development and management of AI systems, outlining principles and controls to ensure ethical, safe, and compliant use. All AI systems must undergo a pre-development or pre-procurement risk assessment. AI regulatory compliance: Powtoon navigates the complex, evolving landscape of AI regulatory compliance by adhering to general data privacy laws and emerging AI-specific regulations. Major compliance areas for a SaaS utilizing AI include: Data Privacy (GDPR, CCPA), Security (ISO 27001), AI-Specific Laws (EU AI Act), and Standard Adoption (ISO 42001). Third party Management: Powtoon has strict policies in place to manage third party risk. Our vendor management includes a security review that assures Powtoon's security policies are met before new vendors' technology can be used in the company or integrated into our systems. Full usage rights assignment from third party to end customer: We only work with vendors who will grant us and our end customers perpetual, unlimited usage rights for content created by their models. No Training on Customer Data: Our AI tools are trained solely on public data, never client data or user-submitted datasets. Vendors are contractually required not to use customer prompts or transmitted data for training or service improvement. No Customization: We selected vendors who heavily filter harmful, offensive, or dangerous model responses. The tools are used as-is, without customization or external knowledge bases like RAG. Content Validation & Bias Mitigation: Our AI generates accurate, responsible content by using only vetted public sources (our website and official documentation). Rigorous validation precedes each release to mitigate bias and hallucination. Intrusion Detection & Security Controls: Powtoon AI systems are robustly defended against prompt injection, priming, and model tampering, with architecture preventing unauthorized prompt or model modification. While public data sources make data poisoning and model inversion irrelevant, all identified risks are documented and continuously assessed by QA. Minimal retention of customer data: Powtoon assures contractually that any data (prompts, keywords, etc.) a third party service provider receives via an API call to generate new content, or content in a new modality, will be retained only for the minimal time required to perform the requested service. Highlights Powtoon has implemented an Information Security Management System (ISMS) and continuously adheres to the required controls for each domain. Powtoon is implemented as an online, browser-based, multi-tenant Software-as-a-Service (SaaS). The system is architected from the ground up as a highly available, fully scalable web application with a multi-tiered architecture. Privacy details Privacy URL