Snapshot 239667
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Skip to navigationSkip to main content
Trust at Aerospike
Aerospike
trust@aerospike.com
Privacy PolicyOpens in new tab
Compliance
ISO 27001:2022
SOC 2 Type 2
CCPA
GDPR
Resources
View all
Aerospike-2025-Penetration Test-Final Report.pdf
Data Processing Addendum (DPA)
Opens in new tab
Privacy Policy
Opens in new tab
Aerospike Inc 2026 ISO 27001 Certificate.pdf
Aerospike-2026-Type 2 SOC 2-Final Report.pdf
Subprocessors
View all
Amazon Web Services • Cloud provider
USA, UK, Singapore
Aerospike Cloud runs on AWS infrastructure; customer data is hosted in AWS regions
Google LLC • Email & document repository
USA
Provides corporate email, calendar, and document storage/collaboration
Salesforce • CRM & support
USA
Manages prospect and customer accounts, support cases, and related metadata
Auth0 • Access & authentication
USA
Provides user authentication and access control for Aerospike services
Updates
View all
Security
Aerospike Response to PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell")
Published October 22, 2026
Impact on Aerospike products and services
Summary
Aerospike’s products (Aerospike Database, Aerospike Cloud, our client libraries and tools) are not impacted by CVE-2026-109618 nor CVE-2026-109619. PHP is in use on the servers that support our software download service. Those servers were updated with the appropriate patches as described in Ubuntu’s security advisory on October 21, 2026.
No customer action is needed for any service Aerospike operates. Customers who use the Aerospike PHP client run it on their own PHP installation and should update that installation (see question 4).
1. Does your service use PHP anywhere in your platform(s)?
Service Uses PHP?
Aerospike Database (Enterprise, self-managed) No
Aerospike Cloud (managed service) No
Aerospike client libraries and tools No. The Aerospike PHP client is an extension that runs inside the customer’s own PHP installation.
Software download service (download.aerospike.com, artifacts.aerospike.com) Yes. Patched October 21, 2026 (see question 3)
Aerospike Academy (learn.aerospike.com) Yes. Aerospike Academy encountered a period of downtime as the hosting provider performed patching. The service has been restored.
2. Are any of these instances externally facing?
Download servers: Yes. They serve public software downloads.
Aerospike Academy (learn.aerospike.com): Yes. As a precaution, the third-party provider took the site offline until it was patched, and has since restored the service.
3. Have you patched these vulnerabilities?
Download servers: Yes. On October 21, 2026, they were updated with Ubuntu’s security fix (Ubuntu Security Notice USN-8948).
Aerospike Academy (learn.aerospike.com): Yes. The third-party provider patched the site before restoring service.
4. Is any customer action required?
For services Aerospike operates: No.
For customers who use the Aerospike PHP client: the client does not include PHP. Aerospike strongly recommends that customers update their instance of PHP that utilizes the Aerospike PHP client.
5. If not patched: timeline, and will anything be taken offline?
Not applicable: the affected customer-facing systems have been patched.
Service interruptions:
The software download service had a brief interruption while it was patched on October 21, 2026, and is fully available.
Aerospike Academy (learn.aerospike.com) was taken offline by its provider as a precaution until it was patched. The provider has since restored the service.
6. Are mitigations available for customers who cannot patch immediately?
Not applicable to Aerospike software or services.
For customers’ own PHP environments, such as those running the Aerospike PHP client, the PHP project states that updating is the only complete fix.
See the PHP project’s security advisory of October 21, 2026Opens in new tab for the full guidance.
7. Additional protections beyond patching
The download servers’ server image and auto-scaling configuration were updated.
8. Have you observed any indication of exploitation or exploitation attempts?
No.
Aerospike’s security team is continuing to monitor for any impact or exploitation attempts.
For further questions, contact trust@aerospike.com.