Snapshot 257798
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Skip to navigationSkip to main content Userpilot We’ve built security into every layer of our products and operations, so you can focus on growth while we protect your data. security@userpilot.com Compliance SOC 2 HIPAA GDPR Data Privacy Framework Program Resources View all SOC2 Type II SOC2 Type II 2026 GDPR External Penetration Testing Userpilot Pentest 2026 Other resources Policy Packet Userpilot, Inc. - Letter of Commitment.pdf Userpilot AI Security Overview Controls View all Infrastructure security Encryption key access restricted Unique account authentication enforced Production application access restricted View 13 more Infrastructure security controls Organizational security Asset disposal procedures utilized Production inventory maintained Anti-malware technology utilized View 10 more Organizational security controls Product security Data encryption utilized Control self-assessments conducted Penetration testing performed View 1 more Product security control Internal security procedures Continuity and Disaster Recovery plans established Continuity and Disaster Recovery plans tested Cybersecurity insurance maintained View 31 more Internal security procedures controls Data and privacy Data retention procedures established Data classification policy established Subprocessors View all Amazon Web Services • Cloud Hosting Provider United States, Europe By default, our AWS servers are hosted in the US, with EU hosting available on select plans Updates View all Security Userpilot's Response on PHP2Shell Recent Vulnerabilities Published October 28, 2026 Below is Userpilot's position on the PHP vulnerabilities disclosed on 20–21 October 2026 (CVE-2026-109618 and CVE-2026-109619, also known as "PHP2Shell"). Exposure The Userpilot application and platform used to deliver our services and process customer data are not affected. This includes their hosting, third-party components and sub-processors. The only Userpilot component that ran an affected PHP version was our public marketing website and blog. These run on infrastructure separate from the application and do not store, process or have access to customer data. 2.Remediation The affected website and blog were patched to a fixed version on 21 October 2026, and the PHP/web services were restarted. Remediation is complete, so no further interim mitigations are needed. Monitoring and compromise assessment For the period between disclosure and remediation, we reviewed the affected website and blog for signs of compromise. This included: Cloudflare WAF alerts and web server logs for exploitation attempts or anomalous requests Web roots, for unexpected or modified files such as web shells System activity, for unexpected processes, privilege changes, new accounts or new scheduled tasks Outbound network activity, for unexpected connections or data transfers Outcome No indicators of compromise or suspicious activity were found. No customer data or services were affected. Credentials The affected systems did not handle any customer credentials, tokens or API keys, or any credentials for the Userpilot application. No customer-related credential rotation was needed. Notification We have found no actual or suspected compromise of, or unauthorized access to, customer data. If that changes, we will notify affected customers right away, in line with our contractual and data protection obligations.