Acquia Trust Center

Vulnerability Advisor: Certificate Authority Compromise
https://www.php.net/archive/2026.php#2026-10-20-1

It was publicly disclosed that the private keys of eight eMudhra intermediate CA certificates have been compromised. These certificates chain to roots trusted by all major browsers and operating systems. Until trust stores are updated, an attacker could theoretically use these keys to impersonate websites and services.
Major browser vendors have already taken action — Firefox and Chrome blocked the affected certificates on October 17, and Apple devices followed on October 19. Continued upstream updates are pending from operating system maintainers.
Acquia is updating CA certificate bundles across our platform infrastructure. We encourage you to share this message with your security teams who may have questions for us so they can subscribe for updates.

Vulnerability Advisory: PHP RCE’s (CVE-2026-109618 and CVE-2026-109619)
https://www.php.net/archive/2026.php#2026-10-20-1

Severity: Critical

Acquia was notified in advance of the pending release of a patch to PHP due to a pair of CVSS 9.2 PHP CVE’s. Tracked as CVE-2026-109618 and CVE-2026-109619, these vulnerabilities involve a Remote Code Execution (RCE) flaw in PHP Versions starting at 5.x. If exploited, this could allow an unauthenticated attacker to execute arbitrary code on a vulnerable servers.

Acquia is preparing for this release tomorrow and will provide further status updates here. We encourage you to share this message with your security teams who may have questions for us so they can subscribe for updates.

The Acquia Cloud PCI DSS Attestation of Compliance is now available for review. For clients who procure the Acquia Cloud PCI Compliant Hosting, find the 2026 AOC available on the document tile "PCI DSS". If you have any questions, please reach out to your designated account manager!

Acquia is pleased to announce the release of the 2025 SOC1 Type 2 and SOC2 Type 2 reports, covering January 1, 2025 through December 31, 2025. These reports are now available on our Trust Center and confirm our commitment to the highest standards of security, confidentiality and availability. The audit scope for this cycle included Acquia Cloud (Classic & Next with supporting services), Acquia Customer Data Platform, Acquia Campaign Studio/Factory and Acquia DAM.

Acquia Web Governance, formerly known as Optimize or Monsido, is not included but will follow a similar roadmap as to the acquisition of Acquia DAM (via Widen Enterprises). Effective 12-31-2025 Acquia Web Governance is officially on Acquia policy and procedure and will be operating on the company controls for the full calendar year audit period to be included in the 2026 Audit Cycle assessment.

If your access has expired, please request an extension and our team will review and renew that promptly.

Acquia is aware of the React2Shell vulnerability and has not detected any public exposures to React2Shell at this time, but investigation is still underway. We were able to identify potential exposures on internal, non-public facing tools and immediately executed remediations. As this is an externally facing attack, we encourage all Acquia customers to review their implementations and take appropriate remediation actions.