diff --git a/docs/auth/security.md b/docs/auth/security.md
index b417bdff..91717c1a 100644
--- a/docs/auth/security.md
+++ b/docs/auth/security.md
@@ -5,6 +5,12 @@ title: Security Architecture
 
 # Security Architecture
 
+:::note Security notice: PHP RCE vulnerabilities (October 2026)
+epilot is **not affected** by the "php2shell" PHP remote code execution vulnerabilities disclosed on October 21, 2026 ([CVE-2026-109618](https://www.cve.org/CVERecord?id=CVE-2026-109618), [CVE-2026-109619](https://www.cve.org/CVERecord?id=CVE-2026-109619)). epilot does not use PHP anywhere in its platform.
+
+epilot runs on a [serverless Node.js stack](/docs/architecture/overview#tech-stack) on AWS Lambda, where AWS automatically applies security updates to the managed runtimes.
+:::
+
 epilot runs on AWS with security enforced at every layer: multi-tenant isolation, authentication, authorization, encryption, and API protection.
 
 :::info