From 40f2d235fe9fc1afc0d4823ebe32d724c845767b Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 22 Oct 2026 07:05:07 +0000 Subject: [PATCH] docs(security): add temporary notice on php2shell PHP RCE CVEs Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01DW9sERKhPZ12GS5M11bRnn --- docs/auth/security.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/docs/auth/security.md b/docs/auth/security.md index b417bdff..91717c1a 100644 --- a/docs/auth/security.md +++ b/docs/auth/security.md @@ -5,6 +5,12 @@ title: Security Architecture # Security Architecture +:::note Security notice: PHP RCE vulnerabilities (October 2026) +epilot is **not affected** by the "php2shell" PHP remote code execution vulnerabilities disclosed on October 21, 2026 ([CVE-2026-109618](https://www.cve.org/CVERecord?id=CVE-2026-109618), [CVE-2026-109619](https://www.cve.org/CVERecord?id=CVE-2026-109619)). epilot does not use PHP anywhere in its platform. + +epilot runs on a [serverless Node.js stack](/docs/architecture/overview#tech-stack) on AWS Lambda, where AWS automatically applies security updates to the managed runtimes. +::: + epilot runs on AWS with security enforced at every layer: multi-tenant isolation, authentication, authorization, encryption, and API protection. :::info