Welcome to Support Fusion's Trust Center.
Information security and data privacy have been built into how we operate since day one. Use this page to understand our security posture and request access to our documentation.
Logicalis
Charles Square
Ericom
Attentus Technologies
Defenovate
Cambridge Associates
Subprocessors
- How do you secure my platform API credentials?
- How much of my data does Support Fusion store?
Trust Center Updates
Security advisory: PHP2Shell (CVE-2026-109618 and CVE-2026-109619)
Status: Not affected. No customer action required.
Summary
On 21 October 2026 the PHP project disclosed two critical vulnerabilities in the PHP programming language, tracked as CVE-2026-109618 and CVE-2026-109619 and known together as PHP2Shell. Both allow an unauthenticated attacker to run code on a web server that uses an affected version of PHP. They carry a severity rating of 9.2 out of 10, and active exploitation has been reported since disclosure. Many websites and web applications worldwide are affected, and we understand why customers are checking with every supplier.
Our position
Support Fusion is not affected. The Support Fusion platform does not use the PHP programming language in any component that we develop or operate. There is no vulnerable software for us to patch and no exposure to these vulnerabilities. This has been confirmed by our Chief Technology Officer following a review of our platform and supporting systems.
We have also reviewed the published advisories from our cloud and perimeter service providers. No action was required on our part.
What customers need to do
Nothing in relation to the Support Fusion platform. Your data and your integrations are not exposed through our service.
If your organisation runs PHP in its own environment, we recommend following the PHP project’s guidance and updating to a fixed release (8.5.12, 8.4.27, 8.3.36 or 8.2.35) as a priority. Versions before 8.2 do not have a full vendor release and should be treated as urgent.
How we handle advisories
Support Fusion monitors public vulnerability disclosures and vendor security bulletins as part of our ISO/IEC 27001 certified information security management system. When a widely reported vulnerability appears, we assess whether any affected software is present in our platform or supporting systems, confirm the outcome with our technical leadership, and publish our position here. If our position on this advisory changes, this page will be updated.
Contact
Security questions can be sent to security@suppfusion.com.