Trust Center
Kapiche has implemented best-in-class security practices to keep customer data safe.. At Kapiche, we protect your data like it's our own
Colorado Technical University
AGL Australia
ANZ
Woodside Homes
RAC WA
Trust Center Updates
Kapiche not affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
Kapiche is not affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619).
PHP2Shell refers to two critical remote code execution vulnerabilities in PHP core, patched by the PHP project on 21 October 2026.
How we confirmed this
- Full estate scan: Our security team used Wiz, which continuously scans our entire cloud environment, including hosts, containers and images, to confirm that no affected PHP components are present anywhere in the Kapiche platform.
- Independent external validation: We double checked our internet facing services with Intruder, our external vulnerability scanning service, which found no exposure to these vulnerabilities.
What this means for you
No action is required by Kapiche customers. There is no impact to the Kapiche platform, customer data or service availability.
We continue to monitor this issue and will post an update here if anything changes. If you have questions, please contact your Kapiche account team.
For more details on these vulnerabilities, see Akamai's analysis: https://www.akamai.com/blog/security-research/understanding-php2shell-everything-you-need-to-know
Kapiche not affected by the XZ Utils backdoor vulnerability
Kapiche is not affected by the XZ Utils backdoor vulnerability.
Our security team has reviewed all OS versions deployed in our environment and confirmed that none of the impacted operating systems or versions are utilized.
For more details on this vulnerability, please visit https://nvd.nist.gov/vuln/detail/CVE-2024-3094 and https://www.darkreading.com/vulnerabilities-threats/are-you-affected-by-the-backdoor-in-xz-utils.
Kapiche's Response to HTTP/2 Rapid Reset Attack and Curl Vulnerabilities
Kapiche is aware of CVE-2023-44487, also known as "HTTP/2 Rapid Reset Attack," related to HTTP/2 capable web servers where rapid stream generation and cancellation can result in additional load which could lead to a Denial of Service. Kapiche's infrastructure is designed with various protections to address Layer 7 request floods, however, we have implemented additional mitigations and patches address this issue.
Kapiche's Response to the 2022 OpenSSL 3 Vulnerabilities
After careful review of our infrastructure and SBOM, the Kapiche team has determined that we are not currently vulnerable to the OpenSSL 3 vulnerabilities CVE-2022-3602 and CVE-2022-3786 that were disclosed on November 1, 2022.
As a helpful resource, you can use this page to determine if certain widely used software in your environment is affected or unaffected: https://github.com/NCSC-NL/OpenSSL-2022/blob/main/software/README.md