Trust

PHP security vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
Status: In progress. Last updated October 21, 2026 2:45pm EDT

Background
On October 21, 2026, the PHP project disclosed two critical vulnerabilities in PHP, one of the technologies FormAssembly is built on. You trust us with your data, and we want to be open with you about what this means and what we're doing.

• CVE-2026-109618: PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
  See also https://www.cve.org/CVERecord?id=CVE-2026-109618
• CVE-2026-109619:PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
  See also https://www.cve.org/CVERecord?id=CVE-2026-109619

What we're doing
Our engineering and infrastructure teams have assessed the exposure and have begun work to address these vulnerabilities across all of FormAssembly's environments. We will add updates here as each step is completed.

What you need to do
Nothing. FormAssembly is fully available, and no action is needed on your part. FormAssembly will continue to remediation efforts.

We will update this page as work progresses and when remediation is complete. If you have questions, our team is glad to help

FormAssembly Not Affected by Compromised Axios Package
We are aware of a recently disclosed supply chain incident affecting specific versions of the widely used npm package axios.

What happened?
Certain versions of axios were found to include malicious code introduced through a compromised maintainer account.

Affected versions:

• axios@1.14.1
• axios@0.30.4

Our status
We have conducted an internal review and can confirm that FormAssembly systems and services are not affected by these compromised versions.

We continue to monitor this situation closely and will provide updates if necessary.

For more details, you may refer to:
https://semgrep.dev/blog/2026/axios-supply-chain-incident-indicators-of-compromise-and-how-to-contain-the-threat/

We are aware of the recently disclosed vulnerabilities affecting Microsoft SharePoint (CVE-2025-53770 and CVE-2025-53771). We want to assure our customers and partners that FormAssembly is not affected by these issues.

These vulnerabilities apply only to on-premises versions of Microsoft SharePoint. At FormAssembly, we exclusively use Microsoft 365 SharePoint Online for our Connectors, which is not impacted by these CVEs.

We remain committed to closely monitoring all security advisories and ensuring our platform and connectors continue to meet industry best practices.

If you have further questions or concerns, please don't hesitate to reach out to our security team via security@formassembly.com.

FormAssembly's controls are assessed by A-LIGN, who specialize in compliance across multiple industries, on an annual basis.

FormAssembly annually performs a SOC-2 Type-2 assessment. Our most recently available report covers from December 1, 2023 - May 31, 2024. An updated review period is scheduled with our auditors, and we expect an updated report to be available in mid-2023.

The SOC 2 report includes management’s description of FormAssembly’s trust services and controls as well as A-LIGN’s opinion of FormAssembly’s system design. You can find it under the Reports section of this Security Portal.

We maintain a SOC 2 Type 2 certification as a result of this regular audit activity and can share the most recent SOC 2 report with our customers upon request and under a non-disclosure agreement. The SOC 2 is a report based on the Auditing Standards Board of the American Institute of Certified Public Accountants' (AICPA) existing Trust Services Criteria (TSC). The purpose of this report is to evaluate an organization’s information systems relevant to security.

The scope of this report covers controls supporting the FormAssembly App and Enterprise/Compliance plans.

We are aware of the recently reported vulnerabilities in React and Next.js (CVE-2025-55182), also known as React2Shell.

After reviewing our production environments and dependency inventory, we can confirm that none of our applications or infrastructure use the affected versions of React, Next.js, or related packages. We have not found any signs of vulnerability, exploitation, or exposure tied to this issue.

We will continue to monitor security advisories and follow current best practices to keep our systems safe.

If you have any questions or concerns, feel free to contact our security team at security@formassembly.com.