Trust Center

Summary
The OutSystems Security Team has completed its investigation of the PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both are Remote Code Execution (RCE) flaws in PHP, each rated CVSS v4.0 9.2 (critical). PHP published fixes on October 21, 2026.

Scope of Validation
Product security scans resulted in no findings within the OutSystems Platform and Products for either CVE.

Current Status

• No observed impact on the OutSystems platform or customer environments
• No vulnerable PHP components identified within the product and platform scope
• Continuous monitoring remains in effect as detection logic and threat intelligence evolve

Ongoing Monitoring
OutSystems Security continues to monitor our environment to ensure that vulnerable code is not introduced and deployed. We will update this post if our assessment changes.

Customer Action Required
No customer action is required at this time.

Additional Information
This advisory applies to the OutSystems Platform, including O11 and ODC. It does not extend to customer-managed extensions, third-party integrations, or customer-controlled infrastructure that runs PHP. Customers running PHP in their own infrastructure should follow the PHP project's security release guidance, which is to update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
For additional questions, customers may contact OutSystems Support through standard channels.

Product Dropdown Selection

To navigate this Trust Center, please select the product you're evaluating on the dropdown on the top right. On each product page, you will see all the certifications and attestations that are applicable to that product.

Please note that some certifications and attestations (such as SOC 1, SOC 2, HIPAA, PCI, ACN, or ENS,) are only applicable to Sentry entitled customers. If you're not currently a Sentry customer, but would like to upgrade to Sentry, please reach out to your Account Manager or Customer Success Manager

Status: No Impact Identified
OutSystems conducted a comprehensive assessment of the recently disclosed axios supply chain vulnerability. No impact to our platform or customer environments was identified.

Key Findings:

• No affected packages in production environments
• No vulnerable versions identified in source code or recent development activity
• No indicators of compromise on developer endpoints
• No malicious network activity observed

Ongoing Monitoring:
We have implemented targeted detection measures and will continue monitoring for any emerging indicators related to this vulnerability.

Conclusion:
No remediation actions are required at this time. There is no evidence of impact to customer data or services.

Summary
OutSystems Security Team has completed the investigation of the Critical RCE Vulnerability in React and Next.js threat, CVE-2025-55182 and CVE-2025-66478. This vulnerability is related to Remote Code Execution (RCE) in React Server Components. OutSystems' Teams have validated their React code and assured that no react-server-xxx are used. The continuous monitoring of the OutSystems environment also confirmed that there is no vulnerability for the CVE-2025-55182.
At time of writing, CVE-2025-66478 (https://nvd.nist.gov/vuln/detail/CVE-2025-66478) is now marked as duplicate of CVE-55182.

Scope of Validation
Our assessment involved all react components used in both O11 and ODC platforms.

Current Status
No evidence of active exploitation detected
No confirmed vulnerable components identified within monitored scope
Continuous monitoring remains in effect as detection logic and intelligence evolve

Ongoing Monitoring
OutSystems Security continues and actively monitors our environment to make sure possible vulnerable code is not introduced and deployed to OutSystems environment.

Customer Action Required
No customer action is required at this time.

Additional Information
This advisory applies to both O11 and ODC within the OutSystems Platform. It does not extend to customer-managed extensions, third-party integrations, or customer-controlled infrastructure. If additional information is customers may contact OutSystems Support through standard channels.
For additional questions, customers may contact OutSystems Support through standard channels.

Summary
OutSystems Security has completed validation activities related to the publicly reported “Shai-Hulud 2.0” vulnerability campaign. Based on continuous monitoring and analysis across our monitored environments, OutSystems has not observed any indicators of compromise or known vulnerable components associated with this campaign as of 2025-12-02 15:44 UTC.

Scope of Validation
Our assessment and monitoring include the following security control surfaces:

• Source code repositories
• Container images and registries
• Deployed cloud workloads and exposed attack paths within our managed cloud environments

Current Status

• No evidence of active exploitation detected
• No confirmed vulnerable components identified within monitored scope
• Continuous monitoring remains in effect as detection logic and intelligence evolve

Ongoing Monitoring
OutSystems Security continues to actively monitor for updated indicators of compromise, exploit techniques, and upstream threat intelligence related to this campaign using both internal detection capabilities and third-party intelligence sources. If our risk posture changes, customers will be notified promptly through this portal.

Customer Action Required
No customer action is required at this time.

Additional Information
This advisory applies to all components within the OutSystems Platform. It does not extend to customer-managed extensions, third-party integrations, or customer-controlled infrastructure.

For additional questions, customers may contact OutSystems Support through standard channels.