Alert: PHP2Shell Vulnerability

[UPDATED: October 22, 2026] On October 21st, 2026, Docusign became aware of a critical vulnerability affecting PHP, known as PHP2Shell. Details regarding this vulnerability and PHP’s recommended mitigation measures are available in the PHP project’s security advisory: https://www.php.net/archive/2026.php#2026-10-21-5.

We can confirm that Docusign-operated services and products utilized by our customers do not use PHP and are not affected by this vulnerability. The Docusign security and engineering teams have completed a comprehensive investigation into PHP2Shell and found no indicators of compromise in our environment. 

We have identified a limited number of internal Docusign systems that utilize PHP and we are actively remediating them. For developers, we are also updating our external integration documentation with an instruction to use a patched PHP version. We are continuing to monitor for any further changes or updates.

The security of our products is a top priority. Docusign will continue to monitor the situation as it evolves. Please visit https://docusign.com/trust/alerts for the latest updates regarding this alert.