Security Portal

Status: Monitoring

Summary

On October 19, 2026, Cloudflare reported that the private keys for eight eMudhra intermediate certificate authority (CA) certificates were compromised because the keys were generated with insufficient strength. These certificates were trusted by major browsers and operating systems. An attacker could use them to create forged certificates for any website and impersonate servers to intercept or modify traffic. Major browser and operating system vendors have since moved to block the affected intermediates.

Impact to Addigy

Addigy has reviewed this issue and taken steps to protect our environment. To date, we have not identified any impact to Addigy services or customer data. Our review is ongoing, and we will update this advisory if that changes.

Actions Taken

• Updated the Cloudflare client on all active Addigy-managed devices to a version that blocks the affected certificates.
• Continuing to review our infrastructure, certificate trust stores and third-party providers for any remaining exposure.

Recommended Actions for Customers

• Update software that relies on its own certificate trust store, including browsers, VPN and security clients, and developer tools, to the latest versions.
• If you use Cloudflare products, follow Cloudflare's guidance, including updating the Cloudflare One (WARP) client and Cloudflare Tunnel (cloudflared).
• Do not disable certificate verification to clear certificate errors that appear after patching. Doing so removes the protection these updates restore.

References

• Cloudflare: https://blog.cloudflare.com/emudhra-certificate-compromise/
• Test site and patched package list: https://emudhra.we-have-a-problem.com/

Status: Monitoring

Summary

On October 20, 2026, details of two critical flaws in PHP were made public. Together they are known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). The flaws can let an attacker run code on servers running unpatched PHP. PHP released fixes on October 21, 2026 in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

Impact and Investigation

Core Services Unaffected: The Addigy platform, including the Addigy console, APIs and device agent, does not use PHP. We have found no impact on Addigy services.

Data Exposure Status: No customer data has been affected.

Additional Protection: Addigy services sit behind Cloudflare, which deployed web application firewall (WAF) protections against PHP2Shell before the flaws were publicly disclosed. These protections were active from 03:02 UTC on October 21, 2026.

Marketing Website: Our public marketing website, www.addigy.com, runs on a separate system that holds no customer data. Its hosting provider applied the PHP security update on October 21, 2026.

Sub-processors

We are checking the status of every Addigy sub-processor. We will update this advisory as we confirm each vendor's status.

Customer Action

Addigy customers don't need to do anything. If you run PHP in your own environment, we recommend updating to a fixed version as soon as possible.

If you have additional questions or need additional information, please contact security@addigy.com.

Status: No impact to Addigy

Summary

Addigy is aware of the recently disclosed security incident involving Klue, in which attackers compromised the Klue integration and stole OAuth tokens used to connect to customers' Salesforce environments. Several organizations have confirmed unauthorized access to their Salesforce data as a result.

Addigy does not use Klue. No Addigy systems, customer data, or Salesforce data were affected.

Addigy's position

Because Addigy does not use Klue, there is no direct exposure to this incident. We have reviewed our environment and confirmed:

• Addigy does not have, and has never had, the Klue integration connected to any Addigy system.
• No Addigy customer data was involved in this incident.
• Addigy's products and services were not affected and required no customer action related to this event.

Our ongoing commitment

While this specific incident does not affect us, we treat third-party integration security as an ongoing priority. We are evaluating all Addigy third-party providers to verify if they were impacted by this incident. We maintain controls and monitoring around the third-party applications connected to our systems, and we continue to review and strengthen our defenses against this class of supply-chain attack.

Questions

If you have questions about this notice or Addigy's security practices, please contact our security team at security@addigy.com.

We have recently completed our audit and received the finalized SOC 2 Type II and SOC 3 reports for 2025.

They are now currently available on our Security Portal for your review.

Please reach out to us if there are any questions at security@addigy.com or compliance@addigy.com.

Following the disclosure of React2Shell (CVE-2025-55182), Addigy immediately conducted a review of all of its libraries, third-party packages, and systems.

After the review, we have determined that none are vulnerable to React2Shell. We do not use the React framework, its server components, nor Next.js in any of our systems.

The necessary components for the React2Shell vulnerability are not present in Addigy systems.

If you have any questions or need additional information, please contact our security team directly at security@addigy.com.