ClearPoint posts security notices on this page. Each notice explains what happened, whether ClearPoint customer data was affected, what we did, and whether you need to take any action. The newest notice is at the top. If you have questions about a notice, please contact us at [email protected].
October 21, 2026: PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell")
Status: Resolved
ClearPoint platform affected: No
Customer action required: None
What happened
On October 21, 2026, two critical vulnerabilities in the PHP runtime (CVE-2026-109618 and CVE-2026-109619) were disclosed. They allow unauthenticated remote code execution on servers that run an unpatched version of PHP.
Impact on ClearPoint customers
The ClearPoint platform is not affected. PHP is not part of the ClearPoint application stack, and no PHP runs anywhere in the platform's production environment. The backend API runs on Lucee and Node.js, the frontend is built in JavaScript and React, and Nginx is the web server. All of it is hosted on AWS.
ClearPoint also hosts public Community Dashboard sites for some customers. These sites run on WordPress, which uses PHP, and are separate from the ClearPoint platform. We updated PHP to a patched version on every Community Dashboard host on October 22, 2026.
What ClearPoint did
We confirmed that the ClearPoint platform does not use PHP.
On October 22, 2026, we updated PHP to a patched version on all Community Dashboard hosts.
Our standard vulnerability management controls continue to apply. These include monthly vulnerability scanning of production systems, a patch management process for operating-system-level vulnerabilities, and an annual third-party penetration test. All of these are covered by our SOC 2 Type II report.
What you need to do
You do not need to take any action.
May 23, 2026: Composio API key incident
Status: Resolved
Customer data affected: No
Customer action required: None
What happened
On May 23, 2026, Composio notified its customers of a security incident. Composio is a third-party service that ClearPoint uses for AI app connections (see ClearPoint Sub-Processors). Composio's investigation found that some Composio API keys may have been exposed. Composio asked all of its customers to rotate their API keys.
Impact on ClearPoint customers
No ClearPoint customer data was affected. At the time of the incident, no ClearPoint customers were using Composio in production.
What ClearPoint did
We reviewed our use of Composio and confirmed that no customer data was affected.
We rotated all of our Composio API keys and all other keys that could have been affected.
What you need to do
You do not need to take any action.