Trust Portal
Trust Portal Updates
PHP Engine Vulnerabilities (October 2026)
On 21 October 2026, the PHP project disclosed two critical vulnerabilities in the PHP engine and released fixes the same day. The flaws allow an unauthenticated attacker to execute code or read process memory on a web server running an affected version of PHP.
Trustpilot’s platform, APIs and Business Portal are not affected and remain fully operational. Trustpilot does not run PHP in its platform.
This advisory is for customers who use our e-commerce integrations. Those are plugins installed on your own store — WooCommerce, Magento, PrestaShop, OpenCart and others — so the affected software is the PHP running on your server, not code supplied by Trustpilot.
Recommended action: update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, matching your branch. PHP 8.1 and earlier are end-of-life and will not receive an official branch fix; we’d encourage planning an upgrade. Check with your host or hosting platform first, as many have already applied the update. Public exploitation is expected to escalate quickly, so we’d treat this as urgent.
Your Trustpilot integration will continue to work normally once PHP is updated. No change is needed in your Trustpilot account.
Node.js and certificate authority disclosures (October 2026)
Two unrelated issues were disclosed to the public in October 2026 that affect software used widely across the technology industry:
- On 20 October, compromised signing keys belonging to the eMudhra certificate authority were disclosed (CVE-2026-111943, CVE-2026-113470).
- On 21 October, the Node.js project disclosed a High severity flaw in its bundled Brotli decompression library (CVE-2026-111497) and published fixed releases.
Neither issue originates in Trustpilot software, and neither has caused any interruption to the services our consumers and business customers use.
Trustpilot does not use eMudhra certificates for trustpilot.com, our business platform or our public APIs, so no certificate reissue is required.
Our security team began assessing both disclosures within a day of publication and is applying the vendor-published fixes across our software and infrastructure, prioritised by exposure. We have seen no evidence of either issue being used against Trustpilot systems or data.
We will provide a further update if the position changes.