Security Bulletin

Last Updated: October 23, 2026

Vasion maintains a robust security program as an ISO 27001:2013 and SOC2 Type 2 certified solution to promptly address any and all security vulnerabilities when discovered. Meeting the ISO standard involves an extensive process of becoming ISO-compliant to better meet our customers' business, legal, and regulatory requirements. As a globally-recognized security program, maintaining an ISO certification shows a commitment to executing high-quality security practices and improving our security posture through defined processes and documentation.

Our security policies, articulated here, detail these certifications as well as the approach to:

  • Physical Security.
  • Network Security.
  • Application Security.
  • Training.
  • Data Protection.

Our Vasion Trust Center describes in detail the security tests that we have run, the polices that we apply and adhere to, as well as a number of monitoring tests we regularly run.

Bulletins

Current Year

October 22, 2026

Vasion remediated a third-party, industry-wide security issue described in our October 21 notice for the PHP remote code execution vulnerabilities (fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35).

Background:

On October 21, the PHP Foundation released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to address the two critical vulnerabilities that could allow unauthenticated remote code execution, CVE-2026-109618 and CVE-2026-109619.

Resolution:

Our engineering team immediately began working on updates to address the third-party, industry-wide security issues.

Below are any additional next steps based on your specific environment:

  • Vasion-hosted services: We generated an emergency patch on Oct. 23, 2026 to deploy the fix to all customers. Review the patch release notes in the Vasion Automate Fed Release Notes topic.
  • Vasion Virtual Appliance (VA): We released an updated Vasion Virtual Appliance (VA) on Oct. 22, 2026 that includes these fixes (Host v26.2.352 / Application v26.2.1965. It is a critical security update, and customers should upgrade to the updated VA release as soon as it is available. Review the patch release notes and download the new versions on our Release Notes topic.