When a widely reported vulnerability or security incident affects common software, our Security team assesses PandaDoc’s product, cloud infrastructure, and underlying services. This page shares the results and is updated as remediation progresses. The most recent bulletins appear first.
eMudhra Intermediate Certificate Authority incident (CVE-2026-111943)
Status: Remediation in progress
Customer action required: None
Last updated: October 23, 2026
This is an update regarding the recent eMudhra Intermediate Certificate Authority incident, tracked under CVE-2026-111943 and related ecosystem updates. Our Security and Infrastructure teams have completed an environment assessment. Here is the status across our technology stack:
Component | Status | Details |
Go components | Not affected | We do not run the affected Go runtime versions or libraries referenced in upstream advisories under CVE-2026-111943 in our production infrastructure. |
Node.js services | Remediation in progress | Some Node.js dependencies rely on trust-store bundles that contain the affected intermediate certificates. We validated updated runtime packages with current CA trust stores and are deploying them across our production clusters. |
Python services and tooling | Remediation in progress | We are updating runtime trust bundles, packaging, and build toolchains so that all embedded certificate stores reject the compromised intermediate certificates. |
Java services | Remediation in progress | We are deploying updated OpenJDK runtime distributions and refreshed certificate stores across Java workloads so they distrust the revoked certificates. |
Security impact
Continuous network monitoring, TLS inspection, and runtime threat detection show no evidence of unauthorized traffic interception, man-in-the-middle (MITM) attempts, or data compromise.
What you need to do
Nothing. All certificate revocations and toolchain updates are managed on our cloud infrastructure. We will update this bulletin when all production rollouts are complete.
PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
Status: Not affected
Customer action required: None
Last updated: October 23, 2026
This is an update regarding the recent PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Our Security team has completed an assessment of our product, cloud infrastructure, and underlying services.
The PandaDoc application is not vulnerable to or affected by these issues. Our production environments do not use vulnerable PHP runtime components, and comprehensive infrastructure vulnerability scans show zero exposure across our systems.
What you need to do
Nothing. We continue to monitor our environments and upstream dependencies as part of our continuous security monitoring program.
Need more details?
If your security team needs more information for a vendor assessment, contact our Support team, and we’ll route your request to our Security team. You can read about PandaDoc’s certifications and security practices on our security page.