Is Vasion Down?

FedRAMP and Virtual Appliance Update, October 30, 2026: Vasion has released fixes for both of the two third-party, industry-wide security issues described in our October 21 notice. We have updated Vasion-hosted FedRAMP services and released an updated Virtual Appliance for the compromise of multiple eMudhra intermediate certificate authorities. Resolution: Vasion immediately began working on fixes to address both third-party, industry-wide security issues. As of October 30, Vasion has addressed the compromise of multiple eMudhra intermediate certificate authorities in the Vasion-hosted FedRAMP services and the Virtual Appliance. Below are any additional next steps based on your specific environment: Vasion-hosted FedRAMP services: Our Fall release included a fix for the compromise of multiple eMudhra intermediate certificate authorities. Please review the release notes in our documentation here: https://docs.vasion.com/fed/Release_Notes/Automate-Fed.htm. While your Vasion software was updated automatically, there are some steps that you may need to take manually, depending on your settings. It is recommended that all customers update the Agent and Service Agent binaries to protect against man-in-the-middle attacks. You should manually update everything that you don't already have set to automatically update, and ensure all of your Agents and Service Agents are running the latest versions. Please visit the release notes at this link: https://docs.vasion.com/fed/Release_Notes/Automate-Fed.htm for instructions on how to update your Agent and Service Agent binaries. Vasion Virtual Appliance (VA): Customers on the Virtual Appliance should complete two steps: Step 1: Upgrade the Virtual Appliance. We have released an updated version that includes these fixes and it is recommended to upgrade to the updated VA release (Host: 26.2.362) now. Please visit this link: https://docs.vasion.com/v/Release_Notes/VirtualAppliance.htm for access to the download. Step 2: Update the Agent and Service Agent binaries. To protect against man-in-the-middle attacks, we recommend that all customers make sure their Agents and Service Agents are running the latest versions. Customers who don’t have automatic updates enabled will need to update these binaries manually. Please visit the release notes at this link: https://docs.vasion.com/v/Release_Notes/VirtualAppliance.htm for instructions on how to update the Agent and Service Agent binaries. Conclusion: This completes Vasion’s server-side updates for the two third-party, industry-wide security issues described in our October 21 notice. Customers who do not have automatic updates enabled should update their Agent and Service Agent binaries to complete the process. We will continue to monitor and follow any further updates or changes that arise. Details on Vasion’s security and privacy practices are available in our Trust Center at https://trust.vasion.com/. If you have questions, contact Vasion Support at support@vasionfed.com (for FedRAMP customers) or printsupport@vasion.com (for Virtual Appliance customers) or reach out to your account manager. Thank you for your partnership. --- [2026-10-28T13:36:54.538Z] (monitoring) Update, October 28, 2026: Vasion has now released fixes for both issues for Vasion-hosted services, except FedRAMP and the Virtual Appliance, where eMudhra updates are in progress. Background: On October 21, the PHP Foundation released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to address the two critical vulnerabilities that could allow unauthenticated remote code execution. Separately, the private keys of multiple eMudhra intermediate certificate authorities (together with their cross-signed variants) were reported compromised, which could allow an attacker to impersonate websites and services for clients that still trust them. Resolution: Vasion immediately began working on fixes to address both third-party, industry-wide security issues. As of October 28, Vasion has addressed the compromise of multiple eMudhra intermediate certificate authorities in the Vasion-hosted services (except FedRAMP and the Vasion Virtual Appliance, which are in process). Below are any additional next steps based on your specific environment: Vasion-hosted services (except FedRAMP): Our Fall release included a fix for the compromise of multiple eMudhra intermediate certificate authorities. Please review the release notes in our documentation here: https://docs.vasion.com/a/Release_Notes/Automate.htm. While your Vasion software was updated automatically, there are some steps that you may need to take manually, depending on your settings. It is recommended that all customers update the Agent and Service Agent binaries to protect against man-in-the-middle attacks. You should manually update everything that you don't already have set to automatically update, and ensure all of your Agents and Service Agents are running the latest versions. Please visit the release notes at this link: https://docs.vasion.com/a/Release_Notes/Automate.htm#:~:text=Certificate%20Authority%20Distrust%20(eMudhra) for instructions on how to update your Agent and Service Agent binaries. Vasion Virtual Appliance (VA): Updates are underway and being validated. If you have not yet installed VA host 26.2.352 for the PHP fix, please do so now. Please continue to monitor this page for updates. Vasion-hosted FedRAMP services: Updates are underway and being validated. No customer action is required at this time. Please continue to monitor this page for updates. Conclusion: This completes Vasion’s server-side updates (except FedRAMP and the Virtual Appliance, which are in progress) for the two third-party, industry-wide security issues described in our October 21 notice. Customers who do not have automatic updates enabled should update their Agent and Service Agent binaries to complete the process. We will continue to monitor and follow any further updates or changes that arise. Details on Vasion’s security and privacy practices are available in our Trust Center at https://trust.vasion.com/. If you have questions, contact Vasion Support at printsupport@vasion.com or reach out to your account manager. Thank you for your partnership. --- [2026-10-25T17:48:04.467Z] (monitoring) FedRAMP Update, October 25, 2026: Vasion has released fixes for one of the two third-party, industry-wide security issues described in our October 21 notice. We have updated Vasion-hosted FedRAMP services to patched versions of PHP to address the remote code execution vulnerabilities (CVE-2026-109618, CVE-2026-109619). We continue to work on the second issue, the compromise of multiple eMudhra intermediate certificate authorities, and are updating certificates and affected components. We will update this notice as we have more information. Resolution: Vasion immediately began working on fixes to address these two third-party, industry-wide security issues. As of October 23, Vasion has patched the PHP vulnerabilities in the Vasion-hosted FedRAMP services. Below are any additional next steps based on your specific environment: Vasion-hosted FedRAMP services: We generated an emergency patch to deploy the PHP fix to FedRAMP customers. Please review the patch release notes in our documentation here: https://docs.vasion.com/fed/Release_Notes/Automate-Fed.htm. Your Vasion environment has been updated and no customer action is required at this time. Vasion will continue to actively update certificates and address technology impacted by the eMudhra compromise. Updates are underway and being validated. No action is required at this time for the eMudhra compromise but an additional update is expected. We will continue to update this bulletin as remediation and validation progress. If you have questions, contact Vasion Support at support@vasionfed.com or reach out to your account manager. Thank you for your partnership. --- [2026-10-23T21:04:41.855Z] (monitoring) Update, October 23, 2026: Vasion has released fixes for one of the two third-party, industry-wide security issues described in our October 21 notice. We have updated Vasion-hosted services (except FedRAMP, which is in progress) to patched versions of PHP to address the remote code execution vulnerabilities (CVE-2026-109618, CVE-2026-109619). We continue to work on the second issue, the compromise of multiple eMudhra intermediate certificate authorities, and are updating certificates and affected components. We will update this notice as we have more information. Background: On October 21, the PHP Foundation released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to address the two critical vulnerabilities that could allow unauthenticated remote code execution. Separately, the private keys of multiple eMudhra intermediate certificate authorities (together with their cross-signed variants) were reported compromised, which could allow an attacker to impersonate websites and services for clients that still trust them. Resolution: Vasion immediately began working on fixes to address these two third-party, industry-wide security issues. As of October 23, Vasion has patched the PHP vulnerabilities in the Vasion-hosted services (except FedRAMP, which is in process) and released an updated VA version for customers to install. Below are any additional next steps based on your specific environment: Vasion-hosted services (except FedRAMP): We generated an emergency patch overnight to deploy the PHP fix to all customers. Please review the patch release notes in our documentation here: https://docs.vasion.com/a/Release_Notes/Automate.htm. Your Vasion environment has been updated and no customer action is required at this time. Vasion Virtual Appliance (VA): For customers running the Vasion Virtual Appliance (VA), we have released an updated VA version that includes the PHP fix. It is an emergency security update, and Customers should upgrade to the updated VA release (host 26.2.352) as soon as possible. Please visit this link https://docs.vasion.com/v/Release_Notes/VirtualAppliance.htm for access to the download. Vasion-hosted FedRAMP services: Updates are underway and being validated. No customer action is required at this time. Please continue to monitor this page for updates. Vasion will continue to actively update certificates and address technology impacted by the eMudhra compromise. Updates are underway and being validated. No action is required at this time for the eMudhra compromise but an additional update is expected. We will continue to update this bulletin as remediation and validation progress. Conclusion: We are actively monitoring these issues and will update this notice as we have more information. Details on Vasion’s security and privacy practices are available in our Trust Center at https://trust.vasion.com/. If you have questions, contact Vasion Support at printsupport@vasion.com or reach out to your account manager. Thank you for your partnership. --- [2026-10-22T19:00:23.944Z] (identified) October 22, 2026: External Security Advisory Affecting Vasion Products (PHP Remote Code Execution Vulnerabilities and eMudhra Intermediate CA Compromise) Vasion continues to remediate the two third-party, industry-wide security issues described in our October 21 notice: the PHP remote code execution vulnerabilities (fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35) and the compromise of multiple eMudhra intermediate certificate authorities. Vasion-hosted services: Updates are underway and being validated. No customer action is required at this time. Vasion Virtual Appliance (VA): For customers running the Vasion Virtual Appliance (VA), we will be releasing an updated VA version that includes these fixes. It is an emergency security update, and Customers should upgrade to the updated VA release as soon as it is available. We will continue to update this bulletin as remediation and validation progress. For more information, see the PHP announcement (https://www.php.net/archive/2026.php#2026-10-21-5) and the eMudhra security incident notice (https://emudhra.com/en/post/certificate-security-incident). Customers with questions can contact Vasion Support at printsupport@vasion.com or reach out to their account manager. --- [2026-10-21T20:08:59.555Z] (identified) October 21, 2026: External Security Advisory Affecting Vasion Products (PHP Remote Code Execution Vulnerabilities and eMudhra Intermediate CA Compromise) Vasion is remediating two third-party and industry-wide security issues. Vasion is aware of two issues affecting the third-party PHP language runtime and eMudhra certificates used in software around the world. Vasion has been actively investigating and remediating both issues since becoming aware of them. On October 21, the PHP Foundation released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to address the two critical vulnerabilities that could allow unauthenticated remote code execution [see https://www.php.net/index.php#2026-10-21-5 for more details]. Separately, the private keys of multiple eMudhra intermediate certificate authorities (together with their cross-signed variants) were reported compromised, which could allow an attacker to impersonate websites and services for clients that still trust them [see https://emudhra.com/en/post/certificate-security-incident for more details]. Vasion-hosted services are being updated by Vasion and will require no customer action. For customers running the Vasion Virtual Appliance (VA), we will be releasing an updated VA version that includes these fixes. It is an emergency security update, and Customers should upgrade to the updated VA release as soon as it is available. We will update this bulletin as remediation and validation progress. Customers with questions can contact Vasion Support at printsupport@vasion.com or get in touch with your account manager.

To ensure continued reliability and performance, Vasion conducts regular maintenance during periods of low customer usage to minimize disruption. Vasion is announcing a Scheduled Maintenance Window for the APAC region. The Scheduled Maintenance Window will take place from Monday November 16, at 16:00 UTC to Monday November 16, 20:00 UTC. During this time, updates will be applied to the SRS environment. Official Release Notes will be available the week of November 16 in our online Admin Guide: https://docs.vasion.com/a/Release_Notes/Automate.htm Vasion continues to monitor recently disclosed security vulnerabilities that have been patched and will remain responsive to any related issues that arise. Depending on how these vulnerabilities (CVEs) develop, additional off-cycle maintenance may be needed, and scheduled dates may be adjusted. Any changes will be communicated on this page. While downtime is not expected, brief service interruptions may occur. If you need assistance during or after the maintenance window, please contact us at printsupport@vasion.com or call Technical Support: North America: +1 (435) 652-1288, ext. 1 Toll-Free: +1 (888) 634-3020 Germany: +49 (6122) 7783900 United Kingdom: +44 (20) 39003233 France: +33 (1) 85640227 Netherlands: +31 (10) 7986140 Australia: +61 2 9161 2828 International: +1 435.652.1288, ext. 1

To ensure continued reliability and performance, Vasion conducts regular maintenance during periods of low customer usage to minimize disruption. Vasion is announcing a Scheduled Maintenance Window for the EMEA region. The Scheduled Maintenance Window will take place from Monday 16 November, at 21:00 UTC to Tuesday 17 November, at 01:00 UTC. During this time, updates will be applied to the SRS environment. Official Release Notes will be available the week of 16 November in our online Admin Guide: https://docs.vasion.com/a/Release_Notes/Automate.htm Vasion continues to monitor recently disclosed security vulnerabilities that have been patched and will remain responsive to any related issues that arise. Depending on how these vulnerabilities (CVEs) develop, additional off-cycle maintenance may be needed, and scheduled dates may be adjusted. Any changes will be communicated on this page. While downtime is not expected, brief service interruptions may occur. If you need assistance during or after the maintenance window, please contact us at printsupport@vasion.com or call Technical Support: North America: +1 (435) 652-1288, ext. 1 Toll-Free: +1 (888) 634-3020 Germany: +49 (6122) 7783900 United Kingdom: +44 (20) 39003233 France: +33 (1) 85640227 Netherlands: +31 (10) 7986140 Australia: +61 2 9161 2828 International: +1 435.652.1288, ext. 1