Passbolt
- Aliases / services
- パスボルト / Passbolt Cloud / Passbolt
- Official website
- https://www.passbolt.com/
Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.
Response status by service
Passbolt Cloud
- Response status
- Patched and restored
- Response information checked
- 2026-10-27
Current re-audit: Official response verified · Research date: 2026-10-27
Team password management provider.
PHP patched at 17:25 CEST on October 21 after precautionary downtime.
Scope: Cloud only; self-hosted deployments are listed separately.
What users should do
No customer action required.
Official service URL
Source URLs
- https://www.passbolt.com/incidents/critical-php-vulnerabilities-cvss-9-2https://www.passbolt.com/incidents/critical-php-vulnerabilities-cvss-9-2Response evidence
Self-hosted OS packages
- Response status
- Customer update required
- Response information checked
- 2026-10-27
Current re-audit: Official response verified · Research date: 2026-10-27
PHP fixes come from the OS vendor.
Scope: Without a patched package, the notice advises keeping the instance unreachable externally.
What users should do
Update PHP and restart PHP-FPM or the web server.
Source URLs
- https://www.passbolt.com/incidents/critical-php-vulnerabilities-cvss-9-2https://www.passbolt.com/incidents/critical-php-vulnerabilities-cvss-9-2Response evidence
Official Docker / Helm
- Response status
- Fix available; redeployment required
- Response information checked
- 2026-10-27
Current re-audit: Official response verified · Research date: 2026-10-27
Official Docker images and Helm chart are fixed.
Scope: Publication does not automatically update running containers.
What users should do
Retrieve and redeploy the fixed artifacts.
Source URLs
- https://www.passbolt.com/incidents/critical-php-vulnerabilities-cvss-9-2https://www.passbolt.com/incidents/critical-php-vulnerabilities-cvss-9-2Response evidence
AWS AMI / OVA / DigitalOcean
- Response status
- Fixed images; marketplace review pending
- Response information checked
- 2026-10-27
Current re-audit: Official response verified · Research date: 2026-10-27
AMI and OVA fixes are available; the fixed DigitalOcean image awaits marketplace review.
Scope: New images do not update existing instances.
What users should do
Update PHP through the OS package manager on existing VMs.
Source URLs
- https://www.passbolt.com/incidents/critical-php-vulnerabilities-cvss-9-2https://www.passbolt.com/incidents/critical-php-vulnerabilities-cvss-9-2Response evidence
Related official sources
- Passbolt PHP2Shell responseOfficial notice
Comments