Security updates
Short introduction to the page and content the user could expect to find here
Issued 3 November 2026
PHP2Shell vulnerability and Scrive services
Version 1.0 · Scrive Security Office
Scrive’s core services are not affected by the PHP2Shell vulnerabilities, because they do not use PHP. The few Scrive components that do use PHP have been patched, and we have seen no indication of exploitation. No action is required from Scrive customers or partners.
This communique is issued so that customers and partners can reference Scrive’s official position in their own vulnerability assessments. It covers Scrive eSign (including Scrive GO, Forms and APIs), Contractbook and esignatur.