Resolved
Veritone statement on the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
Veritone is aware of the critical PHP vulnerabilities disclosed on October 21, 2026, commonly referred to as PHP2Shell. Upon disclosure, our security team conducted a comprehensive review of all Veritone production applications and infrastructure, including our Broadbean and Pandologic product lines. This review covered our source code, deployed systems, and cloud environments, and was validated using multiple independent security and inventory tools.
We have confirmed that no Veritone production system or customer-facing service runs the affected PHP software, and no customer data or service was exposed to this vulnerability. No action is required by our customers. Veritone continues to monitor for new developments related to this issue and remains committed to the security of our platforms and the trust our customers place in us.
Veritone statement on the LiteLLM supply-chain compromise
Veritone is aware of the October 2026 security incident in which a compromised version of the open-source LiteLLM package was briefly distributed through public software repositories. Because LiteLLM is a component used in parts of our AI platform, our security team immediately reviewed every Veritone environment where it is deployed, including production services, build pipelines, and developer systems, to determine whether the compromised release had been downloaded or run anywhere in our infrastructure.
That review confirmed that no Veritone system used the compromised version of LiteLLM at any point, and no customer data, credentials, or services were exposed as a result of this incident. No action is required by our customers. Veritone continues to monitor the situation, maintains controls over the software versions we deploy, and remains committed to the security of our platforms and the trust our customers place in us.
Posted Oct 22, 2026 - 18:05 UTC
This incident affected: DMH Services (API, Ingest, Processing, Transfer, Cognition, DMH Content CDN, DMH Content API, Email Service, Payment Processing, CloudFront Application CDN, Relational Database Service, Elastic Compute Cloud, ElastiCache, Elastic Load Balancing, US East Storage, US West Storage, UK Storage, DMH Sites, Akamai Edge Delivery), Broadbean (Broadbean Adcourier, Broadbean Aplitrak, Broadbean Search, Broadbean Talentsearch, Broadbean New Manage Responses (NMR), Broadbean Old Manage Responses (OMR), Broadbean Parsing, Broadbean Hybrid, Broadbean Candidate Hub, Broadbean Sync/Auto Post, Broadbean Compliance Dashboard, Broadbean Candidate Writer), aiWARE - US (API, Attribute, Automate, Collections, Data Center, Identify, Discovery, Illuminate, Library, Redact, Custom Analytics (VCAP), Developer, Media Ingestion and Processing, Track, Analytics Center), aiWARE - UK (API, Attribute, Automate, Data Center, Discovery, Collections, Identify, Illuminate, Library, Redact, Custom Analytics (VCAP), Developer, Analytics Center), aiWARE - US GOV 1 (API, Identify, Illuminate, Library, Redact, Track), aiWARE - US GOV 2 (API, Identify, Illuminate, Library, Redact), aiWARE - US FED 1 (API, Illuminate, Library, Redact), aiWARE - US FED 2 (API, Illuminate, Library, Redact), Broadbean (Pandologic) (PandoIQ), aiWARE - CA1 (API, Identify, Illuminate, Library, Redact), aiWARE - US FED 3 (API, Illuminate, Redact), Veritone.com website, aiWARE-US-3, and Support Channels (Email Support, Phone Support, Web Form Support, Chat Support).