No customer action required on Rapid7 components
Based on our investigation to date, no action is needed on the components listed below. We recommend assessing and updating PHP across your own environment, as described in our blog and documentation.
Product status
On-premises components
This table reflects our investigation as of October 27, 2026.
| Product or component | Status | Details |
|---|---|---|
| Rapid7 Vulnerability Management Security Console | Not affected | Does not use the affected PHP components |
| Rapid7 Vulnerability Management scan engines and Scan Assistant | Not affected | Does not use the affected PHP components |
| Rapid7 Agent | Not affected | Does not use the affected PHP components |
| Rapid7 Collector | Not affected | Does not use the affected PHP components |
| Rapid7 Cloud Security | Not affected | Does not use the affected PHP components |
| Rapid7 Application Security on-premises scan engines | Not affected | Does not use the affected PHP components |
| AppSpider | Not affected | Does not use the affected PHP components |
| Rapid7 Automation orchestrator, including plugins | Not affected | Does not use the affected PHP components |
| Velociraptor server and clients | Not affected | Does not use the affected PHP components |
Rapid7 hosted services
| Service | Status | Details |
|---|---|---|
| Command Platform, including solutions running on Command Platform: Cloud Security, SIEM, Application Security, Vulnerability Management, Automation, Attack Surface Management, and Managed Services offerings built on top of these solutions. | No action required | No PHP usage confirmed. We continue to actively monitor. |
| Managed Vulnerability Management (MVM), Managed Threat Complete (MTC), Managed Detection & Response (MDR) | No action required | No PHP usage confirmed. We continue to actively monitor. |
What does this mean for you
No action required
No customer action is required on the Rapid7 components listed above. Assess and update PHP across your own environment, as described in our blog and documentation.
PHP files in vulnerability-check content
Some Rapid7 products include PHP files used to detect PHP vulnerabilities. They don’t run as a web application or expose any affected components.
Ongoing monitoring
We're monitoring this situation closely. We'll keep customers informed where appropriate, in line with our established customer notification processes.
No action required
No customer action is required on the Rapid7 components listed above. Assess and update PHP across your own environment, as described in our blog and documentation.
PHP files in vulnerability-check content
Some Rapid7 products include PHP files used to detect PHP vulnerabilities. They don’t run as a web application or expose any affected components.
Ongoing monitoring
We're monitoring this situation closely. We'll keep customers informed where appropriate, in line with our established customer notification processes.