Security advisories and vulnerability disclosure
Our Product Security Incident Response Team (PSIRT) receives, verifies, fixes, and announces vulnerabilities here. We also publish third-party flaws that affect our customers.
Did you find a vulnerability?
Do not share the flaw in a public place. Email us the affected product, the version, and the steps to reproduce it. We do not take legal action against good-faith research.
Published security advisories
There is no published vulnerability for Moftgate products at this time. Below are third-party advisories that affect our customers.
PHP2Shell: Two critical RCE flaws in the PHP core
Both flaws need no authentication. An attacker can run code remotely on outdated PHP servers.
- Affected
- Servers that run outdated PHP versions
- Action
- Update PHP. Turn on file integrity monitoring for web directories.
How do we handle a report?
We receive the report
Send the report by encrypted email. You get a tracking number.
We verify it
Our engineers reproduce the flaw in a test environment and calculate the CVSS score.
We fix it
We prepare the patch, test it, and release it in the customer portal.
We publish it
We publish an advisory on this page. With your permission, we credit you.
Severity levels by CVSS score
| Level | CVSS | Meaning |
|---|---|---|
| Critical | 9.0 – 10.0 | Remote attack without authentication is possible. Act now. |
| High | 7.0 – 8.9 | The impact is serious. Do not wait for the next maintenance window. |
| Medium | 4.0 – 6.9 | The attack needs extra conditions. Fix it in planned maintenance. |
| Low | 0.1 – 3.9 | The impact is limited. Fix it in the normal update cycle. |
Talk to our security team
See our trust page for penetration test summaries, audit documents, and architecture questions.