Trust Center

Update on PHP2SHELL vulnerabilities statement

The Webflow Security team is actively tracking the critical PHP2SHELL vulnerabilities (CVE-2026-109618, CVE-2026-109619, and CVE-2026-115560). Webflow’s core services are not built on PHP and are not affected.

No action is required from customers to protect your Webflow site at this time. 

As a precaution, our Security Team has assessed the non-production related systems that may use PHP and taken appropriate steps to mitigate any identified vulnerabilities. We are also conducting a thorough audit of our supply chain to understand any potential exposure. 

Our Security team will continue monitoring and provide updates as needed.

eMudhra CA compromise statement

On October 20, 2026, Mozilla and Google's Chrome Root Program confirmed that the private keys of eight eMudhra intermediate certificate authority (CA) certificates were compromised. eMudhra is a publicly trusted CA used across the internet.

At this time, No action is required from customers.

Webflow impact assessment:

• Webflow's hosting SSL infrastructure is not dependent on eMudhra
  • We have found no Webflow-managed or customer site SSL/TLS certificates are issued by, or chain through, the affected eMudhra intermediates
• The team is actively patching infrastructure in alignment with Webflow patch management and vulnerability operation process for downstream dependencies (Node.js, Go, Python)
• Internal endpoints and Web browsers (Chrome, Firefox) and macOS have already been patched.

PHP2SHELL vulnerabilities statement

The Webflow Security team is actively tracking the critical PHP2SHELL vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Webflow’s core services are not built on PHP and are not affected. Our security team is assessing non-production related systems that use PHP and taking appropriate steps to address any identified vulnerabilities.

No action is required from customers.

"Copy Fail" (CVE-2026-31431) statement

The Webflow Security team is investigating "Copy Fail" (CVE-2026-31431), a Linux flaw that could allow local authorized users to escalate permissions. This vulnerability cannot be exploited remotely over the internet.

We have identified the affected infrastructure instances and are working on fixes.

At this time, there is no evidence of exploitation in Webflow's environment. Customer data and services remain secure and fully operational. We will continue monitoring and provide updates as patches are deployed .

No action is required from customers.

Reference links:

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-31431
• Copy Fail (researcher site): https://copy.fail/

pypi-lightning project statement

April 30, 2026

Webflow is aware of the recent security advisory regarding the pypi-lightning project (https://pypi.org/project/lightning - versions 2.6.2 and 2.6.3). At this time, we have no evidence to suggest any impact to customer data, accounts, or Webflow services and no indication that sensitive codebases were exposed.

Webflow’s security team is continuing to conduct a thorough review of relevant systems. If anything changes, we’ll share updates.

Thanks,
Webflow Security

Vercel security incident statement

The Webflow Security team is aware of Vercel's recently disclosed security incident. Webflow uses Vercel in a limited capacity for application hosting.

At this time, we have no evidence of any impact to customer data, accounts, or Webflow services related to this incident.  The Webflow team is following guidance and has rotated all related credentials.

Additionally, Webflow is conducting a thorough audit of our supply chain and their potential exposure. If anything changes, we will provide updates.

Thank you,
Webflow Security

Axios project statement

We’re aware of the recent security advisory regarding the Axios project (https://www.npmjs.com/package/axios - versions 1.14.1 and 0.30.4). At this time, we have no evidence to suggest any impact to customer data, accounts, or Webflow services and no indication that sensitive codebases were exposed.

Out of an abundance of caution, we’ve implemented additional security controls and are conducting a thorough review of relevant systems. If anything changes, we’ll share updates.

Thanks,
Webflow Security

2026 SOC 1, SOC 2 report, and ISO 27001 certification now available

We Have Exciting News!

Webflow's 2026 SOC 1 & 2 reports and the ISO 27001:2022 certification are now available to request and download from our Trust Center.

Thanks for building with Webflow!

2026 ISO 42001 certification now available

We Have Exciting News!

The 2026 ISO/IEC 42001:2023 is now available to request and download from our Trust Center.

Thanks for building with Webflow!

Webflow updated Security page

We’re excited to share our updated Security page:
👉 https://webflow.com/security

This page provides a comprehensive overview of how Webflow protects customer data and maintains a secure, reliable platform. It outlines our security practices across infrastructure, monitoring, vulnerability management, incident response, compliance, and more.

We’re committed to transparency and continuously strengthening our security posture. Visit the page to learn more about how we safeguard your data.