Veritone statement on the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) Veritone is aware of the critical PHP vulnerabilities disclosed on October 21, 2026, commonly referred to as PHP2Shell. Upon disclosure, our security team conducted a comprehensive review of all Veritone production applications and infrastructure, including our Broadbean and Pandologic product lines. This review covered our source code, deployed systems, and cloud environments, and was validated using multiple independent security and inventory tools. We have confirmed that no Veritone production system or customer-facing service runs the affected PHP software, and no customer data or service was exposed to this vulnerability. No action is required by our customers. Veritone continues to monitor for new developments related to this issue and remains committed to the security of our platforms and the trust our customers place in us. Veritone statement on the LiteLLM supply-chain compromise Veritone is aware of the October 2026 security incident in which a compromised version of the open-source LiteLLM package was briefly distributed through public software repositories. Because LiteLLM is a component used in parts of our AI platform, our security team immediately reviewed every Veritone environment where it is deployed, including production services, build pipelines, and developer systems, to determine whether the compromised release had been downloaded or run anywhere in our infrastructure. That review confirmed that no Veritone system used the compromised version of LiteLLM at any point, and no customer data, credentials, or services were exposed as a result of this incident. No action is required by our customers. Veritone continues to monitor the situation, maintains controls over the software versions we deploy, and remains committed to the security of our platforms and the trust our customers place in us.