Is Obsidian Security down?

Security Advisory: PHP2Shell Vulnerabilities (CVE-2026-109618, CVE-2026-109619) Published: Oct 22, 2026 Summary Obsidian Security has assessed the recently disclosed PHP vulnerabilities known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Our response The Obsidian platform, including its supporting infrastructure and web-based management interfaces, does not use PHP or any of the affected components. These vulnerabilities do not impact the Obsidian service, and no action is required from customers with respect to Obsidian. Our team continues to monitor for related risk from third-party applications and integrations that may use PHP. We recommend customers apply patches and follow remediation guidance from any affected vendors in their environment. Questions For questions, please contact your Obsidian account team or support via [email protected] or the Admin Portal.

We have identified the cause of the issue affecting activity data in the live US environment. The affected services have stabilized, and our systems are steadily working through the backlog. Recovery is progressing, but not yet complete. Activity data for the live environment is still delayed while this clears. Once processing resumes, we expect the delayed data to catch up automatically. No data loss is expected, as delayed events are being retried and will be processed. We will post another update once activity processing has returned to normal.

Our systems has recovered. Processing of activity data for the live environment has resumed, and the backlog of delayed activity is now being worked through.

Processing has returned to normal, and the backlog of delayed activity has been fully cleared. All activity data is now up to date.

Security Advisory: CloudSEK Disclosure — TeamPCP / Trivy Supply Chain Campaign Published: August 14, 2026 Status: Resolved - no customer impact Customer action required: None Summary Obsidian Security is aware of the CloudSEK disclosure regarding the TeamPCP supply chain campaign, which targeted CI/CD pipelines and AI infrastructure beginning in March 2026 and named 2,500+ affected companies. Obsidian is listed among them. The data published by CloudSEK corresponds to the original Trivy-based campaign that affected our CI/CD systems in mid-March 2026, an incident we detected at the time, fully investigated, and remediated. No customer data was exposed at any time. A limited set of Obsidian internal secrets and CI/CD configurations were exposed. The secrets were all unusable in the hands of a third party owing to our defense-in-depth protections and swift incident response. All were revoked and rotated in March 2026, and we confirmed none were used to make any unauthorized access. What Happened Mid-March 2026 — Original incident - Our CI/CD systems were impacted by the Trivy supply chain campaign. - Some internal secrets and CI/CD configuration were potentially exposed. - We detected the activity immediately and initiated an incident response. Our findings: - No customer data or customer secrets were affected. - Any exfiltrated secrets were unusable on their own due to our defense-in-depth posture. - No unauthorized access occurred. Remediation completed at the time: - Revoked and rotated all secrets used in the CI/CD pipeline. - Hardened how our CI/CD pipeline pulls in open-source dependencies and implemented restrictions. August 2026 — CloudSEK publication CloudSEK obtained and published data from the Trivy campaign, listing 2,500+ impacted companies including Obsidian. Our response: - Engaged directly with CloudSEK and obtained the full incident report, including raw log files. - Confirmed the published data originates entirely from the mid-March 2026 incident, with no new or additional exposure. - Reconfirmed that every internal secret appearing in the report had already been rotated in March 2026. - Verified that none of the exposed secrets were used in any access attempt. Any such attempt would have failed given our layered controls. - Re-evaluating our disclosure criteria. Why We Did Not Disclose Earlier Obsidian is continuously targeted, as are all security vendors. We assessed the March 2026 incident against our disclosure criteria and determined that no customer sensitive information was exfiltrated and no customer environment was affected. The incident was contained, remediated, and closed. We are publishing now because the CloudSEK report has brought the underlying data into public view, and we want customers to have an accurate account of what it does and does not represent. We are re-evaluating our disclosure criteria, and going forward anticipate releasing more information about attacks that exfiltrate data, even if we do not consider the data to be sensitive. Current Status We have found no new evidence of unauthorized access and have had no incidents reported. We continue to monitor and will provide updates if our assessment changes. Contact Customers with questions are welcome to reach out to their Obsidian account team or our support team directly at [email protected]. We are happy to schedule a call to walk through the details of this advisory.