Usage

Hoxhunt does not use PHP. The platform runs on Node.js, Go and Python; no PHP interpreter is present in any of our application images, servers or hosting environments, and our public web properties are served from a managed platform that does not execute PHP.

Mitigation measures

Hoxhunt assessed both CVEs against its service inventory on the day of disclosure (21 October 2026) and confirmed they do not apply to the Hoxhunt service. No patch, workaround or configuration change is required.

Supply chain impact

Hoxhunt's sub-processors are assessed under its third-party risk management process, and Hoxhunt's vendor monitoring flags published security incidents at these providers. We are confirming exposure and remediation status with the sub-processors that process Hoxhunt customer data and will provide a first update by 28 October 2026 via this support advisory article, with further updates as answers come in. 

Actions required on your side

None.

Updates

Will be provided as investigations continue.