PHP is not used in JobSheet

You may have seen reports this week of serious security holes in PHP (sometimes called php2shell). A few of you emailed us. We wanted a clear answer on the record.

JobSheet does not use PHP. There is no PHP in the app you use in the browser or on your phone, and no PHP in our API. Your workspace is not affected.

JobSheet is a modern web app on Cloudflare Pages, with an API on Cloudflare Workers. Both are TypeScript and JavaScript. We do not run a PHP server, so this class of PHP bug cannot execute in our product.

We take security extremely seriously. Every request to JobSheet hits Cloudflare first. That is our first layer of defence: their network and web application firewall sit in front of our services before traffic reaches us.

For this PHP issue, Cloudflare published that they had already deployed multiple mitigations about nine hours before the public disclosure. We were not in the blast radius, because we do not run PHP. If we had been affected, those mitigations would already have been live on our first layer of defence.

That is the cover we rely on. If a similar request-based threat were found against one of our own services, we would expect Cloudflare to block it at the edge in the same way, often before the news is public. No one can promise zero risk.

We take security seriously beyond the edge as well. We ship regular updates to JobSheet and keep dependencies current. When serious advisories appear, we actively track them, check whether our stack is affected, and patch and deploy when something applies to us. The first layer of defence is there so a new threat is unlikely to reach you unchallenged; our own update rhythm is there so we close gaps on our side when we need to.

If you have questions, open Support in JobSheet or reply to the email you already sent. We would rather hear from you than leave you guessing.