OfficeSpace Trust
OfficeSpace Software is a complete space management and desk booking solution. This includes Visual Directory, Move Manager, Scenarios, Stack Plans, Reporting, Desk Booking, and Neighborhoods. Additional modules for Room Booking (calendar integration), Service Requests, and Visitor Management are also available.
American Bar Association
OpenAI
Boston Consulting Group (BCG)
KPMG
Scotiabank
Capital One
LPL Financial
AmTrust Insurance
HUB International
Jackson
AstraZeneca
HubSpot
Featured Documents
- Is there segregation of duties for approving and implementing access requests for Scoped Systems and Data?
- Is there sufficient detail contained in network device logs to support incident investigation?
- Is Unix or Linux used as part of the Scoped Services?
- Is there collection of, access to, processing of, or retention of any client scoped Data that includes any classification of non-public personal information or personal data of individuals?
- Is there segregation of duties for granting access and approving access to Scoped Systems and Data?
OfficeSpace Trust Updates
Critical PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
Update, October 22, 2026, 9:00 AM EDT: Remediation complete
Our hosting provider has confirmed that patches for the PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have been applied across their platform, which hosts the WordPress backends for officespacesoftware.com and greetly.com. The updated PHP versions are 8.2.35, 8.4.27 and 8.5.12, which are the fixed releases listed in the CERT-EU advisory.
No customers or customer data were affected. Questions can be sent to security@officespacesoftware.com.
On October 21, 2026, the PHP project released fixes for two critical vulnerabilities that could allow remote code execution (CVE-2026-109618 and CVE-2026-109619). Fixes are available in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For details, see CERT-EU Security Advisory 2026-018.
Our products and platform: We reviewed our application codebase using automated scanning and found no PHP installations or affected versions. Our software products and customer-facing platform are not affected.
Our public websites: The WordPress backends for officespacesoftware.com and greetly.com run on PHP versions in the affected range. These sites do not host or process customer data from our products. Our hosting provider reports that protective mitigations are active at the CDN and hosting layers, and that patches for all PHP versions on their platform are being deployed. As of 5:00 PM EDT on October 21, 2026, rollout is still in progress. We will confirm completion here once we have verified it with our provider. Our dojo.co site does not use PHP.
Customer impact: No customers or customer data are affected. We have found no evidence of exploitation or compromise as of October 21, 2026, 5:00 PM EDT.
Sub-processors: We are in contact with our hosting provider about their remediation, and we are assessing other third-party services for PHP exposure.
We will update this notice when patching is complete. Questions can be sent to security@officespacesoftware.com.
CVE-2025-55182
We are aware of the recently announced critical Remote Code Execution (RCE) vulnerability affecting certain Next.js applications (tracked as CVE-2025-55182).
We have completed a comprehensive review of our technology stack and security landscape.
We can confirm that our production environment and core services are not affected by this vulnerability.
• No Next.js Usage: Our application portfolio does not utilize the Next.js framework in any of our critical systems or services.
• Proactive Monitoring: Our continuous alerting and threat detection systems across our Node.js environments have confirmed that no vulnerable dependencies are present.
Maintaining the security and integrity of our platform is our highest priority. We continue to monitor the situation and surrounding security advisories to ensure our infrastructure remains protected against emerging threats.
If you have any further questions regarding this or any other security matter, please contact our support team.