Start your security review.
Welcome to STACK Construction Technologies' Trust Center. Our commitment to data privacy and security is embedded in every part of our business. Use this Trust Center to learn about our security posture and request access to our security documentation.
CentiMark
SRS Distribution Inc
Interstates
Siemens
Kiewit
ABC Supply Co. Inc.
F.E. Moran Group of Companies
Lennox
ISCO Industries
Blum Construction
STRABAG
Ville de Montréal
Pepper Construction
AGTHERM
NY Power Authority
PCL Construction
Western Specialty Contractors
SPAAR
Hydro-Québec
Pomerleau
Start your security review. Updates
PHP2Shell: Multiple Critical Vulnerabilities in Core PHP Engine
STACK has confirmed WPEngine has completed the PHP patching on the www.stackct.com website. STACK has also confirmed that all subprocessors integrated with our Takeoff and Estimate and Build and Operate products are either not effected or have patched. Thank you for your patience while we investigated possible areas of exposure.
Wiz Research uncovered multiple critical memory-safety vulnerabilities in core PHP, dubbed PHP2Shell (CVE-2026-109618, CVE-2026-109619). Stemming from flawed fatal-error and out-of-memory handling logic dating back over a decade, these engine-level bugs allow unauthenticated remote process-memory disclosure (Heartbleed-style) and unauthenticated Remote Code Execution (RCE). Because the flaws reside within the PHP engine itself, they impact environments independently of the application running on top-affecting practically every PHP version (including branches back to PHP 5.4).
STACK's Takeoff & Estimate and Build & Operate platforms do not use PHP, so they are not affected. Our corporate website does use PHP through a hosting provider, which has put protections in place and is rolling out the fix. We are also checking with our other subprocessors and will follow up if anything changes.