Trust Center

RWS is aware of the recently disclosed security vulnerabilities CVE 2026-109618 and CVE 2026-109619, affecting certain versions of PHP, a widely used web application technology. Following industry notification of this issue, our Security, Engineering and Cloud Operations teams immediately initiated a review of our environment to identify any potentially affected systems and implement appropriate remediation measures.

Our investigation is ongoing; however, there is currently no evidence that this vulnerability has been exploited within the RWS environment, nor is there any indication of risk to customer data, systems or services.

As part of our standard security response process, we have identified potentially affected assets, engaged the relevant service owners, initiated patching activities, implemented additional monitoring, and are conducting validation scans to confirm remediation. Where appropriate, temporary mitigating controls have also been applied to further reduce risk while updates are completed.

RWS has proactively initiated engagement with relevant third-party suppliers to assess potential exposure and obtain assurance regarding their response activities. Supplier communications, security advisories and recommended actions are being continuously reviewed and incorporated into RWS's ongoing assessment and risk management activities.

Protecting customer information and maintaining the security and resilience of our services remains a top priority. We continue to monitor the situation closely and will take any additional actions necessary to ensure our environment remains secure.

At this time, no customer action is required. We will provide further updates should the situation materially change.

Today, we're launching the RWS Trust Center – a single destination where clients, partners and prospects can see our trust commitments and the evidence behind them, in one place.

Why we're building this now
AI, data protection and cybersecurity rules are moving fast. The EU AI Act and other emerging AI regulations, expanding global privacy laws, evolving cybersecurity standards and growing complexity in the supply chain all confirm that responsible practices matter as much as delivering great technology. The Trust Center provides practical resources that reflect how seriously we take our responsibility to our clients, and to the content and data they trust us with.

Our trust commitments
The Trust Center is built around three key pillars – each one covering a different part of how we earn your trust.

• AI governance — How we govern the use of AI across our products and services, anchored in the requirements of the EU AI Act and aligned with the OECD and EU principles for trustworthy AI.
• Data privacy — How we handle, store and protect personal data across the jurisdictions in which we operate.
• Security — How we certify and evidence our security practices, from ISO/IEC 27001:2022 and SOC 2 Type II through to penetration testing and incident management.

Transparency in practice
The Trust Center is fully searchable, and access flexes with how sensitive the material is — a living resource that will keep evolving alongside our products, our certifications and the regulations that shape them. Reflecting the same commitment we outlined when we wrote about the recalibrated EU AI Act as a sign of responsible innovation: durable governance, built carefully and made visible for anyone who wants to see it.

Trust is a practice. This is how we demonstrate it.

Christel Cao-Delebarre
VP, Head of Trust AI & Privacy at RWS