Skip to content
Trust Center
Back to cloudfix.com
Menu

Security advisories

Our status on published vulnerabilities.

When a widely reported vulnerability could touch CloudFix, we assess it and publish our status here. Each entry covers your AWS accounts, the CloudFix platform, and whether you need to do anything.

Ask the security teamHow CloudFix is built

Advisories

Newest first.

  1. CVE-2026-111497

    Brotli decoder vulnerability ("Node2Shell", "HTTP2Shell")

    Mitigation in progress

    Your AWS accounts
    Not affected. The components CloudFix deploys into your AWS accounts (IAM roles, the Cost and Usage Report stack and AWS Systems Manager automation steps) are Python-based and contain no Brotli library.
    CloudFix platform
    CloudFix runs on AWS Lambda's managed Node.js runtime, configured to take AWS runtime security patches automatically. The CloudFix API rejects Brotli-compressed requests. We are applying an application change so that CloudFix does not decode Brotli responses from other services until AWS's patched Node.js runtime is live on our platform. We will update this entry when it is.
    Action for customers
    None.
    Disclosed
    21 October 2026
    Last updated
    27 October 2026

  2. CVE-2026-109618, CVE-2026-109619

    PHP remote code execution ("PHP2Shell")

    Not affected

    Your AWS accounts
    Not affected. Nothing CloudFix deploys into your AWS accounts uses PHP.
    CloudFix platform
    Not affected. CloudFix does not use PHP. The service runs on Node.js and Python on AWS Lambda, and the web application is static content served from Amazon S3 and CloudFront.
    Action for customers
    None.
    Disclosed
    October 2026
    Last updated
    26 October 2026

How we assess

Three places we check.

  • Your AWS accounts

    Every CloudFormation template and automation document CloudFix deploys into customer accounts, and the runtimes they use.

  • The CloudFix platform

    Our application code and its dependencies, and the AWS runtimes the service runs on in production.

  • Our build pipeline

    The tools that build and test CloudFix. Build pipelines hold no customer data.

Need a formal response?

If your vendor-risk process needs a signed or written statement on a specific vulnerability, the security team will send one.

Contact the security teamSecurity overview