Snapshot 251612
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Skip to navigationSkip to main content Snyk Trust is paramount at Snyk. Our Developer Security Platform uses AI-driven insights to secure your entire software supply chain and AI-generated code. We ensure transparency: customer code is never used for AI training. We uphold ISO 27001, SOC2 Type II, and GDPR compliance, protecting your data with encryption and regional residency. Explore our commitment to innovative, trustworthy security. trustassurance@snyk.io Privacy PolicyOpens in new tab Compliance ISO 27001:2022 ISO 27017:2015 SOC 2 Type II PCI DSS - SAQ A Secure by Design Pledge FedRAMP Rev. 5 Resources View all Compliance Security and Compliance Overview PCI-DSS Certificate PCI-DSS SAQ View 1 more Penetration Tests Pentest: Container Pentest: Infrastructure as Code (IaC) Pentest: Network Pentest: 2025-10 - Snyk Open Source SCA View 3 more Architecture Diagram Snyk Architectural Diagrams Policies Security Addendum Opens in new tab Data Processing Addendum Opens in new tab Questionnaires AI FAQ SIG Lite Snyk API & Web API & Web: BC Test API & Web: DR Test API & Web: Business Continuity Plan API & Web: Disaster Recovery Plan View 1 more Business Continuity & Disaster Recovery BC/DR Overview for Multi tenant BC and DR Testing 2025.pdf Other resources Mandiant Security Memo on the Klue Incident Cyber Insurance 2026 ISO Statement of Applicability View 2 more Subprocessors View all Amplitude, Inc. • Data analytics Hosted in the U.S. May be accessed globally by Snyk employees. Snyk uses Amplitude to obtain usage analytics in relation to its products and services. To compile these analytics, Amplitude may access personal data relating to a user’s use of Snyk’s services, their features and functionality. Snyk uses these analytics to optimize and improve its offerings. Amazon Web Services (AWS) • IT Data can be hosted in the U.S., EU or Australia at Customer’s election. May be accessed globally by Snyk employees. SaaS Services hosting provider serving as the backbone of our infrastructure for several of our products and Services. AWS may have access to all Customer Data. However, as a general principle, AWS will not access any Customer instances of the Snyk Services except in limited cases such as to investigate service issues. Akamai Technologies, Inc. • Engineering The nature of the Akamai solution, for optimizing traffic management, means that Akamai processes Snyk’s customer data from the region closest to where the user is located. SnykContent Delivery Network provider - Snyk uses the CDN for managing user traffic on its products and services. Developer personal data may be included in the short term data cache for this service. Okta • IT Hosted in the U.S, EU or Australia at Customer’s election. May be accessed globally by Snyk employees. Auth0 serves as an identity provider which is used to authenticate users of Snyk’s services. To perform this authentication, Auth0 will have access to personal data of the users. FAQ Updates View all General Zero-Day Incident - OpenSSH Password Authentication Bypass - Update #1 Published November 5, 2026 Overview On November 5, the OpenSSH project released 10.6p2, which fixes a password authentication bypass in sshd. If you run sshd on a Linux system built on musl (such as Alpine, OpenWrt, Buildroot, and Yocto) without PAM, an attacker may be able to access SSH without a password. To mitigate the vulnerability, you should update to OpenSSH 10.6p2. No CVE has been assigned yet. Is Snyk affected? As of this publication, based on the available information, the Snyk environments are not impacted. What you should do Upgrade to OpenSSH 10.6p2Opens in new tab or higher (for example, apk upgrade openssh on Alpine). Alpine has patched and backported openssh-server in all releases from 3.16 through edge. The versions containing the fix are listed in the Alpine advisoryOpens in new tab. If you can't update immediately: disable password logins by setting PasswordAuthentication no in your sshd configuration, then restart sshd. What comes next? We will continue to monitor the situation, add advisories as Linux distributions publish theirs, and provide updates as additional information becomes available. If you have questions, please contact your Snyk account team or Support. General Snyk is standardizing SCM file access on Workspaces Published November 2, 2026 Snyk is standardizing how it retrieves repository files Temporary Git cloning is a common way for modern code security and CI/CD tools to retrieve repository contents for analysis. Snyk is standardizing on this model through what we call Workspaces, replacing the legacy method of fetching individual files through your SCM provider's HTTP API. This consolidates Snyk’s repository retrieval in one method; it does not change what Snyk can access. Snyk remains limited to the scope authorized by your SCM integration and, if you use Snyk Broker, by your Broker configuration. Snyk does not maintain a persistent repository clone. The temporary clone is removed after scan processing, while source data required for vulnerability analysis may remain in an encrypted cache for a maximum of 24 to 48 hours, depending on your region. Snyk Broker customers may need to update their Broker client or configuration. All other customers require no action. How Snyk handles your repository contents Retrieval is triggered by a scan. Snyk creates a temporary clone, within the region where your tenant is hosted, of a specific commit SHA only when a scan runs. It does not maintain a standing repository copy. Retention is short and encrypted. Source data required for vulnerability analysis is held in an encrypted cache for a maximum of 24 to 48 hours, depending on your region, and is then permanently removed. Transport is HTTPS. Snyk performs the temporary clone over HTTPS using the credentials already configured for your SCM integration. SSH-based cloning is not used. What you may need to do If you use Snyk Broker: Workspaces requires your Broker client to be on version 4.205.1 or later and to permit the temporary Git cloning used for analysis. If your deployment predates that release or has cloning disabled, you must update your client or configuration. Everyone else: No action is required. Why Snyk is making this change Scan accuracy. Modern analysis capabilities, including Snyk Evo, Secrets detection, and Reachability analysis, require a complete view of the repository. Scan reliability. In Snyk case studies, customers using Workspaces have seen reductions in SCM provider rate limiting of up to 94%, reducing incomplete and failed scans. Platform stability: Workspaces reduce the risk of Snyk scanning overwhelming your source-control system or hitting provider API rate limits. API-based scanning can generate high request volumes that providers constrain, making it unsuitable for enterprise-scale scanning. When the change will happen Organizations not yet using Workspaces will be migrated in stages. No action is required unless you use Snyk Broker. Snyk expects to complete the migration by the end of 2026. Learn more Full details are published in the Snyk documentation under How Snyk handles your dataOpens in new tab and SCM integrations — WorkspacesOpens in new tab. Security Brotli Decoder Remote Code Execution Vulnerability (CVE-2026-111497) Published October 28, 2026 Overview On October 21, Google released Brotli 1.0.10, 1.1.1, and 1.2.1 to fix a critical out-of-bounds write in its Brotli C decoder (CVE-2026-111497Opens in new tab, CVSS 9.2) that can lead to remote code execution. If you run an affected component, you should immediately update to the vendor’s fixed release, for example Node.js 26.12.1, 24.22.1 or 22.23.4, or .NET 8.0.33, 9.0.22 or 10.0.14, then restart or redeploy. Node.js 25 and older lines are end-of-life and receive no fix. Many runtimes, language packages, Linux distributions and products bundle their own copy of the decoder, and each needs its own update. If you only use Snyk Open Source scanning, you will not see runtimes such as Node.js in your results. That doesn’t mean you are unaffected. Is Snyk affected? Snyk is currently assessing any potential impact to our environments and will prioritize remediation of any findings if necessary. What Snyk can show you Snyk Open Source (CLI and SCM integration) reports dedicated advisories for packages that bundle the decoder, such as Brotli and brotlicffi on PyPI, the Ruby brotli gem, kjdev/brotli on Composer, and .NET runtime packs on NuGet. It does not report runtimes because they are not declared dependencies. Snyk reports runtimes and vendored copies of the Brotli C source through Unmanaged scanning (snyk test --unmanaged) and, for Linux distribution packages, Snyk Container, as each distribution publishes its advisory. Snyk advisories: all advisories for CVE-2026-111497Opens in new tab. What you should do Use Snyk Open Source, Unmanaged scanning and Snyk Container together to find every copy of the decoder, update each one, then restart processes and rebuild container images. What we are doing Advisories published and updated: we published advisories for the Node.js runtime and the Brotli C library on October 22, the day the CVE was published, and we publish dedicated advisories as we confirm other packages that bundle the decoder. More coverage on the way: we add Linux distribution advisories to Snyk Container as each distribution reports them. If you have questions, please contact your Snyk account team or Support. General Zero-Day Incident - PHP Remote Code Execution Vulnerabilities (CVE-2026-109618 / CVE-2026-109619) - Update #1 Published October 21, 2026 Overview On October 21, the PHP project released security updates for two critical vulnerabilities (CVSS 9.2) that can allow unauthenticated remote code execution. If you run PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, you should immediately update to one of the fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP states that updating is the only safe choice (PHP security advisoryOpens in new tab). These are vulnerabilities in the PHP runtime itself (the software that runs your applications), not in PHP library dependencies in your application. If you only use Snyk Open Source scanning, you will not see these CVEs in your results. That doesn’t mean you are unaffected. Is Snyk affected? As of this publication, based on the available information, the Snyk environments are not impacted. We are continuing to monitor. What Snyk can show you Snyk Open Source (CLI and SCM integration) analyzes the dependencies your applications declare, so it does not see which PHP runtime is deployed. Snyk reports these advisories through Unmanaged scanning (snyk test --unmanaged) and, for PHP installed from Linux distribution packages, Snyk Container, as each distribution publishes its advisory. Snyk advisories: CVE-2026-109618Opens in new tab (RCE via out-of-memory corruption) and CVE-2026-109619Opens in new tab (RCE via stale global state). Snyk API & Web does not report the PHP runtime version. The Zero Day report covers only projects scanned with Unmanaged scanning or Container scans of distribution packages, so it will show no results for Open Source-only projects. What you should do Follow the instructions in the PHP security advisoryOpens in new tab. What we are doing Advisories published and updated: we published advisories for both CVEs before PHP’s 14:00 UTC release, and updated them with affected versions and fix details within about 30 minutes of the release. More coverage on the way: Ubuntu and Red Hat advisories are available, and we are adding other Linux distributions as they publish theirs. We are also preparing a Zero Day report for this event, for Unmanaged projects. If you have questions, please contact your Snyk account team or Support.