Vercel Trust Center changed Vercel, Nov 9, 2026

Vercel · Nov 9, 2026 · 5 added, 1 removed · seen by the weekly check

Added: Node.js, PHP, and eMudhra Security Advisories
Added: In October 2026, Vercel published three advisories affecting runtimes and certificates: a compromised eMudhra certificate authority (October 17), a Node.js Brotli vulnerability (October 21), and the php2shell PHP vulnerabilities (October 21). Where needed, Vercel has applied protections to the platform.
Added: Projects on Vercel: Redeploy to get the patched Node.js and Vercel's added protections. Projects on Node.js 20.x must switch to 22.x or 24.x and redeploy.
Added: PHP, anywhere: Upgrade to 8.2.35, 8.3.36, 8.4.27 or 8.5.12.
Added: Your own runtimes and servers: Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1. Update certificate bundles, such as certifi 2026.10.19 or later, and rebuild on updated container base images.
Removed: We've identified a security incident that involved unauthorized access to certain internal Vercel systems. We are actively investigating and have engaged incident response experts to help investigate and remediate. We have notified law enforcement. At this time, we have identified a subset of customers that were impacted and are engaging with them directly. Information about the incident, including any steps customers should take can be found at our Security Bulletin .

About this change