There have been a number of internet-wide security incidents making headlines this week. Node.js and PHP disclosed several security vulnerabilities, and a lot of you have asked whether your apps are affected. We wanted to update you on how our team responded to these incidents.
Impact on apps built on Bubble
First, the most important info: Our assessment found no way to use these vulnerabilities to access customer data or gain elevated privileges, and we have seen no sign of exploitation since the disclosure. No action is required from Bubble users. We’ll continue to monitor and will provide updates if anything changes.
What happened and how we responded
On October 21, Node.js released fixes for several vulnerabilities, including CVE-2026-111497 (known as Node2Shell). Parts of the Bubble platform run on Node.js, so our engineering team worked through every vulnerability in the release to check whether any of them could be exploited on Bubble. We then deployed updates accordingly.
The same day, PHP released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (known as PHP2Shell). Bubble doesn’t run PHP, so these weren’t a direct risk, but we wanted to be sure. Our core infrastructure provider confirmed that the services we use aren’t affected. We also contacted our other critical vendors, and we’re not aware of any impact to Bubble or to your apps.
Our view on software and security
No software is immune to vulnerabilities like these. A big part of Bubble’s mission is making software development accessible to everyone, and that includes the work that keeps an app running after you launch it.
We know you probably didn’t start building an app so you could track Node.js advisories. On Bubble, security, hosting, and infrastructure come built in. When an incident does affect Bubble, we want you to feel confident that our engineering and security teams are handling the situation with care. We also want you to know that you can rely on us to tell you what happened.
If you have questions, you can reach out to our Support team any time.
Build your app on Bubble's Free plan. No need to upgrade until you're ready to launch your app.
Join building
