Blog
Security vulnerabilities across the internet: How Replit is protecting your business
Published:
Oct 22, 2026
Luis Héctor Chávez
Scott Kennedy
The vulnerabilities disclosed this week affect software that much of the internet depends on. They create real risks for businesses and more work for the teams responsible for keeping their applications secure. As AI makes more vulnerabilities easy to find, those teams will face more pressure to respond.
At Replit, the security of our customers and the software and businesses they are building is our top priority. We’re handling much of the work for them directly: patching infrastructure, updating language tooling, and blocking exploits.
Helping you build software also means helping you keep it secure once it’s running. We manage the environment your apps run in. This means we can apply many of these protections without you having to do anything. If you need to republish an app, we’re notifying you directly.
What you need to do
We have put protections in place for the issues below at the firewall level to prevent malicious exploit attempts from reaching your apps, but some fixes require you to take further action to update and republish your apps.
To do so, open your Security Center, filter for published apps, and review any outstanding security issues. Apply the available patches, then republish so those fixes take effect in your live apps.
Recent third-party security vulnerabilities: Replit’s response
What happened: During a routine intermediate certificate authority (CA) key signing ceremony, eMudhra used weak private keys that were guessable by attackers and allowed them to spoof any domain’s TLS certificate if the attacker was able to intercept network communications, which is an impractical attack in a cloud hosting scenario. It affected trust stores used by widely adopted software, including Ubuntu, Node.js, and Python.
How Replit has taken action: We removed the compromised CA from our base images and automatically applied the fix to 95% of published apps, including Node.js’s use of the CA. We also patched Replit’s Python tooling.
What action you need to take: Republish Python apps to include the tooling update. If your app requires a manual update rather than an automatic fix, we’re emailing you with instructions.
What happened: Node.js disclosed several vulnerabilities, including a flaw in its Brotli decoder that could allow attackers to run code remotely.
How Replit has taken action: We deployed web application firewall (WAF) protections against exploitation through incoming web requests and made patched Node.js versions available.
What you need to do: Republish your Node.js apps to use the patched runtime. This also addresses attack paths outside the incoming requests covered by the firewall, including responses your app receives from other services. We’re notifying affected customers directly.
PHP:
What happened: Vulnerabilities disclosed in PHP could allow attackers to run code remotely.
How Replit has taken action: We deployed web application firewall (WAF) protections to block exploitation and patched Replit’s PHP tooling.
What you need to do: We recommend republishing your PHP apps to use the patched version, even with the firewall protections in place.
What happened: A supply chain attack targeted LiteLLM, a widely used open-source Python library.
How Replit has taken action: Our existing Socket Firewall, enabled across Replit environments, blocked all malicious package install attempts.
What you need to do: No action is required for the malicious installs blocked by the firewall.
What happened: Several vulnerabilities were disclosed in the Linux kernel, a core component of infrastructure across the internet.
How Replit has taken action: Replit’s existing microVM architecture prevented exploitation of all these vulnerabilities, by construction. We’ll upgrade to the latest version that has all the fixes once it’s available and share more about these architectural protections in an upcoming whitepaper.
What you need to do: No action is required for these specific vulnerabilities.
We’re proud of the Replit team for working around the clock to patch systems, block exploits, and notify customers.
Furthermore, our bet to harden the infrastructure to make issues like the Linux kernel’s vulnerabilities not affect any Replit customer has started to pay off; we’ll invest more in proactive measures that prevent or mitigate vulnerabilities, as well as anything that helps us react faster to them. Vulnerabilities like these will be discovered at a progressively higher pace, so we want to be always ready to protect you and your data.
We’re working to automate more of that response, with clear visibility into what we’ve handled and what still needs your attention. We will continue to notify customers as we learn more.
More
Aug 17, 2026Black-box pen tests on Replit
See how Replit's new black-box pen testing simulates real attacks to find vulnerabilities hidden from code-only scans.
Aug 16, 2026Govern Replit at scale
New Enterprise Governance tools for Replit
Apr 20, 2026Defense in Depth: How Replit Secures Every Layer of the Vibe Coding Stack
Defense in Depth: How Replit Secures Every Layer of the Vibe Coding Stack Vibe coding is changing how software gets built. But as AI agents write more of our code, the question security teams are asking has shifted from "Can AI build this?" to "Can I trust what AI builds?". At Replit, we believe the answer has to be yes, not through blind faith, but through architecture. Every layer of the Replit infrastructure where customer code runs, from the development sandbox to the production deployment, is designed with defense in depth. The Replit platform itself, our control plane, is also implemented with these principles in mind. No single control is the last line of defense. Every layer assumes the one above it might fail. This post is a detailed walkthrough of how we think about security across the stack, written for the people who need to evaluate it: CISOs, security engineers, and teams considering Replit for production workloads. Zero Trust as a Foundation Replit adheres to Zero Trust Architecture principles across our internal infrastructure. Concretely, that means: