Is Collibra Down?

Update: We have not identified any exploitation of these issues affecting Collibra environments. However, because these components are built into software across the internet, we are reviewing and updating Collibra products as a precaution. For additional information and guidance, please refer to the upcoming release announcement. Summary: Over the past few weeks, security issues were disclosed in widely used third-party technology. These include an out-of-bounds write in the Brotli compression library (CVE-2026-111497) and remote code execution vulnerabilities in core PHP memory-handling routines (CVE-2026-109618 and CVE-2026-109619). Separately, it was disclosed that eight intermediate certificate authority (CA) keys in eMudhra’s emSign G3 hierarchy were generated weakly enough to be recovered. This affects TLS and code-signing certificates that chain to those CAs. Follow updates on the incidents: eMudhra | PHP2Shell | Brotli --- [2026-10-27T21:00:00] We are continuing to assess the full scope of the incident’s impact. We are planning preventative updates to Collibra products and services that will start shortly. As of this update, Collibra Security and Engineering have still not identified any risk of impact to Collibra environments or customer data. We continue to assess and address impacted resources as needed, and we will provide updates accordingly. --- [2026-10-23T12:32:00] Description: On October 20, 2026, eMudhra announced the compromise of private keys for eight intermediate certificate authority certificates. Follow eMudhra’s updates on the incident here . As of this update, Collibra Security and Engineering have not identified any risk of harm to Collibra environments or customer data. We continue to assess and address impacted resources as needed, and we will provide updates accordingly.

auto-closed --- [2026-10-22T21:09:00] Description: On October 20, 2026, eMudhra announced the compromise of private keys for eight intermediate certificate authority certificates. Follow eMudhra’s updates on the incident here. As of this update, Collibra Security and Engineering have not identified any risk of harm to Collibra environments or customer data. We continue to assess and address impacted resources as needed, and we will provide updates accordingly.

Description: On October 21, 2026, security researchers disclosed two critical remote code execution vulnerabilities in core PHP memory-handling routines, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). The vulnerabilities affect servers running vulnerable PHP runtimes. As of this update, Collibra Security and Engineering have not identified any impact to Collibra products, hosted services, or customer data. Collibra’s platform and customer-facing application infrastructure do not run on PHP. We continue to assess our environments and third-party vendors, and we will provide updates accordingly.