Trust Center

On October 20, 2026, the private keys for eight intermediate certificate authorities (CAs) operated by eMudhra were weak enough to be recovered from their public certificates. Anyone with access to these keys could potentially issue fraudulent certificates for websites to potentially intercept or alter encrypted traffic from systems that still trust the affected CAs. eMudhra has since revoked these certificates, major browser and operating system vendors have blocked the use of these certificates, and related fixes to affected software are tracked as CVE-2026-111943.
Drata does not use any eMudhra-issued certificates. To confirm any exposure, Drata’s Security and Engineering teams reviewed certificate trust across our environment and have removed any affected CAs from the trusted certificate bundles used by Drata. We have not identified evidence of exploitation affecting Drata or our customers. We are updating remaining lower-risk internal components as part of our standard vulnerability management process and continue to monitor our environment.

On October 21, 2026, details of several high-severity vulnerabilities in the Node.js runtime, including CVE-2026-111497 (known as “Node2Shell”), were made public.
Drata’s Security team has assessed the impact of these vulnerabilities on Drata and, as of October 23, 2026, we have patched any impacted production services. We have not identified any evidence of exploitation affecting Drata or our customers. We are updating a few remaining components with lower-severity impacts (in accordance with our standard vulnerability management process) and will continue to monitor our environment.

On October 21, 2026, Drata became aware of the PHP2Shell security vulnerabilities. Reputable threat intelligence sources have reported that these vulnerabilities affect the core PHP language runtime and could allow unauthenticated remote code execution on web servers running vulnerable PHP versions (CVE-2026-109618, CVE-2026-109619).

• Recommended reading: PHP Security Advisory, The PHP Group

We want our customers to know that Drata is not impacted by this vulnerability.

Our investigation supports this assessment:

• PHP is not part of the Drata or SafeBase platforms. Our products are built mainly on TypeScript, Python and Go. No production service or customer-facing system runs PHP, and no subprocessors have disclosed being impacted at the time of this update.
• No internet-exposed vulnerable assets. Our cloud security platform found no vulnerable PHP on any internet-facing or production workload.
• Limited, non-exploitable presence in build tooling. PHP was present only as a preinstalled package on 1 internal ephemeral service. There it does not serve web requests and accepts no inbound network traffic. Even so, we have applied the patched packages. 

The confidentiality, integrity and availability of the Drata product and customer data remain unharmed.

We will continue to monitor the situation and will update this post if additional information materially changes this assessment. If you have questions, please contact security@drata.com.

On May 11, 2026, Drata became aware of the TanStack Mini Shai-Hulud supply chain attack security incident. Reputable threat intelligence sources have reported that this incident compromised 84 packages in the @tanstack/* npm namespace, modifying affected versions to steal CI/CD credentials and exfiltrate data to attacker-controlled infrastructure.

• Recommended reading: TanStack npm Packages Compromised in Ongoing Mini Shai-Hulud Supply-Chain Attack, Socket Research Team
• Recommended reading: TanStack npm Supply Chain Compromise Postmortem, TanStack

We leverage TanStack packages within our product, but our pinned versions predate the affected range. We conducted a thorough investigation including cross-referencing our dependencies against the confirmed compromised package list, scanning our codebases and developer endpoint environments for malicious files associated with this campaign, and searching our endpoint and network telemetry for known attacker infrastructure. At this time, based on our analysis and investigation, we have not found indications of compromise.

On May 6, 2026, Drata became aware of the Braintrust security incident, in which attackers obtained unauthorized access to one of Braintrust's AWS accounts on May 4, 2026. The affected environment stored organization-level AI provider API keys that customers had configured within the Braintrust platform. Reputable threat intelligence sources have reported that Braintrust identified at least one impacted customer but had not found evidence of broader exposure at the time of disclosure.

Drata is not impacted by this incident based on the information currently available. Our investigation, conducted the same day the incident became public, supports this assessment:

• Drata currently uses Braintrust exclusively for internal, offline evaluation workflows. No customer data is processed on or streamed to Braintrust — it is not part of any customer-facing product workflow.

• Our code review confirmed the Braintrust SDK is scoped to an optional evaluation dependency group only and is not active in core production services.

• No indicators of compromise were observed in our environment.

Precautionary steps we took, even though we had no evidence of customer data impact:

• Revoked and rotated all AI provider API keys stored within the Braintrust platform, as recommended by Braintrust.

• Rotated the Braintrust API key across all environments.

• Reviewed the scope of our Braintrust integration and confirmed it is limited to internal eval tooling with no connection to customer data.

The confidentiality, integrity, and availability of the Drata product and customer data remain unharmed.

We will continue to monitor the situation and will update this post if additional information from Braintrust, our threat-intelligence providers, or our own ongoing investigation materially changes this assessment.

If you have questions about your Drata environment in connection with this incident, please contact security@drata.com.