CloudFix Feature
PHP2Shell, Node2Shell and the Next One: Where to Find CloudFix's Status
CloudFix now publishes its status on widely reported vulnerabilities at trust.cloudfix.com/advisories, so your security team can check it without sending a questionnaire.
October brought two vulnerabilities with catchy names in the same week: PHP2Shell (CVE-2026-109618 and CVE-2026-109619) and the Brotli decoder flaw published as Node2Shell and HTTP2Shell (CVE-2026-111497). Within days, customers’ vendor-risk teams were asking the same three questions: are you affected, what are you doing about it, and do we need to do anything?
Those are fair questions. CloudFix holds roles in your AWS accounts, so your security team should know where we stand without waiting for an email.
One page for every answer
We now publish our status at trust.cloudfix.com/advisories. Each entry covers:
- Your AWS accounts. Whether anything CloudFix deploys into them (IAM roles, the Cost and Usage Report stack, Systems Manager automation) is affected.
- The CloudFix platform. Whether the service itself is affected, and what we did about it.
- Action for customers. Whether you need to do anything. So far, the answer has been no.
We update an entry when its status changes, with the date.
How we check
For each advisory we check three places: every template and automation document we deploy into customer accounts, our application code and the AWS runtimes it runs on in production, and the pipeline that builds CloudFix. The build pipeline holds no customer data.
If your vendor-risk process needs a written statement on a specific vulnerability, contact the security team and we will send one.
