Two recent security issues, PHP2Shell and a vulnerability in Google’s Brotli library, have received a lot of attention in the past week. If you’re wondering whether they affect SFTP To Go, we can put your mind at ease.

We don’t use PHP, so PHP2Shell doesn’t affect our service, and we’ve already successfully patched the Brotli vulnerability, CVE-2026-111497. You don’t need to update anything or change your SFTP To Go settings. Here’s what happened and how we’ve handled it.

SFTP To Go security status at a glance

  • PHP2Shell: Not affected. We don’t use PHP.
  • CVE-2026-111497: Patched on October 25, 2026.
  • Customer action: None required for SFTP To Go.

What is PHP2Shell?

PHP2Shell refers to two critical flaws in PHP, a programming language used by many websites. On affected servers, the flaws could let an attacker run code without logging in. That’s a serious concern for services using PHP, but it doesn’t apply to SFTP To Go.

Why SFTP To Go isn’t affected

We don’t use PHP, so the software affected by PHP2Shell isn’t part of our service. You don’t need to make any changes to your SFTP To Go account in response to it.

What is CVE-2026-111497?

CVE-2026-111497 is a flaw in Brotli, a software component that decompresses data. Compression makes data smaller for transmission; decompression restores it so an application can read it. Brotli is included in widely used software, including Node.js, so many services needed to assess whether the flaw could affect them.

The flaw can cause Brotli to write data beyond the memory reserved for it. An attacker who gets affected software to decompress a specially crafted response could cause a crash or corrupt the application’s memory. On certain builds, that could also make it possible to run malicious code.

What this means for SFTP To Go

Using software that includes Brotli doesn’t automatically make a service exploitable. The vulnerable decoder must actually receive and decompress attacker-controlled data. Specifically, the area that could have been potentially affected was the processing of webhook responses.

For example, if a customer webhook target had responded with a malicious Brotli-compressed body. We reviewed our logs and found no evidence of this ever happening, and our deployed fix has fully closed this exposure.

We’ve completed the fix

Our engineering team reviewed where that vulnerable functionality could be reached in SFTP To Go and closed the potential exposure. We deployed the fix on Sunday, October 25, 2026, three days after the CVE was published. Deployment is complete, as confirmed by our engineering team.

For you, that means the work required within SFTP To Go has already been done. There’s no update to install, no setting to change, and no credential rotation required because of this vulnerability.

Do you need to do anything?

No. If you use SFTP To Go, we’ve taken care of the work needed within our service. There’s no SFTP To Go client or agent to update, and these issues don’t require you to rotate credentials or change your settings.If you have any questions or concerns, please reach out to our support team.

Frequently asked questions

Does PHP2Shell affect SFTP To Go?

No. SFTP To Go doesn’t use PHP, so PHP2Shell doesn’t affect our service.

Has SFTP To Go patched CVE-2026-111497?

Yes. We deployed the fix on October 25, 2026.

Do I need to update anything or change my credentials?

No. These issues don’t require you to update software, rotate credentials, or change your SFTP To Go settings.