Security
Security Advisory Summary
PHP Notice For Customers
Security Advisory: PHP2Shell Vulnerability
Updated on Oct 22, 2026
Published on Oct 22, 2026
Wasabi is aware of two recently disclosed critical PHP security vulnerabilities (CVE-2026-109618 and CVE-2026-109619).
Our assessment has identified potential exposure in an optional, third-party speedtest tool accessible through the Wasabi Management Console. The speedtest service is logically separated from our core Wasabi application infrastructure. No customer action is required. The speedtest feature does not store customer data, and we have found no indication of compromise.
We have patched PHP on the speedtest server in 13 of 16 Wasabi storage regions. We have disabled speedtest while we upgrade the remaining regions. At this time, the remaining regions to be patched are:
us-west-2 (San Jose)
eu-west-3 (UK)
eu-south-1 (Milan)
As a precaution, Wasabi will leave speedtest disabled in the above regions until we complete remediation and restore the speedtest functionality. We will update this advisory when remediation is complete.
The following Wasabi provided products and services are NOT impacted by these CVEs:
Wasabi Hot Cloud Storage S3 service (including S3 and management APIs)
Wasabi Management Console (except for us-west-2, eu-west-3, eu-south-1 storage regions)
Wasabi Account Control Manager
Wasabi Cloud Sync Manager
Wasabi Cloud NAS
Wasabi Explorer
Wasabi Surveillance Cloud
Wasabi Ball Transfer Appliance
Wasabi.com public website
For additional information about these vulnerabilities, please refer to CVE-2026-109618 and CVE-2026-109619.
Customers with security-related questions may contact security@wasabi.com.
Wasabi Statement on REACT Security Vulnerability
Updated on Aug 24, 2026
Published on Dec 17, 2025
1 minute(s) read
Dec 3, 2025: Wasabi is aware of the React2Shell vulnerability, also referred to as CVE-2025-66478, and has completed verification that this issue does not affect any Wasabi products or services.
A newly revealed vulnerability impacting a critical 10.00 CVSS remote code execution (RCE) vulnerability was disclosed in React Server Components and Next.js on December 3, 2025, and designated as CVE-2025-66478 with the highest severity rating of 10. The flaw has been dubbed REACT and affected a large portion of JavaScript applications.
The vulnerability allows an unauthenticated attacker to execute arbitrary code on a server using nothing more than a crafted HTTP request. The React Server Components (RCS) use a serialized transport format – “Flight” – to send structured component data and server function calls between the client and server. The vulnerability is a logic flaw in how React deserializes incoming RSC payloads.
From REACT CVE-2025-66478 (Critical Security Vulnerability in React Server Components) detail: “On November 29th, Lachlan Davidson reported a security vulnerability in React that allows unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Even if your app does not implement any React Server Function endpoints, it may still be vulnerable if your app supports React Server Components. This vulnerability was disclosed as CVE-2025-55182 and is rated CVSS 10.0.”
NIST also released CVE-2025-66478 Detail: “A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.”
Wasabi is aware of the vulnerability and has completed verification that this issue does not affect any Wasabi products or services.
This includes our service itself as well as Wasabi Hot Cloud Storage, Wasabi Account Control Manager, Wasabi Cloud NAS, Wasabi Surveillance Cloud, and Wasabi File Acceleration. Keeping our customers and their data secure is always our top priority. Wasabi continually tests and monitors our systems for vulnerabilities such as this. We have taken active steps to ensure that no Wasabi customer is exposed to these types of vulnerabilities. At the time of this knowledge base posting, Wasabi has not received any information to indicate that these types of vulnerabilities have been used to attack the Wasabi infrastructure or in any way impact the integrity of customer data stored with the Wasabi service.
Wasabi Statement on Log4j (CVE-2021-44228) Security Vulnerability
Updated on Feb 5, 2026
Published on Dec 14, 2023
1 minute(s) read
Dec 13, 2021: Wasabi is aware of the vulnerability disclosed by Log4j (CVE-2021-44228) and has completed verification that this issue does not affect any Wasabi products or services.
A newly revealed vulnerability impacting Apache Log4j 2 versions 2.0 to 2.14.1 was disclosed on the project’s GitHub on December 9, 2021, and designated as CVE-2021-44228 with the highest severity rating of 10. The flaw has been dubbed Log4Shell.
Log4j 2 is an open source Java logging library that is widely used in a range of software applications and services around the world. The vulnerability can allow threat actors the opportunity to take control of any Java-based, internet-facing server and engage in Remote Code Execution (RCE) attacks.
From CVE-2021-44228 detail: “An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled.” The impact of this vulnerability is likely to be very widespread. There are already reports that threat actors are actively engaged in mass Internet scanning to identify servers vulnerable to exploitation.
Wasabi is aware of the vulnerability and has completed verification that this issue does not affect any Wasabi products or services.
This includes our service itself as well as Wasabi Explorer, Wasabi Account Control Manager, Wasabi Cloud NAS, and Wasabi File Acceleration.
For those who are concerned about closing third-party vulnerabilities (i.e., products aside from Wasabi), Apache, which looks after the Log4j product, has published a security advisory about the issue. Recommended steps you can take include:
Upgrade to Apache Log4j 2.15.0. If you’re using Log4j, any 2.x version from 2.14.1 earlier is apparently vulnerable by default.
If you are still using Log4j 1.x, don’t, because it’s completely unsupported. Note that Log4j 1.x has a Log4Shell-style bug of its own, dubbed CVE-2021-4104, so that the lack of support for this version means that this bug will probably never be patched. You need to switch to the latest version (2.15.0) if you plan to stay with Log4j.
Block JNDI from making requests to untrusted servers. If you can’t update, but you’re using Log4j 2.10.0 or later, you can set the configuration value log4j2.formatMsgNoLookups to true, which prevents LDAP and similar queries from going out in the first place.
If you have any other questions regarding the Log4j issue and Wasabi, reach out to Wasabi Support (support@wasabi.com) for further assistance.
Wasabi Statement on Spectre & Meltdown Security Vulnerability
Updated on Jan 30, 2026
Published on Dec 14, 2023
1 minute(s) read
An industry-wide, hardware-based security vulnerability was disclosed on 3 January 2018. The vulnerability that was disclosed requires specific exploit code to be run on a CPU. This is a relevant problem for compute-as-a-service providers (i.e., AWS EC2), as by their nature, these services allow customers to run arbitrary code on the provided compute service. This threat scenario is not applicable to Wasabi, as we do not offer compute-as-a-service to our customers.
Wasabi operates our own servers (we do not use a third-party compute-as-a-service offering), so we don’t allow arbitrary code to be run on our servers. As such, these flaws do not pose a direct threat to the Wasabi service or the data stored therein. With that said, Wasabi is continuing to evaluate the server vendor patches that are relevant to server components that we do use, and we will implement these patches as they become available.
Keeping our customers and their data secure is always our top priority. Wasabi continually tests and monitors our systems for vulnerabilities such as this. We have taken active steps to ensure that no Wasabi customer is exposed to these types of vulnerabilities. At the time of this knowledge base posting, Wasabi has not received any information to indicate that these types of vulnerabilities have been used to attack the Wasabi infrastructure or in any way impact the integrity of customer data stored with the Wasabi service.
Please continue to monitor this knowledge base article for additional information on this topic.