Trust Center

LiteLLM Package Compromise - No Impact to Coder Releases or Customer Data

A malicious version of the open-source LiteLLM Python package was briefly published to PyPI on October 21 and pulled in by an automated build job in one of our repositories.

The job had no repository secrets, and our releases and customer data were not affected. We reviewed build logs across our repositories, runtime telemetry for our development environment, and endpoint logs for any other installs of the package. We confirmed with the engineers who work in that repository that none ran the affected build steps during the exposure window and we cleared the build caches for the impacted runs.

We found no evidence that any Coder credentials or data were taken, and the investigation is now closed. No customer action is needed.

For additional details: https://www.mend.io/blog/litellm-1-107-0-compromised/

Please reach out to security@coder.com with any questions.

PHP2Shell Vulnerabilities (CVE-2026-109618, CVE-2026-109619) - Limited Impact to Coder

The Coder platform is not impacted by the critical PHP vulnerabilities dubbed “PHP2Shell” (CVE-2026-109618, CVE-2026-109619). We assessed all Coder-published artifacts and our own environment.

The only affected Coder artifact is our published universal workspace image, and default use is not exploitable: no PHP web server is configured or started, so the issue only applies if a user or agent runs PHP’s built-in server or CGI and exposes the port.

We merged a fix and got a release out on 10/26/2026. Coder doesn’t host customer deployments, so customer data and workloads don’t run in Coder-operated systems. Customers who use the universal image should update to the patched tag, and until then should avoid exposing PHP’s built-in server or CGI to untrusted networks.

Please reach out to security@coder.com with any questions.

Railway Security Incident - No Impact to Coder Products or Customer Data

We are aware of the recent security incident at Railway, a third-party hosting platform, in which an attacker accessed and decrypted some customers’ stored credentials.

Coder used Railway only for internal tools and test projects and one Coder template - but these were all unaffected by the env var compromise.

As a precaution, we rotated every credential stored there, took the affected services offline, and reviewed audit logs across our key systems, which showed no unusual activity. No customer action is needed.
Railway's disclosure: https://blog.railway.com/p/security-disclosure-wednesday-october-21st

Please reach out to security@coder.com with any questions.

As a follow-up to our earlier update on the August 31 registry.coder.com incident (advisory GHSA-vx42-ghc9-gw65), the independent incident response firm we engaged, Coalition Incident Response, has completed its review. Their investigation confirmed our findings regarding the scope of the incident and validated the response actions we took.

As committed, we have prepared a report summarizing the incident, the independent review, and the changes we are making as a result, along with the executive summary of the firm's findings. The report will be available beginning tomorrow, September 30.

The trust our customers place in Coder is our most valuable asset. We remain committed to protecting it through the security of our platform and through transparency with you about how we operate.

On August 31, an unauthorized party used a compromised Cloudflare API key to change the DNS records for registry.coder.com and direct it to infrastructure they controlled. Terraform module versions served from that infrastructure had been modified to steal cloud credentials. Following discovery, we removed the malicious DNS changes, notified customers, and published the details in advisory GHSA-vx42-ghc9-gw65.

We have now engaged an independent incident response firm to review how we handled the incident, including how quickly we detected it, whether our containment was adequate, if there are any remaining issues to be remediated. We will share a summary of their findings and the changes we make as a result, and we will commit to a date for providing this information once their work is far enough along to support one.

The trust our customers place in Coder is our most valuable asset. We remain committed to protecting it through the security of our platform and through transparency with you about how we operate.

As part of our commitment to ensuring the highest level of security, service availability, and data protection, MJD Advisors performs an annual SOC 2 Type 2 audit of the Coder platform and environment.

On September 21st, 2026, Coder received the final SOC 2 Type 2 report from the audit firm.

The report is available in the Documents center of the Trust Center.