Branch | Trust Center

We are aware of the eMudhra Certificate Authority key-generation incident tracked as CVE-2026-111943 and the Node.js Brotli decoder vulnerability known as Node2Shell (CVE-2026-111497), both disclosed in October 2026. We completed a full impact assessment and confirmed these issues do not affect Branch’s product systems or systems that process, store, or handle customer data.

Branch does not rely on eMudhra-issued certificates for any production services or systems that handle customer data. Our TLS certificates and trust stores are sourced from established, widely trusted certificate authorities and are continuously validated. In addition, Branch does not run vulnerable Node.js runtimes in any product systems or systems that process customer data in a manner that would expose them to Node2Shell.

No customer action is required.

Protecting the confidentiality, integrity, and availability of customer data is a core priority. We continuously monitor the threat landscape, assess emerging vulnerabilities, and maintain layered controls designed to reduce risk across our environment. We will continue monitoring this situation and will provide further updates if needed.

If you have questions, please contact your Branch account team or our security team at security@branch.io.

Branch Security Team
October 26, 2026

We are aware of the critical PHP remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) disclosed on October 21, 2026. We completed a full impact assessment and confirmed these issues do not affect Branch.

Branch does not run PHP, PHP-FPM, or any PHP-based web interfaces or APIs in product systems or systems that process, store, or handle customer data. Our production platforms and customer-facing services are built on modern technology stacks that do not rely on PHP.

No customer action is required.

Protecting the confidentiality, integrity, and availability of customer data is a core priority. We continuously monitor the threat landscape, assess emerging vulnerabilities, and maintain layered controls designed to reduce risk across our environment. We will continue monitoring this situation and will provide further updates if needed.

If you have questions, please contact your Branch account team or our security team at security@branch.io.

Branch Security Team
October 22, 2026