Bentley Systems Trust Portal | Trust Center

Summary

Bentley Information Security is aware of the two critical PHP vulnerabilities disclosed on 21 October 2026 (CVE-2026-109618 and CVE-2026-109619, widely nicknamed “PHP2Shell”) and the related advisories from the US National Security Agency and UK NCSC.

Current Status

Bentley has assessed its products, hosted services and corporate systems; and we have no evidence of compromise of any Bentley or User environment. In addition, Bentley continually monitors our environments for vulnerabilities and applies fixes as soon as possible and will continue to do so until all systems are remediated.

Recommended actions for Users

No action is required for Bentley-hosted services - Bentley will apply any necessary remediations on your behalf.
No Bentley on-premise products are affected.

For more information, please visit Bentley’s CVE (Common Vulnerability Exposure) Program.

Summary

Bentley Information Security is aware of the vulnerability: CVE-2026-111497.

This CVE stems from an out-of-bounds write in the Brotli decoder that is bundled with Node.js. An attacker can trigger the vulnerability by supplying specially crafted Brotli-compressed data to an application that decompresses untrusted input, potentially resulting in process-memory disclosure or arbitrary code execution with the privileges of the affected process. Researchers demonstrated successful exploitation against unpatched Node.js versions.

Exploitation requires an application or one of its dependencies to explicitly decompress attacker-controlled Brotli data, either from incoming requests or responses fetched from external servers. Node.js does not automatically decompress such data. The vulnerability also affects applications using vulnerable system-level Brotli libraries, independently of Node.js. For example, curl's --compressed option can trigger the vulnerable decoder when processing a malicious Brotli-compressed HTTP response, if curl is linked against an affected library. Updating Node.js alone does not remediate vulnerable system libraries or other downstream components.

Current Status:

Bentley Information Security continually monitors all cloud-based deployments for vulnerabilities and classifies those vulnerabilities based on actual threat to our systems and data. To date, we have classified this threat as medium due to compensating controls already in place. Medium vulnerabilities are typically mitigated in a maximum of 90 days. We will continue to monitor our systems and adjust our mitigation timelines accordingly if needed.

Recommended actions for Users:

No action is required for Bentley-hosted services - Bentley will apply any necessary remediations on your behalf. No Bentley on-premise products are affected.

For more information, please visit Bentley’s CVE (Common Vulnerability Exposure) Program.

As part of Bentley’s ongoing commitment of excellence to our users, we are pleased to announce the publication of our first Information Security Whitepaper. This Whitepaper serves as an overview of all things Bentley Infosec, showcasing a public view of our organization’s standards for transparency, trust, and information security.

This document provides an overview of the governance, controls, and processes that support the protection of Bentley's information systems and data. You can find the full Bentley Information Security Whitepaper by registering on the Bentley Trust Portal.

As part of our Security and Trust programs at Bentley, our Trust Portal contains more granular Q&As for topics such as incident management, governance risk and compliance (GRC), artificial intelligence (AI), cloud security, application security, vulnerability management, and more.

As cybersecurity challenges continue to evolve, organizational and operational success depends on strong coordination across disciplines. In an era of increasingly connected infrastructure and the rise of digital twins, advanced technologies like AI and machine learning empower us to enhance the design, construction, and operation of critical assets in ways previously unimaginable.

Our mission is to ensure Bentley remains secure, resilient, and adaptive to this evolution.

We achieve this by embedding security and resilience not just into our corporate environment, but into the very fabric of our software and services. This ensures that we protect our users' critical project data and earn their trust at every stage of the infrastructure lifecycle.

Questions about Bentley Systems Information Security? Use the link below to schedule time with our CISO!
CISO Office Hours