Trust Center

We are aware of the recently reported security incident disclosed by Fireworks.ai. Fivetran + dbt’s platform remains secure and unaffected by this incident.

Out of an abundance of caution, we encourage customers using the Fivetran Fireworks connector to review the Fireworks.ai Security Bulletin and follow their recommended steps regarding credential rotation.

Quick Reminder to Fivetran Fireworks.ai Connector users: If you have rotated your Fireworks.ai API key, please remember to update your credentials in your Fivetran connector settings to ensure your syncs run without interruption.

We continue to assess new details as they emerge to ensure the ongoing security of our platform.

If you have any questions or concerns, please reach out to our support team.

Our review to date has found no evidence of active exploitation affecting Fivetran Hybrid Deployment. As a precaution, we are applying the industry-wide certificate and library updates released in response to this vulnerability report. 
 
Here is our current status:

• Hybrid Deployment Agent: Updated.
• Connection Setup tests and schema loading: Updated.
• Data Syncs: Update underway.
• Connector SDK: Update underway.

 
With Fivetran's default settings, these updates are applied automatically. If you manage container images yourself, please update to the latest images. 
 
Teams across Fivetran + dbt continue to monitor our services and roll out these updates. We will keep customers updated through our Trust Center. If you have any questions, please contact Fivetran Support.

Our security review has found no evidence of active exploitation affecting HVR. As a precaution, we are applying the industry-wide certificate and library updates released in response to this vulnerability report.

The following updates are available or planned:

• HVR: Updated releases are available now: 6.3.5_9, 6.3.0_21, and 6.2.0_52 (and later). We recommend upgrading to the latest release for your version. If you use your own ca-bundle.crt file, please update it as well.
• Fivetran Proxy Agent included with HVR: There are two ways to update its Java runtime:
  • Upcoming HVR release: Upgrade when the release becomes available to receive the updated Java runtime.
  • Azul update: Follow Azul’s guidance to update the Java runtime in your HVR installation’s jre folder.

We also recommend keeping your operating system, Java, and database drivers up to date.

Teams across Fivetran + dbt continue to monitor our services and apply these updates. We’ll share further updates through our Trust Center.

If you have questions or need help, please contact Fivetran Support.

Our security review so far has found no evidence of active exploitation affecting Fivetran or dbt Labs systems.

Fixes for the majority of our core systems are now underway, with each fix at one of the following stages:

• Live in production
• Completing testing in staging
• Final checks before moving to staging

Teams across Fivetran + dbt continue to monitor our services, and make progress on remediation. We will keep Fivetran + dbt customers updated through our Trust Center.

Our security review to date has found no evidence of active exploitation on Fivetran + dbt systems. Our response is ongoing. Teams across Fivetran + dbt continue to assess the impact, monitor our services, and make progress on remediation. We will keep Fivetran + dbt customers updated through our Trust Center.

To date, we have not identified any exposure or impact to our customers or systems from this vulnerability. As a proactive measure, we are actively patching our infrastructure to ensure our environments remain secure.

We remain vigilant and are closely following any emerging details. We will share any future updates directly here in the Trust Center.

On October 21, 2026, details of a high-severity vulnerability in the Node.js runtime, CVE-2026-111497 (known as "Node2Shell"), were made public. Attackers could use this flaw to run code on a server running a vulnerable version of Node.js when that server decompresses Brotli data sent by the attacker.

Our response is ongoing. Teams across Fivetran + dbt continue to assess the impact, monitor our services, and make progress on further remediation. We will keep Fivetran + dbt customers updated through our Trust Center.

Fivetran and dbt have concluded PHP2Shell investigation and patching. We found no evidence of impact to any customers or Fivetran + dbt systems; No customer action is required.

On October 20, 2026, details of two critical vulnerabilities in the PHP language runtime, CVE-2026-109618 and CVE-2026-109619 (known as "PHP2Shell"), were made public ahead of the planned disclosure. Attackers could use these flaws to run code on any web server running a vulnerable version of PHP without logging in.

We immediately reviewed Fivetran services and infrastructure. The Fivetran platform and customer data pipelines do not run PHP and are not affected. Two legacy HVR support systems had an affected PHP version installed. We have fixed PHP on both systems. We have found no evidence of impact to any customers at this time. No action is required by customers.

We continue to monitor PHP2Shell. We have found no evidence of impact to any customers or Fivetran + dbt systems at this time.