We don't use PHP
Summary
- Published
- Collected
📦 Full-Text Content Snapshot
R2 Archive · Full Article PreservedPublished on: 2026-10-27 · Source: metabase.com
Oct 27, 2026 in Engineering
‧
1 min read
We don't use PHP
‧ Oct 27, 2026 in Engineering
‧ 1 min read
The recent run of security disclosures doesn’t impact Metabase. We don’t use PHP, we’ve already removed the compromised eMudhra certificate authority, and none of the affected npm packages are in our dependencies.
In May, we wrote about the strip-mining era of open source security. We anticipated that things would get worse, and we improved our internal security practices, policies, and scanning accordingly.
No exposure to PHP
We don’t use PHP in any part of our stack, so the PHP vulnerabilities don’t affect us. No action is required on your part.
eMudhra intermediate certificate compromise
In response to the eMudhra certificate issue, we released an update that removes the emSign ECC Root CA (operated by eMudhra) from the list of trusted certificate authorities. This change is available in Metabase versions 64.3.4, 63.21.1, and 58.37.1.
If you’re using Metabase Cloud, your instance has already been updated to the latest version. If you’re self-hosted, upgrade to one of those versions as soon as possible.
We’re monitoring our dependencies
We continue to carefully monitor our Node.js and Java dependencies. If you are a self-hosted Pro or Enterprise customer, we will notify you through the Security Center about any vulnerabilities we find. Open-source and air-gapped users can follow our blog for security updates.
What you can do
- Self-host if you want control: you can run Metabase on your own servers. You can air-gap it too, so it has no path to the public internet.
- Keep Metabase up to date: If you self-host Metabase, upgrade when we ship security fixes. If you’re a Metabase Cloud customer, we’ll keep your instances up to date and secure.
- Lock down your instance: follow our best practices to secure your self-hosted Metabase instance.
- Stay in the loop: Follow our blog for security updates and best practices.
You might also enjoy
Oct 21, 2026 in Engineering
Making pivot tables faster with GROUPING SETS
Pivot tables used to require many queries and a lot of glue code to keep the totals consistent. Using SQL GROUPING SETS, we are now able to query the database for the whole pivot table at once.
‧ 10 min read
[](https://www.metabase.com/blog/faster-pivot-tables-with-grouping-sets)
Oct 12, 2026 in Engineering
More, Better, Faster: How we automate Metabase releases
How we went from a manual Metabase release checklist to fully automated daily patch releases with GitHub Actions, reused test builds, and a three-click release UI
‧ 4 min read
[](https://www.metabase.com/blog/how-we-automate-metabase-releases)
📦 Full-Text Markdown Snapshot archived by Phying News · Original source: metabase.com
--- id: 10382 title: "We don't use PHP" cve: null cvss: null severity: "unknown" vendor: null product: null affected_versions: null source_domain: "metabase.com" source_url: "https://www.metabase.com/blog/metabase-doesnt-use-php" published_at: "2026-10-27T00:00:00Z" snapshot_at: "2026-10-28T23:54:32Z" archived_by: "Phying News (https://phying.com/item/10382)" lang: en --- # We don't use PHP *Published on: 2026-10-27 · Source: [metabase.com](https://www.metabase.com/blog/metabase-doesnt-use-php)* [ All posts ](https://www.metabase.com/blog) Oct 27, 2026 in **Engineering** ‧ 1 min read # We don't use PHP  ##### [ Vamsi Peri ](https://www.metabase.com/blog/authors/vamsi-peri) ‧ Oct 27, 2026 in **Engineering** ‧ 1 min read  ##### Share this article [ ](https://twitter.com/intent/tweet?url=https://metabase.com/blog/metabase-doesnt-use-php) [ ](https://www.linkedin.com/sharing/share-offsite/?url=https://metabase.com/blog/metabase-doesnt-use-php) Copied to clipboard The recent run of security disclosures doesn’t impact Metabase. We don’t use PHP, we’ve already removed the compromised eMudhra certificate authority, and none of the affected npm packages are in our dependencies. In May, we wrote about [the strip-mining era of open source security](https://www.metabase.com/blog/strip-mining-era-of-open-source-security). We anticipated that things would get worse, and we improved our internal security practices, policies, and scanning accordingly. ## No exposure to PHP We don’t use PHP in any part of our stack, so the PHP vulnerabilities don’t affect us. No action is required on your part. ## eMudhra intermediate certificate compromise In response to the eMudhra certificate issue, we [released an update](https://github.com/metabase/metabase/pull/85066/) that removes the emSign ECC Root CA (operated by eMudhra) from the list of trusted certificate authorities. This change is available in Metabase versions 64.3.4, 63.21.1, and 58.37.1. If you’re using [Metabase Cloud](https://www.metabase.com/cloud), your instance has already been updated to the latest version. If you’re self-hosted, [upgrade](https://www.metabase.com/docs/latest/installation-and-operation/upgrading-metabase) to one of those versions as soon as possible. ## We’re monitoring our dependencies We continue to carefully monitor our Node.js and Java dependencies. If you are a self-hosted Pro or Enterprise customer, we will notify you through the [Security Center](https://www.metabase.com/docs/latest/installation-and-operation/security-center) about any vulnerabilities we find. Open-source and air-gapped users can follow our [blog](https://www.metabase.com/blog) for security updates. ## What you can do * Self-host if you want control: you can run Metabase on your own servers. You can [air-gap it too](https://www.metabase.com/product/air-gapping), so it has no path to the public internet. * Keep Metabase up to date: If you self-host Metabase, upgrade when we ship security fixes. If you’re a Metabase Cloud customer, we’ll keep your instances up to date and secure. * Lock down your instance: follow [our best practices](https://www.metabase.com/docs/latest/installation-and-operation/security-best-practices-self-hosting) to secure your self-hosted Metabase instance. * Stay in the loop: [Follow our blog](https://www.metabase.com/blog) for security updates and best practices. ### You might also enjoy [ All posts ](https://www.metabase.com/blog)  Oct 21, 2026 in **Engineering** #### Making pivot tables faster with GROUPING SETS Pivot tables used to require many queries and a lot of glue code to keep the totals consistent. Using SQL GROUPING SETS, we are now able to query the database for the whole pivot table at once.  ##### Tamás Benkő ‧ 10 min read [](https://www.metabase.com/blog/faster-pivot-tables-with-grouping-sets)  Oct 12, 2026 in **Engineering** #### More, Better, Faster: How we automate Metabase releases How we went from a manual Metabase release checklist to fully automated daily patch releases with GitHub Actions, reused test builds, and a three-click release UI  ##### Ryan Laurie ‧ 4 min read [](https://www.metabase.com/blog/how-we-automate-metabase-releases) [ All posts ](https://www.metabase.com/blog) ###### Subscribe to newsletter ##### Updates and news from Metabase  --- > 📦 **Full-Text Markdown Snapshot** archived by [Phying News](https://phying.com/item/10382) · Original source: [metabase.com](https://www.metabase.com/blog/metabase-doesnt-use-php)