From the source
Replit says it is patching infrastructure, updating language tooling and blocking exploits for third-party vulnerabilities disclosed this week that affect software much of the internet depends on.
- The company says it manages the environment customer apps run in, so many protections are applied without users doing anything, and it is notifying customers directly when an app needs republishing.
- Replit removed a compromised certificate authority from its base images and automatically applied the fix to 95% of published apps, including Node.js's use of the CA, and patched its Python tooling.
- For Node.js and PHP vulnerabilities that could allow remote code execution, Replit deployed web application firewall protections and made patched runtimes available, but recommends republishing apps to use them.
- A supply chain attack on the open-source Python library LiteLLM was blocked by Replit's existing Socket Firewall, and the company says its microVM architecture prevented exploitation of Linux kernel vulnerabilities by construction.
- Replit says it will upgrade to the latest kernel version once available and share more about those architectural protections in an upcoming whitepaper.
