We wanted to share our perspective on recent, highly critical security vulnerabilities involving PHP and Node.js.
If your files are hosted on our servers we have already taken care of any needed mitigation.
If you manage your own servers or web services, there is a slight chance these issues could affect an older, self-hosted FileMaker server. Claris has not included PHP with FileMaker Server for quite some time, and most setups have moved past it. However, you shouldn’t take these vulnerabilities lightly. Check with your IT team or hosting provider, don’t just update on your own.
There are two areas of concern:
(1) PHP
If you have a PHP website (WordPress, for example):
If you are running standard PHP websites on your servers, make sure you or your IT team apply the latest patches immediately. If you use WordPress as a service from WordPress.com (as we do), you are covered, as they have already updated. PHP 8.1 and older need an OS vendor patch or an upgrade.
If you still have PHP running in FileMaker Server:
Few people use this feature these days. If you still have it running on an older server, it needs to be updated or disabled. Claris last bundled PHP with v19.3.3 (Macintosh) and v 19.1.2 (Windows), though upgrades did not necessarily remove earlier copies of PHP. Linux servers did not bundle PHP.Â
(2) Node.js
You are exposed to the Node.js vulnerability:
Node.js is often used in the background, and you might not realize it’s running. If you are hosting with older versions of FileMaker Server (v17-v20), there is a slight chance Node.js is running alongside that, under the radar. The risk is still present if you’re using a newer version, so be sure you’ve updated to the latest patch. Also check to see if you have an independently installed Node.js runtime running on your machine. That should be patched as well.
Here are some helpful resources:
- NSA Advisory on PHP Vulnerabilities
- PHP Security advisory: Critical remote code execution vulnerabilities, update now
- Node.js – October 21, 2026 Security Releases
- Claris PHP security considerations
We are keeping a close eye on things on our end. If you have any questions or want us to help double-check your current server setup, just let us know!