Security - Trust Center
Welcome to Criteo's Trust Center. Our commitment to security and data protection is embedded in every part of our business. Use this Trust Center to learn about our security posture and request access to our security documentation.
Security - Trust Center Updates
PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)
All external and internal applications hosted by Criteo are secure from cyber-attacks based on PHP vulnerabilities. The external applications not hosted by Criteo have been upgraded or have had security measures added.
Please be assured that nothing coming from Criteo can endanger the security of your business.
If you have not done so already, please review and update your own tech stack to ensure you are not vulnerable to attack.
Security bulletin - Communication for Node.js
Criteo’s Security Team is coordinating assessment and remediation across applications and internal systems. Software updates have been deployed, with remaining application upgrades being tracked with the responsible engineering teams. To date, we have detected no evidence of compromise resulting from these vulnerabilities.
Criteo manages runtime remediation for services it operates. If you operate your own Node.js environment, upgrade to a supported, patched release: at least 22.23.4 on the 22.x line, 24.22.1 on 24.x, or 26.12.1 on 26.x, or install your vendor’s verified security update. Updating an application library alone does not replace updating the Node.js runtime.