Date: October 21, 2026

This post covers three recent security issues that affect widely used web technologies. These are important to address, but they are also manageable. Our development and operations teams are actively working right now to patch and update all customer instances across our networks. Most customers will not need to take any action themselves.

PHP Critical Vulnerabilities (CVE-2026-109618 and CVE-2026-109619)

Two critical vulnerabilities were disclosed in the PHP runtime. In certain conditions they can allow an unauthenticated attacker to execute code on a server running affected versions of PHP. These issues (collectively discussed as “php2shell”) affect a very wide range of PHP versions, including those that power many websites and applications.

What you should know
Patches are available for supported PHP versions (8.5.12, 8.4.27, 8.3.36, and 8.2.35). Older, unsupported versions do not receive official fixes from the PHP project. The safest course is always to update.

Mitigation & more information

• Official PHP security advisory and update instructions: php.net news archive
• Download fixed versions: php.net/downloads
• Interim risk-reduction steps (if you cannot update immediately) are described in the official advisory (e.g., certain php.ini settings). These are not complete fixes.

Node.js Security Releases (October 21, 2026)

Node.js released security updates today for the supported 22.x, 24.x, and 26.x lines. These address several high-severity issues, including a Brotli decoder problem that could permit remote code execution, TLS hostname validation bypasses, and an update to the bundled certificate store that blocks the compromised eMudhra intermediate certificates described below.

What you should know
The highest severity issues fixed are rated High. End-of-life Node.js versions are not patched and remain affected. Updating to the new releases is the recommended path.

Mitigation & more information

• Official Node.js security release announcement: nodejs.org October 21, 2026 Security Releases
• Updated versions include approximately 22.23.4, 24.22.1, and 26.12.1 (check the release notes for exact builds and changelog details).

eMudhra Intermediate Certificate Authority Key Issue

Eight intermediate certificate authority certificates issued by the Indian company eMudhra (emSign brand) were found to have very weak private keys. This could theoretically allow an attacker to create fraudulent TLS certificates and impersonate websites or intercept encrypted traffic. The issue stems from a key-generation process error in April 2025.

What you should know
Major browsers (Chrome, Firefox, and others) and many software projects have already blocked the affected certificates. eMudhra states that the intermediates had not issued end-entity certificates, their root private keys were not affected, and their Indian digital signature / eSign services are unaffected. There is currently no public evidence of malicious use of the weak keys. The practical risk is highest for software and systems that have not yet received trust-store updates.

Mitigation & more information

• eMudhra official statement: emudhra.com certificate security incident
• Update browsers, operating systems, and certificate trust stores. Node.js and other runtimes that bundle their own root stores have issued or are issuing updates (see the Node.js release above).
• Avoid bypassing certificate warnings.

What we’re doing 

Our teams are working right now to apply the relevant PHP, Node.js, and certificate/trust-store updates across all customer instances we host. We will continue monitoring and will share any further updates if needed.

What customers should do

• If your sites and applications are hosted with us, you generally do not need to take any action. We are handling the updates.
• If you manage your own servers, containers, or self-hosted environments that use PHP or Node.js, please apply the patches linked above as soon as practical.
• Keep browsers and operating systems updated as usual.
• If you have specific questions about your account or need help, please contact your account manager or support.

We take these issues seriously and are prioritizing them so your services remain protected. Thank you for your continued trust.