Oct 26, 2026
0 new incidents, 2 with updates.
Updated
- LiveCriticalPartly patched
eMudhra intermediate CA private keys compromised
Eight eMudhra Global TLS intermediate CA private keys were found to be cryptographically weak / recoverable (researcher report Oct 18). Mozilla, Chrome, Apple and Microsoft blocked the intermediates; eMudhra revoked them Oct 19 and the ECC root was distrusted as a precaution. Downstream runtimes that ship their own trust stores (Go, Node.js, Electron, Python certifi, curl, etc.) needed emergency CA-bundle updates so they stop trusting the compromised chains.
eMudhra / emSign Global TLS intermediates; any client shipping Mozilla-style CA storesSince Oct 18, 2026
- LiveCriticalPartly patched
PHP2Shell: critical unauthenticated RCE in PHP core
Two critical remote-code-execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619, aka “PHP2Shell”) were disclosed early after an embargo leak. Both score CVSS 9.2 and can let an unauthenticated attacker run code on servers serving PHP web requests, especially Apache mod_php. Patches shipped Oct 21 2026 (QNAP shipped NAS firmware fixes Oct 24; other appliance vendors are still preparing fixes); exploitation attempts were observed before and after the patch, and watchTowr / AWS report active scanning.
PHPSince Oct 17, 2026
