October 2026 saw a cluster of serious cybersecurity incidents in just a few days. From a certificate authority compromise at eMudhra to critical remote code execution flaws in PHP, Node.js and Next.js, the events highlight how interconnected and fragile the software supply chain has become. Here is what happened, what it means, and what to do.
1. eMudhra: Eight Intermediate CA Private Keys Compromised
When: Disclosed October 17, 2026. Public impact October 20–22.
What happened: Security researcher Wayne disclosed that the private keys for eight intermediate certificate authorities operated by eMudhra (under the emSign brand) had been compromised. The researcher proved possession by signing a message with each key.
The affected keys came from a batch of 24 intermediates generated on 30 April 2025. All eight were weak enough to be recovered in under a second. Google, Apple, Microsoft and Mozilla quickly pushed emergency blocklists to distrust the affected certificates.
Impact: An attacker with these keys could issue fraudulent TLS certificates for any domain, enabling impersonation and interception of encrypted traffic. However, eMudhra stated the weak keys were never put to commercial use and no customer certificates were issued with them. The Indian IT Ministry said the impact on Indian sites was “very limited.”
What to do: Update your browser and operating system to receive the certificate blocklists. For Go applications, upgrade to Go 1.27.3 or 1.26.10 (CVE-2026-111943) which hardcode distrust of the eight intermediates.
2. PHP2Shell: Two Critical RCE Flaws in the PHP Runtime
CVE IDs: CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2).
What happened: PHP released emergency patches on 21 October for two critical remote code execution vulnerabilities in the PHP runtime itself. The flaws affect nearly every PHP version back to 5.4. An attacker without an account can execute code on the server.
Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35.
Impact: Because the flaws are in the runtime, a site is exposed even if its own application code is secure. Exploit attempts were observed in the wild within hours of disclosure.
What to do: Upgrade PHP immediately. WAF rules (such as Vercel’s) can block known exploit patterns but are not a substitute for patching. If you cannot patch immediately, take the site offline.
3. Node.js: Brotli Decoder Out-of-Bounds Write (CVE-2026-111497)
Severity: High.
What happened: Node.js released security updates on 21 October for all three supported release lines (22.x, 24.x, 26.x), fixing 10 flaws. The most severe is a Brotli decoder out-of-bounds write that permits remote code execution.
Affected: Node.js 22.x, 24.x, 26.x.
Fixed versions: 22.23.4, 24.22.1, 26.12.1.
Impact: Your application is exposed when it decompresses Brotli data an attacker controls, whether in a request body or a fetched response. Researchers demonstrated memory disclosure and command execution.
What to do: Upgrade Node.js immediately. Note that Node.js 20.x reached end of life and will not receive this fix — migrate to 22.x or 24.x. If you run on Vercel, ensure your project uses Node.js 22.x or 24.x and redeploy.
4. Next.js: Image Optimization RCE via SVG (CVE-2026-96889)
Severity: Critical (CVSS 9.5).
What happened: A memory-related vulnerability in an upstream library used for Image Optimization (sharp) can lead to remote code execution when Next.js runs on glibc-based Linux and processes SVG images.
Affected versions: Next.js 10.0.0–15.5.27 and 16.0.0–16.4.0.
Patched versions: 15.5.28 and 16.4.1.
Workaround: Ensure the sharp version used by Next.js is 0.35.5 or later.
What to do: Upgrade Next.js to the patched versions. Fresh installs automatically get a fixed sharp. If you cannot upgrade immediately, disable SVG processing in Image Optimization.
5. Supply-Chain Note: LiteLLM Compromise
A compromised release of the LiteLLM Python package was published to PyPI, affecting users who installed the malicious version. This is a reminder to pin dependencies, use lockfiles, and verify package integrity.
Summary of Actions
| Component | Action | Urgency |
|---|---|---|
| Browser / OS | Update for eMudhra certificate blocklists | High |
| PHP | Upgrade to 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 | Critical |
| Node.js | Upgrade to 22.23.4 / 24.22.1 / 26.12.1 | High |
| Next.js | Upgrade to 15.5.28 / 16.4.1 | Critical |
| Go | Upgrade to 1.27.3 / 1.26.10 | High (if using Go TLS) |
Frequently asked questions
Was my website affected by the eMudhra breach?
If your TLS certificate was issued by eMudhra’s affected intermediates, browsers now distrust it. Check your certificate issuer and reissue from a different CA if needed. Most Indian sites were not affected, per the IT Ministry.
Do I need to update PHP if I use a WAF?
Yes. WAF rules block known exploit patterns but cannot cover all variations. The only complete fix is upgrading PHP.
Is Node.js 20.x still safe to use?
No. Node.js 20 reached end of life and will not receive the CVE-2026-111497 fix. Migrate to 22.x (LTS) or 24.x (LTS).
How do I know if my Next.js app uses a vulnerable sharp version?
Run npm list sharp in your project. If the version is below 0.35.5, upgrade Next.js to 15.5.28 or 16.4.1, which will pull in a fixed sharp.
