[Weekly Security Update Roundup] PHP, Certificate Stores (eMudhra), Node.js, Chrome and Java All Patched in One Week (19-23 Oct) — Priorities and a Checklist

This week (19-23 October) brought several large updates to foundational software at once. If you run servers or websites, check (1) PHP (two unauthenticated remote code execution flaws), (2) the certificate stores (eMudhra's intermediate CA keys turned out to be forgeable) and (3) Node.js (ten fixes) first. On personal PCs and phones, it is (4) Chrome 156 and (5) Java. The three already-exploited issues, Fortinet, SiteGuard and BeyondTrust, come first of all if you have not patched them.

The scope of this article. It is a selection by this site of the updates published this week that matter most to running websites and servers, not a complete list. The priority order is our own. The facts for each item (versions, dates, numbers) come from official announcements I opened, and what I could not confirm is collected at the end.

This week at a glance

1. PHP: two unauthenticated remote code execution flaws (IPA calls them "PHP2shell")

• ▸What: CVE-2026-109618 (from out-of-memory handling) and CVE-2026-109619 (from stale state kept after a request). The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP team says Apache mod_php is at highest risk and that an attack can succeed before any application code runs
• ▸Scores: the CNA, the PHP Group, rates both CVSS v4.0 9.2. As of 09:59 UTC on 23 October 2026, NVD (NIST) shows CVSS v3.1 9.8 (CRITICAL) for CVE-2026-109618 and 8.1 (HIGH) for CVE-2026-109619. Our article of the evening of 21 October was written when NVD had no record; it has been added since
• ▸Exploitation: the PHP team says a working exploit was demonstrated but does not report exploitation in the wild. CISA's assessment recorded in NVD (SSVC) says exploitation "none" (as of 23 October 2026)
• ▸IPA: it asked for preparation on 21 October and published an advisory on 22 October. IPA says that, according to Wiz, who worked on the research, every PHP version from 5.4 on is affected by at least one of the two flaws. 8.1 and older will not get fixes, so it says to consider updating, migrating or even taking the site down
• ▸What to do: check your PHP version, update to a fixed one and restart every worker. The details are in our earlier article (see "Pages we relied on")

2. Certificates: eight eMudhra intermediate CA keys were weak and could be used to forge certificates

• ▸What happened: on 17 October a researcher reported that the private keys of eight eMudhra subordinate CA (intermediate) certificates had been generated with insufficient randomness (Google). Anyone could recover them and forge HTTPS certificates. Chrome received the report at 18:05 UTC and blocked them with a CRLSet update at 19:45 UTC, with no browser update or restart needed (Google)
• ▸Firefox: it received the report at 20:06 UTC and finished distributing the block to all standard-configuration users through OneCRL within three hours (22:59 UTC). For the minority whose settings prevented that, it released Firefox 158.0.1, ESR 115.43.1 and ESR 153.5.1, and on 21 October 158.0.2 for Android. NSS 3.131.1 also removes the root that signed the intermediates (Mozilla)
• ▸Microsoft blocked them on 20 October and Apple on 22 October, according to the checker site built by Mozilla engineers
• ▸Forged certificates probably could not be used against browsers: Google says that, for the six TLS intermediate CAs, no TLS certificate chaining to them had been logged to Certificate Transparency (CT) before it blocked them, so none could have been used against CT-enforcing clients such as Chrome. The checker site likewise says the CT logs hold no entries for the eight intermediates in that period. But software that does not check CT, such as curl, could have been attacked unnoticed, the checker site says
• ▸Non-browser software is where the work is: software with its own trust store stays unchanged until updated. Updates listed as available include Go 1.27.3 and 1.26.10 (CVE-2026-111943), Node.js 26.12.1, 24.22.1 and 22.23.4, Python 3.15.1, 3.14.9 and 3.13.17 with certifi 2026.10.19, curl's CA bundle (2026-10-20), and `ca-certificates` for Ubuntu, Debian, RHEL, Fedora and others (the checker site's list is community-maintained and may miss updates). Cloudflare updated WARP and cloudflared (2026.10.2) among others
• ▸Chrome will remove the root "emSign ECC Root CA - G3" from its root store on the morning of 27 October (Pacific time). Google says sites using certificates from that hierarchy must move to a certificate from another hierarchy now. Chrome is also examining whether eMudhra's other CAs should stay in the store
• ▸eMudhra's account: a flaw in one step of the key generation ceremony produced weak keys that were registered; all eight were revoked; no certificate was ever issued from them; the impact is limited to one customer ecosystem in the United States; the root cause is under investigation. Cloudflare says it found no sign of exploitation on its services
• ▸What to do: update your browsers and OS (checker site's advice). On servers, check that the language, library or container trust stores have been updated; some need a restart or redeploy. Cloudflare says "do not resolve certificate errors by disabling verification"

3. Node.js: the 21 October security release (ten fixes)

• ▸Fixed versions: Node.js 22.23.4, 24.22.1 and 26.12.1. The project notes that end-of-life versions are always affected by a security release
• ▸Four rated high: CVE-2026-111497 (a Brotli decoder out-of-bounds write that can lead to remote code execution; 22, 24 and 26), CVE-2026-105483 (TLS certificate hostname check bypassed when an IP is written in fullwidth digits; 24 and 26), CVE-2026-106069 (bypass when a host loosely resolves to an IP address; 22, 24 and 26), CVE-2026-105482 (`dns.resolve` truncates names containing a NUL character; 22, 24 and 26)
• ▸Three rated medium: CVE-2026-105481 (a keep-alive socket processes a response written before the request was sent), CVE-2026-106072 (improper certificate validation for non-canonical IPv4 hostnames lets DNS names authenticate IP endpoints), CVE-2026-106074 (`crypto.randomUUID()` and `randomInt()` entropy caches are saved into startup snapshots, so every process repeats the same values). The three rated low concern ZIP and the Permission Model
• ▸Reading the Brotli item: per NVD, CVE-2026-111497 is a flaw in the decoder of Google Brotli 1.0.3 to 1.2.0, and the CNA, Google, rates it CVSS v4.0 9.2 (NVD analysis pending). Software using Brotli on its own needs 1.0.10, 1.1.1 or 1.2.1. Node.js labels it "high", so the ratings differ
• ▸Dependency updates are included too: c-ares, the certificate list (the eMudhra change), OpenSSL, SQLite and Undici
• ▸Exploitation: the Node.js announcement does not say attacks were observed, and CISA's assessment recorded in NVD says exploitation "none" (for CVE-2026-111497)

4. Chrome 156: 353 security fixes (six critical)

• ▸Stable since 20 October: Chrome 156.0.8078.47 (Linux), 156.0.8078.47/.48 (Windows and Mac). It rolls out over days to weeks (Chrome Releases)
• ▸353 security fixes, six of them Critical: memory corruption in Skia, Accessibility, CSS, Paint and WebRTC, among others. This announcement does not say exploitation has been seen
• ▸What to do: update Chrome and restart it. You can do this from the browser's update check (our note)

5. Java: Oracle's October critical patch update

• ▸Oracle published 1,295 new security patches in October (Oracle Critical Patch Update, October 2026)
• ▸On 21 October IPA issued an advisory saying Oracle Java SE 27, 26.0.2, 25.0.4.1, 21.0.12.1, 17.0.20.1, 11.0.32.1, 8 Update 503 and 8 Update 503-perf are affected and asking for prompt updating
• ▸What to do: move to the latest release of the Java line you use. Commercial use requires checking the licence (IPA)

6. Three already-exploited issues we have covered

• ▸Fortinet (FortiOS and others), CVE-2025-61624: reported exploited to go from admin to root. Added to KEV on 16 October. Fixed versions include 7.6.5 and 7.4.10 or later
• ▸SiteGuard Server Edition, CVE-2026-106931: a Japanese WAF; the vendor confirmed exploitation. Added to KEV on 20 October. Save the "diagnostic information" before updating
• ▸BeyondTrust Remote Support, CVE-2026-102764: file operations without authentication, exploited since late August. Added to KEV on 16 October

How to prioritize (our view)

• ▸First: whether any of the three already-exploited issues (item 6) is in your environment. If so, update and check for compromise (save diagnostics, review logs)
• ▸Next: PHP on internet-facing servers. The PHP team says "immediately", and there are configurations where an attack succeeds without authentication. Exploitation is unconfirmed, but the release is fresh and a working exploit has been demonstrated
• ▸Then: language runtimes and containers that hold a trust store, and Node.js. These are updates that make your checks of outbound connections (API calls, webhooks, integrations) correct
• ▸Clients at hand: Chrome, Firefox and Java. Confirm automatic updates are working
• ▸If you cannot update yourself: read your hosting company's or managed service's notices; this is up to each provider

Checklist for this week

• ✓★Check your PHP version, update to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, and restart every worker. For 8.1 and older, use a vendor backport or move to a supported version
• ✓Check your Node.js version and update to 22.23.4 / 24.22.1 / 26.12.1. End-of-life versions cannot be fixed by updating, so move to a supported one
• ✓Check that the trust stores (ca-certificates and similar) of your OS, languages and containers have been updated. That includes Go 1.27.3 / 1.26.10, Python (certifi 2026.10.19 or later) and curl's CA bundle. Some need a restart or redeploy afterwards
• ✓Do not fix a certificate error by disabling verification. Find the cause (Cloudflare's advice)
• ✓Check whether you use certificates chaining to emSign ECC Root CA - G3. If so, move to another hierarchy before 27 October
• ✓Update Chrome, Firefox and Java. For Chrome, restart it
• ✓If any of Fortinet, SiteGuard or BeyondTrust is unpatched, handle it first and check for compromise
• ✓For environments you cannot update yourself, read your provider's notice

What I could not confirm

• ▸Whether PHP is exploited in the wild. There is no statement from PHP, and CISA's assessment recorded in NVD says "none", but that is not proof that there is none
• ▸Whether other weak keys made by the same process exist beyond eMudhra. Google says it confirmed that no other keys in its root store share this failure mode. I could not check other CAs
• ▸Verification of eMudhra's account. eMudhra says "no certificate was issued" and "one customer in the US", but that is the company's own account, not independently confirmed. What the browser vendors state is that eight keys were forgeable, that they were blocked, and that the root is being removed
• ▸The full picture of certificate updates. The checker site's list is community-maintained, and some updates are missing or not yet released. Check each product's official notice
• ▸NVD assessments for the Node.js CVEs. CVE-2026-111497 awaits analysis, and some of the other nine had no NVD record as of 23 October 2026
• ▸Details of Chrome 156's six critical bugs. Chrome restricts details until most users have updated
• ▸Other updates this week. This article covers only what I selected; it is not exhaustive

Three lines to share

• ▸Big updates landed together this week. First check PHP (8.5.12 / 8.4.27 / 8.3.36 / 8.2.35), Node.js (22.23.4 / 24.22.1 / 26.12.1) and the certificate lists of your OS, languages and containers.
• ▸★Eight eMudhra intermediate CA keys were found forgeable. Browsers are already protected, but software with its own trust store needs updating. Chrome removes emSign ECC Root CA - G3 on 27 October.
• ▸Fortinet, SiteGuard and BeyondTrust, already exploited, come first. If you cannot update yourself, read your hosting company's notice.

Pages we relied on