Two serious security issues have required urgent attention this week: critical vulnerabilities in PHP and the compromise of certificates issued by eMudhra.
We have contacted our clients to explain the risks and our response. For the systems we manage, we are treating the necessary updates as urgent, rather than waiting for scheduled maintenance windows.
PHP security fixes were released on Wednesday 21 October. Action to address the certificate compromise is also under way across browser vendors and software suppliers, although protecting browsers alone does not cover every affected application.
PHP Patches Are Now Available
PHP powers many websites and business applications. Two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, can allow an attacker to run code on an affected system without logging in.
Following a leak ahead of the planned disclosure, the PHP project released emergency fixes on 21 October: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. It advises all installations serving web requests to update immediately. Temporary workarounds can reduce some exposure, but do not provide complete protection. PHP security advisory
Linux suppliers are also distributing patched packages. Ubuntu, for example, has confirmed fixes for its supported releases, including backported fixes for older PHP versions. These packages can retain an older version number while incorporating the security correction, so the relevant supplier advisory matters when checking whether a system is protected. Ubuntu’s update
We have identified the systems running PHP within our managed client estate and advised our clients that we will apply the appropriate fixed packages as suppliers make them available, rather than waiting for scheduled maintenance windows. Our response also includes reviewing logs on internet-facing systems for signs of attack.
Some updates require services to restart and may cause brief interruptions.
The Certificate Issue Extends Beyond Web Browsers
SSL/TLS certificates help software establish that it is connecting to the genuine website or service. Weakly generated private keys associated with eight eMudhra issuing certificates could allow attackers to forge certificates that vulnerable software would trust.
Google has blocked the compromised keys in Chrome. It has also announced wider removal of the associated emSign ECC Root CA – G3 from the Chrome Root Store, with general release expected on 27 October. Legitimate services using certificates linked to that root may need replacement certificates to avoid connection failures. Google’s security update
The concern extends to applications and services making encrypted connections in the background. Their protection depends on the certificate lists and validation mechanisms they actually use.
For our clients’ managed systems, our response includes updating the operating system’s trusted certificate lists and removing trust in the affected certificates directly where supplier updates are not yet available.
Applications and containers can carry their own certificate lists. Updating the host operating system will not necessarily update those copies. We have therefore highlighted this distinction to our clients: applications outside our management scope may need attention from their developers or software suppliers.
Clear Communication Alongside Urgent Action
When issues like these emerge, clients need to understand whether their systems are affected, what action is required and who is responsible for taking it.
Our role is to make those decisions clear and handle the work within the systems we manage. That includes explaining potential service interruptions and identifying where an application needs separate attention.
We will contact our clients directly where further decisions or action are needed. Anyone with questions about their Linux systems can contact our team at support@tiger-computing.co.uk. We can explain the practical implications and go into the technical detail where it helps.
