Whew! Some weeks bring big problems. This one brought a few. Two critical PHP flaws leaked before fixes shipped, and the same day Mozilla disclosed that eight eMudhra certificate authority keys were weak enough to recover. One is a patching race. The other is a trust problem that will take months to close.
Our threat research team published technical guidance on both: PHP flaws and eMudhra keys. This post is for the person who has to answer the CEO, the board, or the audit committee.
PHP: identify, shield, then fix
- The risk: CVE-2026-109618 and CVE-2026-109619 are rated 9.2 on CVSS v4.0 and can let an attacker run code without logging in. Mirai has added them to its scanning, and reports put potentially vulnerable installations at 22.6 million.
- The fix: PHP released patches on October 21 in versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. No successful attacks have been independently confirmed yet.
- Why it isn't patched yet: Production changes need coordination with development, IT, and operations, plus testing, scheduled downtime, and business risk review. Attackers aren't waiting, which is why virtual patching matters.
Our three-step sequence
- 1. Identify your exposure. Use TrendAI Vision One Cyber Risk Exposure Management (CREM) to rank exposed assets by criticality. Find every PHP instance, including containers, appliances, and hosted sites, and flag end-of-life versions. Hunt for shells spawned by PHP, Base64-encoded web shells, and unexpected wget or credential-file access. Quick check: the PHP2Shell Exposure Checker (confirm results with the runtime owner, since backports can hide the version).
- 2. Deploy virtual patching now. Use Vision One TippingPoint and Endpoint Security to shield affected systems without waiting for production changes, and Vision One Network Detection and Response to catch exploit attempts. Where no protection exists, restrict public access, put admin interfaces behind a VPN, or enable a WAF rule. Treat these as time, not a fix.
- 3. Prioritize and execute remediation. Patch internet-facing and mod_php systems first, then work through the rest by risk. Restart services or redeploy containers so the fix actually loads. For PHP 8.1 and older, which are outside upstream support, use a vendor backport, isolation, or migration. Brief leadership on exposure, patch timing, and migrations.
eMudhra: the browsers recovered, everything else needs work
- Browsers are covered. Chrome, Firefox, Apple, and Microsoft blocked the compromised intermediates, and eMudhra revoked them on October 18.
- Much else isn't. Linux servers, containers, language runtimes, and embedded devices often never check revocation. Each intermediate also exists in a version cross-signed by Sectigo, so removing the eMudhra root alone leaves a path open.
Actions:
- Update trust stores beyond the desktop,
- Rebuild Go applications and container images, and
- Set TLS inspection gateways to block all 16 certificates.
NOTE: Watch for code signing. Two of the eight keys could issue code-signing certificates. Examine any binary that chains to them, even though eMudhra says those CAs never entered production.
The questions your board will ask
- Are we exposed? Sort exposure into high, medium, and low tiers based on what a compromise would put at stake, with what you're doing and how fast for each. High might be internet-facing systems handling customer data or payments, patched within 48 hours.
- Have we been hit? State a confidence level, such as "We've reviewed 90% of our high-risk systems and found no signs of compromise." Explain the rest: why it's open, when it closes, and what protects it meanwhile.
- When will we be done? Separate what you control from what you're waiting for. Give dates for your patching and a supply-chain strategy.
- What can't we fix? Give a number and the ask, such as "5% of our high-risk systems have no fix. They're virtually patched and isolated, and we need a replacement decision by end of quarter."
- Why didn't we see this coming? The measure that matters is how quickly you know your exposure and close it.
Where TrendAI™ can help
TrendAI customers can contact their account representative. Others can find guidance at trendaisecurity.com/en-us/contact or email incident_response@trendmicro.com.
Protections buy time, but patching and verification close the risk. Check your detection coverage instead of assuming it and brief your leaders before someone else does.
To my fellow CISOs, get some sleep when you can and take care of your teams. Next week will bring its own surprises.