--- title: eMudhra's stolen root CA keys fallout spreads, a PHP... description: The eMudhra CA key compromise keeps getting worse, with Go, Cloudflare, uv, and NSS all shipping emergency fixes while researchers warn embedded devices won't... canonical: https://daily.dev/posts/emudhra-s-stolen-root-ca-keys-fallout-spreads-a-php-0-day-forces-an-emergency-patch-window-jw0tvpnwx twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: eMudhra's stolen root CA keys fallout spreads, a PHP 0-day forces an emergency patch window | daily.dev og:description: The eMudhra CA key compromise keeps getting worse, with Go, Cloudflare, uv, and NSS all shipping emergency fixes while researchers warn embedded devices won't... og:url: https://daily.dev/posts/emudhra-s-stolen-root-ca-keys-fallout-spreads-a-php-0-day-forces-an-emergency-patch-window-jw0tvpnwx og:image: https://api.daily.dev/og/posts/jw0TvPnwx.png og:image:alt: eMudhra's stolen root CA keys fallout spreads, a PHP 0-day forces an emergency patch window og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # eMudhra's stolen root CA keys fallout spreads, a PHP 0-day forces an emergency patch window **[Security Digest](https://daily.dev/sources/security_digest)** · 4 min read · 0 upvotes · 0 comments ## Summary The eMudhra CA key compromise keeps getting worse, with Go, Cloudflare, uv, and NSS all shipping emergency fixes while researchers warn embedded devices won't catch up until 2039. PHP's security team is racing a leaked advisory for two 9.2-severity RCE bugs affecting every version since PHP 5, with a fix due today. A Chinese-speaking actor used the open-source Cairn agent framework to breach over 100 companies for roughly $50 each, and CrowdSec's exploitation data shows attackers weaponizing new CVEs within a day of disclosure more than a third of the time. ## Content **TLDR:** The eMudhra CA key compromise keeps getting worse, with Go, Cloudflare, uv, and NSS all shipping emergency fixes while researchers warn embedded devices won't catch up until 2039. PHP's security team is racing a leaked advisory for two 9.2-severity RCE bugs affecting every version since PHP 5, with a fix due today. A Chinese-speaking actor used the open-source Cairn agent framework to breach over 100 companies for roughly $50 each, and CrowdSec's exploitation data shows attackers weaponizing new CVEs within a day of disclosure more than a third of the time. --- ## eMudhra's compromised CA keys trigger a scramble across browsers, languages, and CDNs Eight eMudhra intermediate CA certificates had private keys so weak that researcher Scott Helme found some were tiny numbers like 4 and 56, not proper 384-bit values. Chrome, Firefox, Apple, and Microsoft all moved to distrust the certs within days, Go patched with CVE-2026-111943, and Cloudflare, uv, and others pushed emergency updates to bundled CA stores. Filippo Valsorda called the cleanup bigger than Heartbleed, and he's right to worry about the long tail: curl, Python, and most non-browser clients don't check revocation by default, and embedded devices will trust these certs until 2039 unless someone manually intervenes. [Read more](https://daily.dev/feed-by-ids?id=A03PToHLJ&id=MgtC0hAAv&id=cnLgmBQxU) ## PHP's emergency patch for two 9.2 RCE bugs lands today after an early leak PHP's security team planned to keep CVE-2026-109618 and CVE-2026-109619 private until release, but details leaked and a researcher claims to have already reproduced both heap use-after-free bugs. watchTowr says the flaws affect every PHP version since 2004, and a leaked exploit tool called PHP2Shell reportedly targets WordPress, Magento, Drupal, and half a dozen other major platforms. The fix is due at 14:00 UTC today; if you run PHP anywhere, know where it's deployed now so you can redeploy within hours once patches land. [Read more](https://daily.dev/feed-by-ids?id=57hO7AcC0&id=3PkR99AaT) ## Cairn's unauthenticated API turned an open pentest agent into a 100-company breach spree Reuters and NorForge traced over 100 company breaches, including John Deere and Cummins, to Cairn, an open-source AI agent control plane running on DeepSeek and Claude Code with short prompts under 100 characters. One researcher read the source and found the entire API server ships with zero authentication across sixteen endpoints, which is also how NorForge found 20+ exposed dashboards with 1,100 attack projects sitting in plain view. Average cost per successful breach: around $50 in tokens, with intrusions averaging 23 hours. The same tool shows up independently in South Korean and Japanese breach campaigns, so this isn't a one-off. [Read more](https://daily.dev/feed-by-ids?id=x7axATxVp&id=ohS3PRHb0) ## CrowdSec's 500,000-server dataset shows attackers weaponizing CVEs within a day of disclosure Of 332 exploited CVEs tracked from Q4 2024 to Q2 2026, 36% got hit within 24 hours of publication and another 27% within a week. React2Shell (CVE-2025-55182) pulled 444,948 distinct attacking IPs, with attackers shifting from 3% to roughly 80% hyperscaler cloud IPs within a week before mostly abandoning that infrastructure. Old bugs don't die either: PHPUnit's 2017 CVE and an Apache 2021 CVE are each still hunted by over 88,000 IPs. If your patch cadence is measured in weeks, this data says that's already too slow for anything that gets disclosed loudly. [Read more](https://daily.dev/posts/VD2tF6l32) --- ## Also notable - **Laravel fixes a 9.2 auth bypass letting attackers log in as any user:** An is_string() check was missing from Illuminate\Auth\TokenGuard, letting unauthenticated attackers bypass login on MySQL/MariaDB; fixed in Laravel 12.68.0 and 13.29.0. [Read more](https://daily.dev/posts/oeS9Bx5Ge) - **OVHcloud CLI binaries got swapped with malware for 94 minutes:** A compromised developer GitHub account let attackers replace v0.11.0-v0.15.0 release binaries with credential-stealing malware for 94 minutes on October 19; anyone who ran the binary during that window needs to rotate credentials from a clean device, not just reinstall. [Read more](https://daily.dev/posts/BNMU5Vcyp) - **Meta's Muse AI agent leaked sensitive shared conversations via guessable URLs:** Researchers enumerated 6,800 shared conversation links in a single query and found loan applications, bank fraud alerts, and revenue reviews sitting behind predictable URLs. [Read more](https://daily.dev/posts/S2brD3D4b) - **NowSecure: 97% of mobile apps have no detectable post-quantum crypto:** A scan of 136,711 iOS and Android apps found 96.9% lack any PQC code, and Gartner separately found 45% of CISOs haven't started PQC work at all. [Read more](https://daily.dev/posts/LuFfRg8zO) - **curl will handle low-severity bugs as public GitHub issues starting October 26:** Over 90% of curl's vulnerability reports turn out to be below HIGH severity, often AI-generated noise, so the project is moving LOW/MEDIUM reports out of HackerOne and into the open while keeping HIGH/CRITICAL private. [Read more](https://daily.dev/posts/rRzEU5YsC) --- Tags: [#security](https://daily.dev/tags/security), [#php](https://daily.dev/tags/php) [View this post on daily.dev](https://daily.dev/posts/emudhra-s-stolen-root-ca-keys-fallout-spreads-a-php-0-day-forces-an-emergency-patch-window-jw0tvpnwx) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/emudhra-s-stolen-root-ca-keys-fallout-spreads-a-php-0-day-forces-an-emergency-patch-window-jw0tvpnwx","headline":"eMudhra's stolen root CA keys fallout spreads, a PHP 0-day forces an emergency patch window","text":"The eMudhra CA key compromise keeps getting worse, with Go, Cloudflare, uv, and NSS all shipping emergency fixes while researchers warn embedded devices won't catch up until 2039. PHP's security team is racing a leaked advisory for two 9.2-severity RCE bugs affecting every version since PHP 5, with a fix due today. A Chinese-speaking actor used the open-source Cairn agent framework to breach over 100 companies for roughly $50 each, and CrowdSec's exploitation data shows attackers weaponizing new CVEs within a day of disclosure more than a third of the time.","url":"https://daily.dev/posts/emudhra-s-stolen-root-ca-keys-fallout-spreads-a-php-0-day-forces-an-emergency-patch-window-jw0tvpnwx","datePublished":"2026-10-21T04:17:47.924Z","dateModified":"2026-10-21T04:18:17.408Z","author":{"@type":"Organization","name":"Security Digest","logo":"https://media.daily.dev/image/upload/s--m4ZKB_C0--/f_auto,q_auto/v1779959612/logos/security_digest","url":"https://daily.dev/sources/security_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/security_digest","name":"Security Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Security Digest","item":"https://daily.dev/sources/security_digest"},{"@type":"ListItem","position":3,"name":"eMudhra's stolen root CA keys fallout spreads, a PHP 0-day forces an emergency patch window"}]} ```