Notification about CA certificate security incident and vulnerability CVE-2026-115560 on PHP – action required on Virtual Machines.

News

Dear Users,
We are reaching out to inform you about two critical security incidents involving eMudhra / emSign CA certificates and PHP.

1) eMudhra CA certificates

A compromise of intermediate CA keys has made it possible for attackers to perform Man-in-the-Middle (MITM) attacks against TLS clients. This affects a wide range of tools and environments. Because many tools use their own internal certificate bundles instead of the system’s trust store, updating your operating system packages alone may not be sufficient.

To secure your infrastructure, please perform the following actions on all your instances and containers:

a) Update System Certificate

Ensure your distribution’s CA certificates package is up to date:

  • Ubuntu/Debian: sudo apt update && sudo apt install –only-upgrade ca-certificates ‘libnss3*’
  • Rocky: sudo dnf update ca-certificates

Minimum Required Versions for ca-certificates:

  • Ubuntu 22.04, 24.04, 26.04: 20260816ubuntu0.26.04.1
  • Debian 12/13: Update as of Oct 20, 2026 (root list 2.92 , NSS 3.131.1)
  • Rocky: Update as of October 20, 2026 (root list 2.92 , NSS 3.131.1)

If you are using private images in your instances, please refer to the documentation of your distro.

Legacy Systems Note:

For any distro not mentioned above, we strongly recommend migrating to the most updated version of Rocky Linux or Ubuntu. If not possible, consider the following:

  • Ubuntu 18.04/20.04: You might activate Ubuntu Pro (Free for up to 5 machines) to receive ESM updates via ‘sudo pro attach ‘. The minimum required version are in this case 202402031ubuntu0.18.04.1+esm3 for Ubuntu 18.04 and 20240203~20.04.1ubuntu0.1~esm2 for Ubuntu 20.04.
  • Ubuntu 21.04: This OS is End-of-Life and a non-LTS release. Updates are not available via the official repos.
  • CentOS users: This OS is End-of-Life. Updates are only available for CentOS 7 via services like CIQ Bridge.

Please check the following references for further information:

  • Ubuntu/Debian: https://ubuntu.com/blog/emudhra-ca-compromise-fixes-available
  • Rocky/CentOS: https://kb.ciq.com/article/security-advisories/cve-emudhra-mitigation

b) Update Python Virtual Environments

If you use Python virtual environments (venv, virtualenv or conda envs), you must upgrade pip and certifi in every environment.

To securely upgrade pip (avoiding a MITM attack during the upgrade itself), we recommend using the direct URL with the SHA256 checksum and ensure your tools meet or exceed these versions:

  • pip: >= 26.2.2
  • certifi: >= 2026.10.19
  • uv: >= 0.13.4
  • conda: >= 26.9.4

For more technical details, you can refer to the official discussion on the Python forums:

  • https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576

c) Broader Impact & Other Software

Please be aware that this security incident affects any software that uses its own embedded certificate store rather than the operating system’s trust store. This includes, but is not limited to:

  • Java Applications: Ensure your JRE/JDK is updated and the cacerts truststore is refreshed.
  • Node.js: ensure you are using patched versions (e.g., 22.23.4, 24.22.1, 26.12.1 or newer)
  • Statically compiled binaries (e.g., Go, Rust): If you use tools with embedded certificates, ensure they are updated to versions released after October 20, 2026. You will need to recompile your applications to incorporate the revoked certificates.

We recommend a general audit of all critical services and dependencies to ensure they are running the latest security patches.

You might find more information about your specific software at the following link: https://emudhra.we-have-a-problem.com/

d) Rebuild Container Images

If you build your own images: update the package versions in your container recipe (Dockerfile) and rebuild your images with layer caching disabled. For instance, in docker:

docker build --no-cache -t <image_name>

If you pull pre-built images: check the provider’s release notes or verify the package versions inside the image before deploying. Once verified, pull the updated image. For instance, in docker:

docker pull <image_name>:latest

(Note: Existing containers must be deleted and recreated to apply the changes).

If using Kubernetes: verify that the image in your registry is updated and contains the fixed versions. Then, ensure your imagePullPolicy is set to Always and trigger a rollout restart:

kubectl rollout restart deployment <deployment_name>

2) PHP incoming CVE-2026-115560

PHP team suggested to set session.upload_progress.enabled=0 to mitigate an incoming security announcement (CVE-2026-115560). You can find more information at the following link:

https://www.php.net/archive/2026.php#2026-10-23-1

Please note that this was part of the mitigation of CVE-2026-109618 and CVE-2026-109619 previously announced, thus if that mitigation is still in place you can keep it active. All php user are encouraged to update their php release as soon as security patches for CVE-2026-115560 will be released.

Best regards,

HPC User Support @ CINECA

MENU