October 21, 2026: External Security Advisory Affecting Vasion Products (PHP Remote Code Execution Vulnerabilities and eMudhra Intermediate CA Compromise)

Update timeline

1. identified Oct 21, 2026, 07:56 PM UTC

   October 21, 2026: External Security Advisory Affecting Vasion Products (PHP Remote Code Execution Vulnerabilities and eMudhra Intermediate CA Compromise) Vasion is remediating two third-party and industry-wide security issues. Vasion has been made aware of two issues affecting the third-party PHP language runtime and eMudhra certificates used in software around the world. Vasion has been actively investigating and remediating both issues since becoming aware of them. On October 21, the PHP Foundation released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to address the two critical vulnerabilities that could allow unauthenticated remote code execution [see https://www.php.net/index.php#2026-10-21-5 for more details]. Separately, the private keys of multiple eMudhra intermediate certificate authorities (together with their cross-signed variants) were reported compromised, which could allow an attacker to impersonate websites and services for clients that still trust them [see https://emudhra.com/en/post/certificate-security-incident for more details]. Vasion-hosted services are being updated by Vasion and will require no customer action. For customers running the Vasion Virtual Appliance (VA), we will be releasing an updated VA version that includes these fixes. It is an emergency security update, and Customers should upgrade to the updated VA release as soon as it is available. We will update this bulletin as remediation and validation progress. Customers with questions can contact Vasion Support at [email protected] or get in touch with your account manager.

2. identified Oct 22, 2026, 07:00 PM UTC

   October 22, 2026: External Security Advisory Affecting Vasion Products (PHP Remote Code Execution Vulnerabilities and eMudhra Intermediate CA Compromise) Vasion continues to remediate the two third-party, industry-wide security issues described in our October 21 notice: the PHP remote code execution vulnerabilities (fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35) and the compromise of multiple eMudhra intermediate certificate authorities. Vasion-hosted services: Updates are underway and being validated. No customer action is required at this time. Vasion Virtual Appliance (VA): For customers running the Vasion Virtual Appliance (VA), we will be releasing an updated VA version that includes these fixes. It is an emergency security update, and Customers should upgrade to the updated VA release as soon as it is available. We will continue to update this bulletin as remediation and validation progress. For more information, see the PHP announcement (https://www.php.net/archive/2026.php#2026-10-21-5) and the eMudhra security incident notice (https://emudhra.com/en/post/certificate-security-incident). Customers with questions can contact Vasion Support at [email protected] or reach out to their account manager.

3. monitoring Oct 23, 2026, 05:42 PM UTC

   Update, October 23, 2026: Vasion has released fixes for one of the two third-party, industry-wide security issues described in our October 21 notice. We have updated Vasion-hosted services (except FedRAMP and our Singapore region, which are in progress) to patched versions of PHP to address the remote code execution vulnerabilities (CVE-2026-109618, CVE-2026-109619). We continue to work on the second issue, the compromise of multiple eMudhra intermediate certificate authorities, and are updating certificates and affected components. We will update this notice as we have more information. Background: On October 21, the PHP Foundation released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to address the two critical vulnerabilities that could allow unauthenticated remote code execution. Separately, the private keys of multiple eMudhra intermediate certificate authorities (together with their cross-signed variants) were reported compromised, which could allow an attacker to impersonate websites and services for clients that still trust them. Resolution: Vasion immediately began working on fixes to address these two third-party, industry-wide security issues. As of October 23, Vasion has patched the PHP vulnerabilities in the Vasion-hosted services (except FedRAMP and our Singapore region, which are in process) and released an updated VA version for customers to install. Below are any additional next steps based on your specific environment: Vasion-hosted services (except FedRAMP and customers in our Singapore region): We generated an emergency patch overnight to deploy the PHP fix to all customers. Please review the patch release notes in our documentation here: https://docs.vasion.com/a/Release_Notes/Automate.htm. Your Vasion environment has been updated and no customer action is required at this time. Vasion Virtual Appliance (VA): For customers running the Vasion Virtual Appliance (VA), we have released an updated VA version that includes the PHP fix. It is an emergency security update, and Customers should upgrade to the updated VA release (host 26.2.352) as soon as possible. Please visit this link https://docs.vasion.com/v/Release_Notes/VirtualAppliance.htm for access to the download. Vasion-hosted FedRAMP services and customers in our Singapore region: Updates are underway and being validated. No customer action is required at this time. Please continue to monitor this page for updates. Vasion will continue to actively update certificates and address technology impacted by the eMudhra compromise. Updates are underway and being validated. No action is required at this time for the eMudhra compromise but an additional update is expected. We will continue to update this bulletin as remediation and validation progress. Conclusion: We are actively monitoring these issues and will update this notice as we have more information. Details on Vasion’s security and privacy practices are available in our Trust Center at https://trust.vasion.com/. If you have questions, contact Vasion Support at [email protected] or reach out to your account manager. Thank you for your partnership.