Security notices

Every security matter that affects sslbrain is here: what happened, who is affected, what we did, and what you do.

Notices are always published here. When you have to do something, the account's security contacts also get a mail.

RSS feed

eMudhra is no longer trusted in sslbrain Cloud (EU) and the appliance

Published:

Action required

What happened

On 17-10-2026 a security researcher showed that the private keys of 8 of the CA eMudhra's intermediate certificates could be computed from the public certificates. 6 of them issue TLS certificates and 2 code signing. eMudhra revoked them on 18-10 and 19-10-2026.

Mozilla has removed the root emSign ECC Root CA - G3 from Firefox, and Microsoft and Apple block the revoked certificates. eMudhra has announced that it is leaving public SSL/TLS certificates.

Who is affected

Whoever holds the keys can make a certificate that software still trusting eMudhra accepts. The appliance before 0.4.59 trusted eMudhra's roots through Debian's certificate store and through tools that carry their own list of CAs.

Appliance updates do not depend on TLS: the image is signed by FairSSL and checked against two public keys on the host before it starts.

The service agents use the server's own certificate store in Windows or Linux and install no roots. Integrations only add the certificate's own intermediate certificates to the server.

No certificate that sslbrain issues comes from eMudhra.

What we did

On 24-10-2026 we removed eMudhra from the trust of the sslbrain Cloud (EU) services that make outbound TLS connections, and on 25-10-2026 from the application itself. The application did not trust the roots the revoked intermediates belong to.

Appliance 0.4.59 was released on 24-10-2026 at 20:23 Danish time (CEST). It trusts one current certificate list from Mozilla without eMudhra's roots and the revoked intermediates, and the host system of the OVA and KVM appliance no longer trusts them either.

What you do

Update the appliance to 0.4.59. With automatic updates this happens by itself.

Keep Windows and Linux on your servers updated, so they follow Microsoft's and the distribution's removal of eMudhra.

Under Certificates in the appliance, each certificate shows the CA that issued it. A certificate from eMudhra has to move to another CA.

PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 are fixed

Published:

Action required

What happened

On 21-10-2026 two vulnerabilities in PHP became known, CVE-2026-109618 and CVE-2026-109619. They let an attacker without a login run code on a server with PHP 8.4 before 8.4.27. PHP 8.4.27 fixes them.

Who is affected

Both sslbrain Cloud (EU) and the appliance run PHP. The appliance before 0.4.56 has a vulnerable PHP version.

The service agents and integrations do not use PHP. The website sslbrain.com is static files and runs no PHP.

What we did

From 21-10-2026 at 21:18 Danish time (CEST), sslbrain Cloud (EU) ran PHP 8.4.27.

Appliance 0.4.56 with PHP 8.4.27 was built and signed the same evening at 21:38.

What you do

Update the appliance to 0.4.56 or later. With automatic updates this has happened.