https://sslbrain.com/en/security-notices/ Security matters that affect sslbrain, from FairSSL A/S. en Sat, 24 Oct 2026 12:00:00 GMT https://sslbrain.com/en/security-notices/#2026-10-24-emudhra sslbrain-security-notice-2026-10-24-emudhra Sat, 24 Oct 2026 12:00:00 GMT What happened: On 17-10-2026 a security researcher showed that the private keys of 8 of the CA eMudhra's intermediate certificates could be computed from the public certificates. 6 of them issue TLS certificates and 2 code signing. eMudhra revoked them on 18-10 and 19-10-2026. Mozilla has removed the root emSign ECC Root CA - G3 from Firefox, and Microsoft and Apple block the revoked certificates. eMudhra has announced that it is leaving public SSL/TLS certificates. Who is affected: Whoever holds the keys can make a certificate that software still trusting eMudhra accepts. The appliance before 0.4.59 trusted eMudhra's roots through Debian's certificate store and through tools that carry their own list of CAs. Appliance updates do not depend on TLS: the image is signed by FairSSL and checked against two public keys on the host before it starts. The service agents use the server's own certificate store in Windows or Linux and install no roots. Integrations only add the certificate's own intermediate certificates to the server. No certificate that sslbrain issues comes from eMudhra. What we did: On 24-10-2026 we removed eMudhra from the trust of the sslbrain Cloud (EU) services that make outbound TLS connections, and on 25-10-2026 from the application itself. The application did not trust the roots the revoked intermediates belong to. Appliance 0.4.59 was released on 24-10-2026 at 20:23 Danish time (CEST). It trusts one current certificate list from Mozilla without eMudhra's roots and the revoked intermediates, and the host system of the OVA and KVM appliance no longer trusts them either. What you do: Update the appliance to 0.4.59. With automatic updates this happens by itself. Keep Windows and Linux on your servers updated, so they follow Microsoft's and the distribution's removal of eMudhra. Under Certificates in the appliance, each certificate shows the CA that issued it. A certificate from eMudhra has to move to another CA. https://sslbrain.com/en/security-notices/#2026-10-21-php sslbrain-security-notice-2026-10-21-php Wed, 21 Oct 2026 12:00:00 GMT What happened: On 21-10-2026 two vulnerabilities in PHP became known, CVE-2026-109618 and CVE-2026-109619. They let an attacker without a login run code on a server with PHP 8.4 before 8.4.27. PHP 8.4.27 fixes them. Who is affected: Both sslbrain Cloud (EU) and the appliance run PHP. The appliance before 0.4.56 has a vulnerable PHP version. The service agents and integrations do not use PHP. The website sslbrain.com is static files and runs no PHP. What we did: From 21-10-2026 at 21:18 Danish time (CEST), sslbrain Cloud (EU) ran PHP 8.4.27. Appliance 0.4.56 with PHP 8.4.27 was built and signed the same evening at 21:38. What you do: Update the appliance to 0.4.56 or later. With automatic updates this has happened.