October 21, 2026: External Security Advisory Affecting Vasion Products (PHP Remote Code Execution Vulnerabilities and eMudhra Intermediate CA Compromise)
Ongoing · last updatemonitoringOct 23 · 17:42 UTC
Update, October 23, 2026: Vasion has released fixes for one of the two third-party, industry-wide security issues described in our October 21 notice. We have updated Vasion-hosted services (except FedRAMP, which is in progress) to patched versions of PHP to address the remote code execution vulnerabilities (CVE-2026-109618, CVE-2026-109619). We continue to work on the second issue, the compromise of multiple eMudhra intermediate certificate authorities, and are updating certificates and affected components. We will update this notice as we have more information. Background: On October 21, the PHP Foundation released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to address the two critical vulnerabilities that could allow unauthenticated remote code execution. Separately, the private keys of multiple eMudhra intermediate certificate authorities (together with their cross-signed variants) were reported compromised, which could allow an attacker to impersonate websites and services for clients that still trust them. Resolution: Vasion immediately began working on fixes to address these two third-party, industry-wide security issues. As of October 23, Vasion has patched the PHP vulnerabilities in the Vasion-hosted services (except FedRAMP, which is in process) and released an updated VA version for customers to install. Below are any additional next steps based on your specific environment: Vasion-hosted services (except FedRAMP): We generated an emergency patch overnight to deploy the PHP fix to all customers. Please review the patch release notes in our documentation here: https://docs.vasion.com/a/Release_Notes/Automate.htm. Your Vasion environment has been updated and no customer action is required at this time. Vasion Virtual Appliance (VA): For customers running the Vasion Virtual Appliance (VA), we have released an updated VA version that includes the PHP fix. It is an emergency security update, and Customers should upgrade to the updated VA release (host 26.2.352) as soon as possible. Please visit this link https://docs.vasion.com/v/Release_Notes/VirtualAppliance.htm for access to the download. Vasion-hosted FedRAMP services: Updates are underway and being validated. No customer action is required at this time. Please continue to monitor this page for updates. Vasion will continue to actively update certificates and address technology impacted by the eMudhra compromise. Updates are underway and being validated. No action is required at this time for the eMudhra compromise but an additional update is expected. We will continue to update this bulletin as remediation and validation progress. Conclusion: We are actively monitoring these issues and will update this notice as we have more information. Details on Vasion’s security and privacy practices are available in our Trust Center at https://trust.vasion.com/. If you have questions, contact Vasion Support at printsupport@vasion.com or reach out to your account manager. Thank you for your partnership.
Reported by Vasion on their status page.