https://vanemmerik.ai/supply-chain/ Supply Chain Watch entries: Runtimes. en https://vanemmerik.ai/supply-chain/2026-10-25/#emudhra-oracle-java-cpython-update vea-sc-2026-10-25-emudhra-oracle-java-cpython-update Mon, 26 Oct 2026 00:52:00 +0000 Oracle published a Security Alert on Oct 24 (CVE-2026-114820, CVSS 9.1) whose Java updates remove the affected eMudhra root CA certificates from the JDK trust store; listed as affected are Java SE 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1, GraalVM for JDK 17.0.21 and 21.0.13, and GraalVM Enterprise 21.3.20. Oracle's page does not list fixed version numbers and points to its patch availability note and an eMudhra page instead, so check your vendor's build notes. Separately, CPython assigned CVE-2026-115557 (CVSS 9.4) for a defense-in-depth denylist in the ssl module that rejects any chain containing a compromised eMudhra intermediate key; the pull request is approved and marked as a release blocker with backports requested to 3.11-3.15, but it was not merged as of this watch. One aggregator claims a public proof of concept exists for the Java issue; we could not confirm that. What to do: Apply Oracle's Oct 24 Java update (or your JDK vendor's equivalent) on hosts that make TLS connections, and keep certifi and OS CA bundles current for Python until the CPython fix ships. https://vanemmerik.ai/supply-chain/2026-10-25/#php2shell-unit42-agentic-intrusion vea-sc-2026-10-25-php2shell-unit42-agentic-intrusion Sun, 25 Oct 2026 21:57:00 +0000 Palo Alto Networks' Unit 42 updated its PHP2Shell threat brief (Oct 23, 12:30 PT) with a case in which attackers, apparently driven by an agentic AI platform, ran recon through a web shell at a European government body and obtained password hashes and MFA secrets within two hours of initial exploitation, then tried NTLM relay into Active Directory. The brief does not name the exact CVE used in that case, so treat it as strong but not definitive evidence that PHP2Shell has moved from attempts to real break-ins; our Oct 24 entry said none had been confirmed. Evening update: The Hacker News also reports that CYFIRMA tied a scanning campaign, with moderate confidence, to a suspected North Korea-linked actor probing 216 unpatched hosts in 12 countries (single source so far), and that ReliaQuest has published log artifacts for detection. Fixed PHP releases are unchanged (8.5.12, 8.4.27, 8.3.36, 8.2.35); a third flaw, CVE-2026-115560, still awaits a regular release, and neither main CVE was in CISA KEV as of this watch. What to do: Assume unpatched internet-facing PHP may already be compromised: patch, then hunt for web shells and unexpected outbound connections from PHP hosts since Oct 17, and rotate credentials those hosts could reach. https://vanemmerik.ai/supply-chain/2026-10-25/#wasmtime-aarch64-br-table-sandbox-escape vea-sc-2026-10-25-wasmtime-aarch64-br-table-sandbox-escape Sun, 25 Oct 2026 16:05:00 +0000 CVE-2026-115893 (GHSA-mghf-wjfp-p5xm, RUSTSEC-2026-0379), published Oct 23, is a Cranelift code-generation bug on 64-bit Arm: a Wasm br_table with roughly 256,000 or more targets can compile to a wrong jump target, letting a guest module escape the sandbox. It matters to anyone running untrusted WebAssembly with Wasmtime on aarch64, such as plugin hosts and edge or serverless platforms; x86-64 is not named as affected. Fixed releases are 36.0.19, 48.0.7 and 49.0.4, which also roll up several smaller wasmtime-wasi fixes including a symlink-rename filesystem escape (RUSTSEC-2026-0352). A related truncation bug, CVE-2026-115889, is fixed in 36.0.19 and 43.0.0. No public exploit or in-the-wild use is reported. What to do: Bump wasmtime (and wasmtime-wasi) to 36.0.19, 48.0.7, 49.0.4 or later wherever you run untrusted Wasm, prioritising Arm hosts. https://vanemmerik.ai/supply-chain/2026-10-24/#brotli-http2shell-python-bun-envoy vea-sc-2026-10-24-brotli-http2shell-python-bun-envoy Sat, 24 Oct 2026 21:53:00 +0000 CVE-2026-111497 sits in Google's Brotli C decoder (versions 1.0.3 to 1.2.0), not only in Node.js, so anything that decodes untrusted Brotli data with a bundled or linked copy is exposed. On Oct 23-24 researchers confirmed the PyPI packages Brotli (fixed in 1.2.1) and brotlicffi (fixed in 1.2.1.0) are affected; urllib3/requests, httpx, aiohttp and Scrapy load them automatically when installed and will decode br responses. Bun 1.4.4, Envoy 1.40.0/1.39.3/1.38.6/1.37.8 and Istio 1.29.9/1.30.6/1.31.2 carry the fix; libcurl and Git for Windows builds linking Brotli 1.2.0 are also in scope. Bundled copies in the .NET runtime, the PHP brotli extension, the Ruby brotli gem, DuckDB, ClickHouse and Apache Arrow were still listed as unpatched on Oct 24. Upstream Brotli fixes are 1.0.10, 1.1.1 and 1.2.1, Debian 13 ships 1.1.0-2+deb13u1, and the cdxgen SBOM tool is fixed in 12.8.9 and 13.5.0. Public proof-of-concept code reportedly crashes stock builds; code execution has only been shown in Imperva's lab on an official Node.js 24.22.0 arm64 build and that exploit is unreleased. No in-the-wild exploitation is confirmed, and GitHub's advisory did not list the PyPI packages on Oct 23, so Dependabot may not flag them. What to do: Upgrade Brotli to 1.2.1 and brotlicffi to 1.2.1.0 in every Python environment and image, update Bun, Envoy/Istio and OS libbrotli packages, then rebuild images and bundled binaries. Where you cannot patch yet, reject Content-Encoding: br at the edge. https://vanemmerik.ai/supply-chain/2026-10-24/#php2shell-no-confirmed-compromise-aslr-bypass vea-sc-2026-10-24-php2shell-no-confirmed-compromise-aslr-bypass Sat, 24 Oct 2026 21:53:00 +0000 Two days into mass scanning for CVE-2026-109618 and CVE-2026-109619, no successful in-the-wild compromise has been confirmed: Sophos withdrew an earlier report of one, Wordfence and Hunt.io saw only failed attempts, and Sansec now says public exploits fail on default PHP settings. That window may not last. VulnCheck reports a working exploit for CVE-2026-109618 that leaks memory to defeat ASLR on x86-64 with error display off, the usual production setup; it is limited to its paying customers for now. Amazon's honeypots logged an attempt on Oct 17, four days before disclosure, so log reviews should start there. Fixed releases are unchanged (8.5.12, 8.4.27, 8.3.36, 8.2.35); PHP 8.1 and older get no fix, and neither CVE was in CISA KEV as of Oct 23. What to do: Keep patching to the fixed PHP releases and rebuild PHP base images; for end-of-life PHP, block multipart uploads at the edge if you can, and hunt for POST bodies containing PHP_SESSION_UPLOAD_PROGRESS from Oct 17 onward. https://vanemmerik.ai/supply-chain/2026-10-24/#emudhra-trust-store-updates vea-sc-2026-10-24-emudhra-trust-store-updates Sat, 24 Oct 2026 21:53:00 +0000 The eight eMudhra intermediate CA keys disclosed on Oct 20 were generated so weakly that anyone can recover them, which means a network attacker could mint certificates those intermediates sign; exposure dates back to April 2025, though no misuse has been found. Browsers block them already, but package managers, CI jobs and API clients that carry their own CA bundle keep trusting the chain until updated. Fixed bundles: certifi 2026.10.19, pip 26.2.2, uv 0.13.4, Node.js 22.23.4/24.22.1/26.12.1, Go 1.27.3/1.26.10, rustls-webpki 0.103.16, webpki-roots 1.0.10, composer/ca-bundle 1.4.16/1.6.0, plus Ubuntu, Debian, Alpine, Fedora and Wolfi ca-certificates. Bun, FreeBSD and Java's JDK cacerts were still unfixed or unconfirmed on Oct 23, and container images keep the old roots until rebuilt. What to do: Bump certifi, pip, uv, Node.js, Go and Rust webpki crates to the fixed versions, rebuild container images on patched base images, and check Java and Bun services separately; the system bundle should contain no emSign entries after updating. https://vanemmerik.ai/supply-chain/2026-10-23/#nodejs-oct-2026-security-release vea-sc-2026-10-23-nodejs-oct-2026-security-release Sat, 24 Oct 2026 03:05:00 +0000 Node's Oct 21 security release fixed 10 CVEs across the 22.x, 24.x and 26.x lines. The worst, an out-of-bounds write in the bundled Brotli decoder, is no longer theoretical: on Oct 23 Imperva reported code execution on the official Node.js 24.22.0 Linux arm64 build, including through Express 5.0-5.3 and body-parser 2.0-2.3 request handling, though not on every attempt. Three high-severity TLS and DNS bugs in the same release let certificates match the wrong host or let a NUL byte truncate a hostname. No in-the-wild exploitation reported yet; Node 20.x and older are end-of-life and get no fix. What to do: Move to 26.12.1, 24.22.1 or 22.23.4 everywhere, including base images, CI runners and serverless runtimes; replace any Node 20.x. Until then, limit untrusted Brotli traffic at the edge. https://vanemmerik.ai/supply-chain/2026-10-23/#php2shell-cve-2026-109618 vea-sc-2026-10-23-php2shell-cve-2026-109618 Sat, 24 Oct 2026 03:05:00 +0000 PHP shipped emergency releases on Oct 21 for two critical flaws that let an attacker without an account run code on a server. Exploit attempts reported since then number in the millions, with attackers trying to install Mirai botnet malware. On Oct 23 PHP flagged a separate, lower-risk session issue that the emergency builds do not fix; it only affects unusual session-handler configurations. What to do: Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, including container base images. As a stopgap (and to cover the Oct 23 issue), set session.upload_progress.enabled=0. https://vanemmerik.ai/supply-chain/2026-10-23/#gitlab-onigmo-rce-cve-2026-110264 vea-sc-2026-10-23-gitlab-onigmo-rce-cve-2026-110264 Sat, 24 Oct 2026 02:45:00 +0000 GitLab's Oct 21 critical patch release fixes an unauthenticated remote code execution bug triggered by a crafted Org-mode file, rooted in an integer overflow in Onigmo, the regex engine inside Ruby. Fixed GitLab versions are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13; GitLab.com is already patched. On Oct 23 the Ruby team released 4.0.9, 3.4.12 and 3.3.13 with fixes for the underlying regex bugs. It is not in CISA KEV yet, but public repositories claiming proofs of concept have appeared. What to do: Upgrade self-managed GitLab now (older than 18.11 means following upgrade stops to 18.11.13 or later). Update Ruby on self-compiled installs and on any service that compiles regexes from untrusted input.