Community

Last updated: 23 October 2026

Onify is reviewing the recently disclosed eMudhra certificate authority incident and the PHP vulnerabilities referred to as PHP2Shell. This article describes our current assessment, the scope of potential impact, and the work underway.

Current status

• eMudhra: Potential exposure identified. Further verification and preparation of updated releases are in progress.
• PHP2Shell: Not applicable to Onify’s delivered application components, which do not use PHP.

eMudhra CA incident

On 20 October 2026, details were published about compromised private keys associated with eight eMudhra intermediate CA certificates. Under certain conditions, these keys could be used to create fraudulent certificates that affected systems accept as legitimate. See Mozilla’s technical advisory.

Potential impact on Onify

Onify became aware of the incident on 21 October and completed its initial assessment on 22 October. Further verification of relevant components is ongoing.

Onify’s server components primarily use Node.js and are distributed as Docker images. Our review identified certificate trust data associated with the affected certificate chains in inspected images. Previously released images are being treated as potentially affected while verification continues.

The relevant exposure concerns how Onify components validate certificates when connecting to other services over HTTPS, including integrations and authentication services. It does not depend solely on who issued the certificate used to access an Onify installation.

Running Onify inside Kubernetes or OpenShift does not automatically remove this exposure: components inside the cluster may still establish outgoing connections and validate certificates presented by those services.

Risk assessment

Based on the information currently available, we assess the likelihood of successful exploitation in Onify deployments as low. A successful attack would generally require an attacker to influence a network connection and present a fraudulent certificate accepted by the affected component.

The potential consequences could nevertheless be serious, including interception or manipulation of data exchanged with another service. Actual exposure depends on the deployment’s configuration and network controls.

We have no information indicating that this issue has been exploited in Onify. Customer environment logs have not been reviewed as part of this assessment, so this should not be interpreted as confirmation that no exploitation has occurred.

Work in progress

The Node.js project published security updates addressing the eMudhra incident on 21 October. See the Node.js security release announcement.

We are preparing and verifying updated Onify releases. This work covers certificate handling in the application runtime and relevant operating system components within our Docker images. These can use different certificate stores, so updating operating system certificates alone may not cover the application’s certificate validation.

Verification includes checking that affected certificate chains are rejected and that legitimate integrations and authentication flows continue to work. Updated images will be published after verification is complete.

PHP2Shell

The vulnerabilities CVE-2026-109618 and CVE-2026-109619 affect PHP and can allow unauthenticated remote code execution in affected installations serving web requests. The PHP project published security updates on 21 October. See the official PHP security advisory.

Onify’s delivered application components use Node.js and JavaScript rather than PHP. These vulnerabilities are therefore not applicable to those components, and no PHP2Shell-specific patch is required for them.

This assessment does not cover separately installed PHP applications or third-party systems connected to Onify. Those systems need to be assessed by their respective owners.

Updates and recommendations

Based on our current assessment, we see no need to suspend use of Onify. We recommend upgrading to the relevant updated releases once they become available.

Release details, applicable versions, and upgrade guidance will be published on the Onify Support site and in our Changelog. We expect to provide further information shortly.

Onify is responsible for security updates to the software components and Docker images we deliver. For self-hosted installations, the customer’s operating organisation is responsible for the underlying infrastructure and deployment of updates.

For questions about your installation, please contact Onify Support.