Certificate trust breaks and critical server CVEs

Certificate authority compromise drove root and intermediate removals across trust stores, while Apache projects and others shipped fixes for high-severity flaws in common server software. Operators face urgent updates for TLS trust, CouchDB, Tomcat, PHP, and Roundcube.

eMudhra intermediate certificates compromised

Compromised eMudhra intermediate certificates covering TLS and code-signing prompted root removals and trust-store mitigations. Browser and operating system vendors are acting to limit exposure. Readers maintaining PKI or software signing pipelines need to verify whether affected intermediates remain trusted in their environments.

Apache CouchDB admin credentials enable OS code execution

CVE-2026-86471 lets CouchDB administrators reach code execution as the operating system user. The flaw is fixed in CouchDB 3.5.3. Deployments that expose admin interfaces should treat the update as mandatory.

Certifi removes emSign roots after key compromise

The certifi package released version 2026.10.19 that drops emSign root certificates following key compromise, reducing MITM risk for Python TLS clients. Container and application images that pin certifi require rebuilds to pick up the change.

Apache Tomcat JNDIRealm authentication bypass

CVE-2026-101296 describes a fail-open condition in Tomcat JNDIRealm credential validation for non-GSSAPI SASL mechanisms. Affected releases span Tomcat 7 through 11. Sites using JNDI-based authentication should apply vendor patches promptly.

PHP team pre-announces critical security release

The PHP project signaled an upcoming critical security release that addresses two vulnerabilities rated CVSS 9.2. Administrators should prepare for rapid upgrades once the packages ship.

CouchDB pre-authentication gzip decompression bomb

CVE-2026-90797 allows a pre-authentication denial-of-service via gzip decompression on POST /_session, scored CVSS 7.7. The issue is resolved in CouchDB 3.5.3 alongside the higher-severity admin flaw.

Apache Tomcat AJP response mix-up

CVE-2026-103119 covers a buffer under-read in Tomcat that can leak response data between requests sharing an AJP connection. Tomcat 11 is among the affected lines. Operators using the AJP connector should review the advisory and upgrade.

Roundcube webmail multiplevulnerability release

Roundcube published fixes in 1.6.20 and 1.7.5 for IMAP injection, SSRF bypasses, and header handling problems. Installations running earlier releases should move to the new versions to close the reported issues.