Security and cryptography digest for 2026-10-23

Critical remote code execution in PHP and a compromised intermediate certificate authority led the day's disclosures. Additional high-severity fixes landed for Node.js, OpenStack Ironic, AIDE, and HAPI FHIR.

PHP unauthenticated RCE via use-after-free

A use-after-free in PHP core, tracked as CVE-2026-109619, enables unauthenticated remote code execution through stale global state. The issue carries a CVSS score of 9.2 and affects versions 8.2 through 8.5, with roots reaching back to 5.4 and later. Fixes are available and discussion on oss-security also covered a related second CVE.

eMudhra intermediate CA keys compromised

Flawed P-384 key generation left eMudhra intermediate CA keys compromised, prompting Mozilla and other trust-store maintainers to remove the affected roots and apply mitigations. The same incident forced updates to Python packaging components including certifi, pip, and uv, plus expedited Python releases, to block man-in-the-middle attacks against pypi.org.

Node.js security release for DNS and TLS

Node.js published updates across its active release lines that address high-severity CVEs in DNS and TLS handling together with assorted dependency fixes. Operators running production Node.js services should apply the 2026-10-21 packages promptly.

OpenStack Ironic Redfish path injection

OpenStack issued OSSA-2026-047 for CVE-2026-90458, a path-injection flaw in Ironic's Redfish vendor_passthru method. An attacker who can supply a crafted ID can cause the service to issue arbitrary requests to a baseboard management controller.

HAPI FHIR cross-tenant and authorization flaws

Four CVEs (CVE-2026-113873 through CVE-2026-113876) were published for HAPI FHIR. They include a cross-tenant partition override rated CVSS 8.1, additional authorization bypasses, and a gzip-driven heap-exhaustion issue that matter for multi-tenant healthcare deployments.

AIDE detection bypasses via null bytes and invalid UTF-8

AIDE versions through 0.19.4 improperly compare hash values that contain a null byte and mishandle file names with invalid UTF-8 sequences. Both flaws, tracked under GHSA-6wc9-4w69-5jc5 and GHSA-wq25-fm54-5q3q with CVEs still pending, allow an attacker to evade file-integrity detection.