CA trust break, nginx RCEs, runtime and library patches

Security traffic on 2026-10-24 focused on a certificate authority incident that forced urgent Python trust-store updates, alongside remote code execution and memory-safety fixes in nginx, Ruby, Godot, Apache Camel, and a Perl compression module. Several projects published patches after oss-security disclosures.

emSign root CA removed from certifi

An oss-security notice informed Python users of a security incident involving the eMudhra / emSign CA. The emSign root was removed from certifi, and Python ecosystem tools and interpreters shipped urgent updates to reduce man-in-the-middle risk. Python deployments that rely on the system or certifi trust store should apply the updates without delay.

nginx use-after-free and RCE flaws

F5 disclosed use-after-free and related flaws in nginx before 1.31.7 and 1.30.6, tracked as CVE-2026-93479 and CVE-2026-15176. Under specific AIO and SSI configurations the bugs can lead to remote code execution. Operators running affected nginx builds need to move to the fixed releases.

Ruby Onigmo Regexp RCE fixes

Ruby 4.0.9, 3.4.12 and 3.3.13 correct Onigmo Regexp compilation bugs that enable remote code execution. The issues were identified through related GitLab CVEs. Ruby users should upgrade to close the RCE paths.

Godot binary resource loader heap write

A heap out-of-bounds write triggered by a negative string length in Godot 4.x binary resource loading received a disputed CVE. Upstream merged a fix after a reconsideration request. Godot developers should pull the patched tree to eliminate the overflow.

Apache Camel Saxon XXE

CVE-2026-90885 describes a CVSS 7.5 XML external entity flaw in Apache Camel Saxon. When an already-parsed javax.xml.transform.Source is passed to XQueryBuilder under Saxon's default parser settings, an external entity declared in the message body is resolved. Applications using Camel-Saxon should apply the vendor fix.

Godot OptimizedTranslation bounds checks

Godot merged validation fixes for heap out-of-bounds reads in OptimizedTranslation message lookup after disputed CVE-2026-110736. The changes harden unsafe lookups that could produce memory-safety failures. Godot 4.x users benefit from the upstream patches.

Apache Camel AWS2-S3 expression injection

CVE-2026-95664 is a medium-severity issue in which the Camel-AWS2-S3 producer evaluates untrusted S3 object keys from the CamelAwsS3Key header as Simple expressions. Header values containing ${ or $simple{ can trigger injection. Camel deployments that accept external S3 keys should update and treat the header as untrusted.

Perl IO::Compress::Brotli decoder overflow

IO::Compress::Brotli versions from 0.004001 before 0.023 bundled a brotli library containing an out-of-bounds write in the decoder (brotli 1.0.4 through 1.2.0). The module was updated to drop the vulnerable decoder. Perl code that uses the Brotli bindings should upgrade the module.