• eMudhra Certificate compromise - https://emudhra.we-have-a-problem.com
• PHP issue - https://cert.europa.eu/publications/security-advisories/2026-018/ . The recommendation here is to shut down your PHP sites entirely. FWIW, we have shutdown our own matomo, freescout, mautic, humhub .

We are also updating https://social.cloudron.io/@cloudron and https://x.com/CloudronIO as we get more information.

eMudhra Certificate compromise

Ubuntu has released the necessary CA store update - https://ubuntu.com/security/notices/USN-8944-1 .

To fix this, we need:

• Host package update
• Cloudron update
• Package updates. There are over 200 packages to be updated. This will happen over the coming days.

Host package update

Cloudron already enables automatic security updates on the host. But you can and should check this manually.

First run:

# dpkg-query -W -f 'installed: ${Version}\n' ca-certificates
installed: 20260816ubuntu0.26.04.1

This should say 20260816ubuntu0.26.04.1 atleast. The first part is the date, and it must be later than that. The last part of the string will differ based on your ubuntu version (for example, 20260816ubuntu0.22.04.1 is valid).

You can check when the above package arrived via automatic security update:

# grep -A2 'ca-certificates' /var/log/apt/history.log | tail -n 2
Upgrade: ca-certificates:amd64 (20260601~26.04.1, 20260816ubuntu0.26.04.1)
End-Date: 2026-10-21  06:59:55

If the ca-certificates was not updated, update ca-certificates package manually:

# apt-get update
# apt-get install -y ca-certificates

Now to be 100% sure, check that the cert is not in trust bundle:

# openssl crl2pkcs7 -nocrl -certfile /etc/ssl/certs/ca-certificates.crt  | openssl pkcs7 -print_certs -noout | grep -F "emSign ECC Root CA - G3"   && echo "STILL IN TRUST BUNDLE" || echo "removed from trust bundle"

It should say removed from trust bundle

Cloudron update

Cloudron 10.1.6 is coming soon with an update to nodejs - https://github.com/nodejs/node/releases/tag/v24.22.1 (via this change). You should update to Cloudron 10.1.6 at the earliest, when it's available. Other parts of Cloudron like nginx, docker will use the host CA bundle automatically and are safe. At this point, there is nothing you (the user) can do until we release this.

Package updates

This section is only for packagers. We have already started rolling out package updates.

Status as of 22 OCT 19:20 CEST - Around 175 packages have been updated. ~20 or so remain. We are working through them diligently. It's complicated because sometimes upstream has gone all silent.

New images:

cloudron/base:6.0.1@sha256:7b1e729960c3ca312d26e886917ba89483241bba0219ff292858e10d9d5768ee
cloudron/node-base:24-20261021@sha256:7435d8aca138ce01cfca4cd7ec05683223b8f5d7198c9abdaaefa1b6ba14b4c6 (Per https://nodejs.org/en/blog/vulnerability/october-2026-security-releases , Node.js v22.23.4, Node.js v24.22.1
Node.js v26.12.1 are updated)

I am investigating python. Per https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576, ensure pip >= 26.2.2 .

PHP issue

PHP versions are out -PHP 8.5.12 , PHP 8.4.27 , PHP 8.3.36
PHP 8.2.35 . We are building new packages . Special thanks to oerdnj from https://codeberg.org/oerdnj/deb.sury.org/issues/145

New base images: cloudron/php-base:8.5-20261021 and cloudron/php-base:8.4-20261021