The Control Plane — Week of Mon Oct 26, 2026

Eight eMudhra CA keys compromised, PHP2Shell and Node2Shell hit KEV, Kubernetes October patches finally ship, Node.js 26 goes LTS, and certificate lifetimes.

This week’s theme is the gap between a fix and its effect. Chrome distrusted a compromised CA in under two hours, but a site chaining to the removed root still has to change CAs. PHP and Node.js shipped patches on October 21, and attackers were getting shells days later on servers that hadn’t updated. The 100-day certificate cap starts in March, but most long-lived certificates we looked at will reach it months after that.

Kubernetes and cloud

The October patch round finally shipped on October 28, between about 04:37 and 04:56 UTC: 1.37.2, 1.36.6, 1.35.10, and 1.34.13. The patch release schedule had targeted October 13, then October 20, so the round landed 15 days after its original date. The 1.37 changelog shows why the wait was for Go: the releases are built with Go 1.26.10.

One change in that changelog is worth reading before your next upgrade. Servers built on k8s.io/apiserver now accept up to 16,384 request header values. Go 1.27 defaults to 500, which would reject impersonated or proxied users with about 500 or more groups with HTTP 431. If you run aggregated API servers or auth proxies built on your own Go toolchain, check that limit before moving to Go 1.27.

Kubernetes 1.34.13 is the final 1.34 patch, and it arrived one day after the branch’s October 27 end-of-life date on the releases page. Clusters on 1.34 should take 1.34.13 now and plan the move to 1.35 or later, because no further fixes are coming. The next patch round is scheduled for November 10, and 1.38.0-alpha.3 also went out on October 28.

TLS and certificates

The week’s PKI story started on Saturday, October 17. Google says it received a report at 18:05 UTC that the private keys of eight eMudhra subordinate CAs had been compromised. The keys had been generated with weak entropy. By 19:45 UTC, Chrome had shipped a CRLSet update that distrusts their public keys, and Android devices received an equivalent update through Google Play Services on Monday. Google found no TLS certificates chaining to the six TLS-issuing intermediates in Certificate Transparency logs before that update, and it says no other keys in its root stores share the same weak-entropy failure mode.

Chrome is also removing the emSign ECC Root CA - G3 from the Chrome Root Store, with the change reaching devices on the morning of October 27 (Pacific time). Sites that chain to that root need to move to another CA now, not at their next renewal. The Mozilla dev-security-policy thread has the incident discussion, and The Hacker News has a summary. If you pin intermediates or keep a private trust store, update it to match.

Two smaller changes are on the calendar. Let’s Encrypt moved staging to seven validation requests on October 27, and production follows on November 10. If your HTTP-01 or DNS setup allowlists validation sources or restricts by geography, test it against staging this week. Chrome also updated its quantum-resistant root program testing instructions on October 28. Chrome plans to use Merkle Tree Certificates for post-quantum authentication rather than X.509 certificates with post-quantum signatures.

Security

PHP2Shell is the week’s urgent patch. CISA added CVE-2026-109618 and CVE-2026-109619 to the catalog on October 26. Both are unauthenticated remote code execution flaws rated CVSS 9.2, and PHP fixed them on October 21 in 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The Register reports that AWS saw exploit attempts as early as October 17, that one researcher logged 35 successful shells across three honeypots on October 24 against PHP 8.4.26 under mod_php, and that a Delft University lab counted more than 50,000 requests from over 600 IP addresses. Check the PHP changelog and confirm the version your web server actually loads, not just the CLI version.

The Brotli decoder bug, CVE-2026-111497, now has names (Node2Shell, HTTP2Shell) and a KEV entry. CISA added it on October 27, alongside Adobe Commerce CVE-2026-48356. The flaw is an out-of-bounds write in Brotli 1.0.3 through 1.2.0. Node.js fixed it on October 21 in 22.23.4, 24.22.1, and 26.12.1, and Qualys explains how to find vulnerable runtimes. SecurityWeek reports honeypot attempts on October 26 and 27, and the exploit observed failed at its last stage. Failed attempts can still crash the process, so unpatched services are exposed to denial of service even when code execution fails. Google, Microsoft, Bun, Envoy, and Istio have fixes out. Broadcom lists VMware SDDC Manager as affected, with workarounds and patches still pending.

On October 28, CISA added two more: VMware ESX CVE-2026-41709 and Linux kernel CVE-2026-46300, the local privilege escalation known as Fragnesia. The kernel bug was disclosed in May, and distributions such as Ubuntu have shipped fixed kernels since then. TNW reports that a campaign paired PHP2Shell with Fragnesia to gain root on 25 servers, 24 of them firewalls. That chain is the case for patching kernels on web hosts even when a flaw is “only” local. GKE users can check node image status in Google’s security bulletins.

Web development and tooling

Node.js 26.13.0 became the active LTS line, codename “Lithium,” on October 28. It has no code changes from 26.12.1, so teams already on the October security release are on LTS code. Support runs through the end of April 2029, according to the previous releases page. Node.js 24.22.2 went out the same day.

This is the last LTS under the old schedule. The new release schedule has one major release a year in April, LTS in October, and version numbers that match the year: 27.0.0 ships in April 2027 and becomes LTS that October. Every release will become LTS. If you only upgrade to LTS versions, little changes beyond the numbering, but update any CI rules that assume odd-numbered releases are short-lived.

SRE and reliability

Cloudflare’s Ashburn (IAD) data center had a rough month. On October 28, Cloudflare opened an incident at 04:39 UTC for network performance issues in IAD, warning of elevated latency and 5xx errors. It moved to monitoring at 05:05 and closed at 22:18 UTC. The same day brought increased Durable Objects errors in Eastern North America, which can also affect D1, Queues, and Workflows. The status feed shows several other Ashburn incidents in October, including prefix withdrawals by an external provider that caused timeouts in IAD and Columbus.

The lesson for operators isn’t to avoid one PoP. It’s to know which of your dependencies are regional. Edge traffic reroutes around a bad data center, but Durable Objects and the services built on them live in a region. If your app writes state there, alert on errors by region and decide ahead of time what a degraded write path should do.

Chart of the week: who still serves long-lived certificates

The CA/Browser Forum’s lifetime limits cut maximum TLS validity from 398 days to 200 days in March 2026, and to 100 days on March 15, 2027. To see what developer infrastructure actually serves today, we pulled the most recent indexed certificate for 60 developer domains from CertIndex on October 29. Forty-eight returned complete dates. The dataset is here.

Nineteen of the 48 domains serve certificates longer than 100 days. Six still hold one-year certificates issued before the 200-day cap. The last of those, tailscale.com’s, expires on March 18, 2027, three days after the 100-day limit begins.

The cap doesn’t reach these domains on March 15. A certificate issued on March 14 can still last 200 days. If these 19 domains renew with about 30 days left, each will renew at least once more before the cutoff and get another certificate of up to 200 days. Their first 100-day certificates would then arrive between spring and late summer 2027, and after that they’ll renew roughly twice as often as now. Teams with manual or ticket-driven renewal have until then to automate it.

Two caveats. For 13 domains, all on 90-day certificates, the most recent indexed certificate had already expired, which means the replacement wasn’t indexed yet. Their lifetimes still reflect the issuer’s profile. Twelve domains were left out because their records lacked dates or their inventories hadn’t loaded. Treat the counts as a lower bound.

From the workshop

Three new pieces since the last recap. The certificate lifetime checker shows the lifetimes a domain’s certificates have had and how they compare with the 200-, 100-, and 47-day limits, and the cert lifetime guide explains how to read it. ACME Renewal Settings for 64-Day Certificates lists the renewal thresholds in Certbot, cert-manager, Caddy, lego, acme.sh, Traefik, and win-acme, and which ones need changes. And our write-up of the OVHcloud CLI release swap covers how to verify release archives against their builds.

Recommended reading

• Read Google’s eMudhra post and check whether any of your chains end at emSign ECC Root CA - G3.
• Check your PHP version against the PHP changelog and your Node.js runtimes against the 26.13.0 release notes.
• Use the certificate lifetime checker to see how long your own certificates last today.

Tags: #weekly-recap, #tls, #pki, #kubernetes, #nodejs, #php, #kev, #sre