eMudhra plans its TLS exit. One private key was 4.

eMudhra commits to leaving global TLS

eMudhra’s board has decided to withdraw from the global SSL/TLS certificate business. The follow-up to the compromised-intermediates story is quite something.

Aikido’s analysis says all eight affected private keys were integers below 256; one was 4. eMudhra’s preliminary explanation points to a key-generation wrap/unwrap step producing weak keys that were mistakenly published. It denies an infrastructure compromise and says those intermediates issued no end-entity certificates. The root-cause investigation remains open.

The company promises free replacements through partners and continued revocation/status services until issued certificates expire or are replaced.

GitLab fixes unauthenticated RCE across seven branches

GitLab has fixed CVE-2026-110264, an integer overflow when compiling a crafted regular expression that can, under certain conditions, allow unauthenticated server-side code execution. CE/EE releases back to 7.0 are affected; the full exploitation conditions aren’t disclosed.

Fixes are in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. GitLab.com is patched. Self-managed operators have a scheduling wrinkle: the upgrade includes database migrations, and GitLab warns of downtime on single-node installations.

The release notice doesn’t establish in-the-wild exploitation.

Node.js Brotli RCE reaches beyond inbound requests

Node.js has also fixed an RCE, CVE-2026-111497, in Brotli decoding. Exposure depends on your application or a dependency decompressing attacker-controlled data; Node.js doesn’t do that automatically.

Vercel says it demonstrated memory disclosure and command execution on unpatched supported versions. Its WAF blocks the inbound path, not malicious responses your service fetches. That distinction is worth checking before calling the edge rule a fix.

Patched versions are 22.23.4, 24.22.1 and 26.12.1. End-of-life Node.js 20 won’t receive this fix.

Microsoft attributes ConnectWise compromise to Storm-0940

Microsoft now attributes the ConnectWise multi-tenant application compromise to China-state-aligned Storm-0940. It reports attempted sign-ins against more than 2,250 tenants, not 2,250 confirmed compromises.

Microsoft also says the actor used ARTEX agentic AI to accelerate reconnaissance, password spraying and OAuth abuse. Across the broader ARTEX campaign, it reports multiple cases progressing from initial targeting to privileged cloud access in less than three hours.

The persistence detail deserves attention: Microsoft observed follow-on application credential and privilege changes that can outlast remediation of the original app. It cautions that even successful authentication doesn’t establish data access or exfiltration.

Fisher & Paykel Healthcare discloses personal-information exposure

Closer to home, Fisher & Paykel Healthcare disclosed unauthorised access to two employee email accounts and a subset of company files, some containing personal information. It says it’s notifying affected people and has notified authorities.

The company reports no evidence that its patient-data system was compromised, and no impact on products, manufacturing or supply chain. It believes the incident is contained. The affected-person count, access method and intrusion date remain undisclosed.