# eMudhra plans its TLS exit. One private key was 4. > GitLab and Node.js fixes, ConnectWise attribution, and a New Zealand breach disclosure. - Series: It's Probably Nothing - Publisher: Sierra Echo Charlie - Edition date (Pacific/Auckland): 2026-10-23 - Edition number: 9 - Status: Published edition - Language: en-NZ - [Canonical web edition](https://ipn.nz/editions/2026-10-23) - [Download PDF](https://ipn.nz/pdf/IPN-2026-10-23.pdf) - [MP3 audio](https://ipn.nz/audio/IPN-2026-10-23.mp3) (3:18, 3170263 bytes) - [Standalone transcript](https://ipn.nz/transcripts/2026-10-23.md) ## 1. eMudhra commits to leaving global TLS eMudhra’s board has decided to withdraw from the global SSL/TLS certificate business. The follow-up to the compromised-intermediates story is quite something. Aikido’s analysis says all eight affected private keys were integers below 256; one was 4. eMudhra’s preliminary explanation points to a key-generation wrap/unwrap step producing weak keys that were mistakenly published. It denies an infrastructure compromise and says those intermediates issued no end-entity certificates. The root-cause investigation remains open. The company promises free replacements through partners and continued revocation/status services until issued certificates expire or are replaced. ### Sources - [eMudhra to Exit global SSL/TLS Certificate Business]() — primary source - [eMudhra Statement on distrust of select Global TLS Intermediate and one Root CA]() — primary source - [eMudhra CA compromise: eight private keys, and one of them is 4]() — primary source - [eMudhra kills its certificate business after researchers cracked its private keys in under a second]() — reporting/context - [eMudhra Intermediate Key Compromise Triggers Firefox Blocks and Emergency Go Updates]() — reporting/context ## 2. GitLab fixes unauthenticated RCE across seven branches GitLab has fixed [CVE-2026-110264](), an integer overflow when compiling a crafted regular expression that can, under certain conditions, allow unauthenticated server-side code execution. CE/EE releases back to 7.0 are affected; the full exploitation conditions aren’t disclosed. Fixes are in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. GitLab.com is patched. Self-managed operators have a scheduling wrinkle: the upgrade includes database migrations, and GitLab warns of downtime on single-node installations. ### Qualifications The release notice doesn’t establish in-the-wild exploitation. ### Sources - [GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13]() — primary source - [GitLab Patches CVSS 10.0 Unauthenticated RCE Affecting Releases Back to Version 7.0]() — reporting/context ## 3. Node.js Brotli RCE reaches beyond inbound requests Node.js has also fixed an RCE, [CVE-2026-111497](), in Brotli decoding. Exposure depends on your application or a dependency decompressing attacker-controlled data; Node.js doesn’t do that automatically. Vercel says it demonstrated memory disclosure and command execution on unpatched supported versions. Its WAF blocks the inbound path, not malicious responses your service fetches. That distinction is worth checking before calling the edge rule a fix. Patched versions are 22.23.4, 24.22.1 and 26.12.1. End-of-life Node.js 20 won’t receive this fix. ### Sources - [Wednesday, October 21, 2026 Security Releases]() — primary source - [Node.js security advisory: Brotli decoder RCE (CVE-2026-111497)]() — primary source ## 4. Microsoft attributes ConnectWise compromise to Storm-0940 Microsoft now attributes the ConnectWise multi-tenant application compromise to China-state-aligned Storm-0940. It reports attempted sign-ins against more than 2,250 tenants, not 2,250 confirmed compromises. Microsoft also says the actor used ARTEX agentic AI to accelerate reconnaissance, password spraying and OAuth abuse. Across the broader ARTEX campaign, it reports multiple cases progressing from initial targeting to privileged cloud access in less than three hours. The persistence detail deserves attention: Microsoft observed follow-on application credential and privilege changes that can outlast remediation of the original app. It cautions that even successful authentication doesn’t establish data access or exfiltration. ### Sources - [AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise]() — primary source - [Storm-0940 ARTEX attacks: ConnectWise app abuse and Okta sign-ups]() — primary source - [Compromised ConnectWise Backup Credential Enables Access to 162 Microsoft 365 Tenants]() — reporting/context ## 5. Fisher & Paykel Healthcare discloses personal-information exposure Closer to home, Fisher & Paykel Healthcare disclosed unauthorised access to two employee email accounts and a subset of company files, some containing personal information. It says it’s notifying affected people and has notified authorities. The company reports no evidence that its patient-data system was compromised, and no impact on products, manufacturing or supply chain. It believes the incident is contained. The affected-person count, access method and intrusion date remain undisclosed. ### Sources - [F&P Healthcare statement regarding cyber incident]() — primary source - [New Zealand's Fisher & Paykel Healthcare hit by cyber breach]() — reporting/context ## Audio transcript Narrated using an AI voice. This is It's probably nothing for 23 October. eMudhra's board has decided to leave the global SSL/TLS certificate business. The follow-up to the compromised-intermediates story is quite something: Aikido says all eight affected private keys were integers below 256. One was 4. eMudhra's preliminary explanation points to a key-generation wrap/unwrap step producing weak keys that were mistakenly published. It denies an infrastructure compromise and says those intermediates issued no end-entity certificates. The root-cause investigation remains open. It promises free replacements through partners, and continued revocation and status services until issued certificates expire or are replaced. Meanwhile, GitLab has fixed an integer overflow when compiling a crafted regular expression. Under certain conditions, it can allow unauthenticated server-side code execution. Community and Enterprise releases back to 7.0 are affected, but the full exploitation conditions aren't disclosed. Fixes cover seven release branches, and GitLab.com is patched. For self-managed operators, the upgrade includes database migrations, and GitLab warns of downtime on single-node installations. The notice doesn't establish in-the-wild exploitation. Node.js has also fixed remote code execution, this time in Brotli decoding. Exposure depends on your application or a dependency decompressing attacker-controlled data. Node.js doesn't do that automatically. Vercel says it demonstrated memory disclosure and command execution on unpatched supported versions. Its WAF blocks the inbound path, not malicious responses your service fetches. That distinction is worth checking before calling the edge rule a fix. Fixes are available for Node 22, 24 and 26. End-of-life Node 20 won't receive one. On ConnectWise, Microsoft now attributes the multi-tenant application compromise to China-state-aligned Storm-0940. It reports attempted sign-ins against more than 2,250 tenants, not 2,250 confirmed compromises. Microsoft says the actor used ARTEX agentic AI to accelerate reconnaissance, password spraying and OAuth abuse. Across the broader ARTEX campaign, it reports multiple cases going from initial targeting to privileged cloud access in less than three hours. Microsoft also observed follow-on application credential and privilege changes that can outlast remediation of the original app. It cautions that even successful authentication doesn't establish data access or exfiltration. Closer to home, Fisher & Paykel Healthcare disclosed unauthorised access to two employee email accounts and a subset of company files, some containing personal information. It says it's notifying affected people and has notified authorities. The company reports no evidence its patient-data system was compromised, and no impact on products, manufacturing or supply chain. It believes the incident is contained. The affected-person count, access method and intrusion date remain undisclosed. That's it for this edition. Thanks for listening. Don't forget, all our threat intelligence comes from Mallory dot A I and open sources. If you want intelligence your team can act on, reach out for a chat. ## Publisher Researched by our AI agents using [Mallory](https://mallory.ai) and original sources. Reviewed and published by [Sierra Echo Charlie](https://sierraechocharlie.com). Want intelligence your team can act on? [Reach out for a chat.](mailto:letsgo@sierraechocharlie.com)