SANS Stormcast Wednesday, October 21st, 2026: eMudhra Intermediate CA Certificates Revoked; Critical PHP Security Release; Oracle CPU E-Business Suite SQLi (CVE-2026-101767); FortiSIEM gRPC RCE PoC

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10144.mp3

previous

eMudhra Intermediate CA Certificates Revoked; Critical PHP Security Release; Oracle CPU E-Business Suite SQLi (CVE-2026-101767); FortiSIEM gRPC RCE PoC

00:00

iTunes

MP3 Download

RSS Feed

Google

Podbean

Amazon Echo

YouTube

Spreaker

Spotify

Discussion

Login here to join the discussion.

Podcast Transcript

 Hello and welcome to the Wednesday, October 21st, 2026
 edition of the SANS Internet Storm Center's Stormcast. My
 name is Johannes Ullrich, recording today from
 Jacksonville, Florida. And this episode is brought to you
 by the SANS.edu Master's Degree Program in Information
 Security Engineering. Well to start out with, it's PKI time
 again and with that we have eight intermediate CA
 certificates that have been revoked. These certificates
 belonged to eMudhra and this is an Indian company. Now luckily
 at least for us web PKI users, most of certificates and
 hundreds of millions of certificates that they issued
 are personal signing certificates. So they're not
 used to verify the identity of websites. Apparently they have
 a couple hundreds or so at most web certificates that
 they issued. The problem here wasn't a breach of the
 certificate authority. It was a simple script error as they
 created these certificates. The private keys that go with
 these certificates were just one byte long. This was
 apparently a problem as they sort of set up the key
 creation ceremony in their hardware security module and
 that led to this problem. A blog post today did reveal
 this issue and yes the certificates have been
 revoked. Browsers no longer recognize them. I tested a
 couple earlier and they have refused the connection. The
 blog post I'll link to in the show notes does have lots of
 tips how to check that you're not trusting the certificates
 anymore and also sort of a little web page that basically
 checks for your browser whether or not it loads pages
 that are verified by the affected certificates. So yeah
 definitely keep your certificate authority files up to date.
 The problem here is that in particular like curl on the
 Mac for example such some software uses its own set of
 authority file basically a list of sort of authorities
 they trust and they're not always updated with these sort
 of system wide updates as they happened here. And usually I
 talk about vulnerabilities that were just patched or that
 were just exploited. Well luckily at least from the
 exploit point of view the next vulnerability is neither and
 that's a critical vulnerability in PHP actually
 two distinct vulnerabilities that will be addressed in a
 patch released on Wednesday tomorrow October 21st. The
 problem here is that originally the patch was
 supposed to come out Thursday but today some information
 about this vulnerability leaked so they accelerated the
 rollout of the patch. All versions of PHP going back to
 version 5 are affected but only version 8 is currently
 still supported and will receive updates. Now what
 makes it a little bit scary is that the CVSS score is 9.2
 others described it as a CVSS score of 10 watchTowr sort of
 just wrote an X post that they're aware of the
 vulnerability and they're going to release details after
 the patch has been released so we should expect an exploit
 also to be ready fairly soon after the patch release. So we
 have to wait for the patch release. No details yet as to
 what exact configuration or such is vulnerable but it's a
 vulnerability in PHP core so it's not in an extension. It
 shouldn't matter what extensions you have or have
 not installed. So if you're using PHP be ready for this
 and this is something you definitely want to roll out as
 fast as possible but again we have to wait for some of the
 details to see if you have to see the details once the patch
 comes out and that should be 10 a.m. Eastern on Wednesday.
 And Oracle today released its critical patch update advisory
 for October fixing 1295 new security vulnerabilities. Now
 there's one vulnerability I want to point out a little bit
 and that's a SQL injection vulnerability in the Oracle
 E-Business Suite. Horizon3 they announced that they will
 publish some details about and they already on X kind of gave
 some hints what this vulnerability is all about. So
 that's definitely something to watch out for if you're
 running Oracle E-Business Suite definitely take a look at this
 and make sure that you're patched or not vulnerable to
 this particular vulnerability. And that's CVE-2026-101767.
 Over the last few months we had a couple different
 vulnerabilities being patched by Fortinet in its FortiSIEM
 product. Well we now have a proof of concept exploit for a
 vulnerability that was patched exactly a week ago on October
 13th. This exploit attacks the gRPC service. It's a path
 traversal file write that then allows for remote code
 execution. And the one saving grace here is that it does
 require access to a very specific port 27918. So it
 shouldn't be too difficult to block that at a firewall kind
 of to buy you some time here in case you haven't patched
 yet. Well and that's it for today. So thanks for
 listening. Thanks for liking. Thanks for recommending this
 podcast. And talk to you again tomorrow. Bye.