Courier's Response to the eMudhra and PHP Security Issues

Courier reported that its certificates, customer data, and production services were not affected by the compromise of eight eMudhra/emSign intermediate certificate keys or by two critical PHP vulnerabilities disclosed in October 2026. Browser vendors and major platforms rapidly revoked or blocked trust in the affected certificates, while Courier began deploying updated Node.js releases that remove trust in the compromised certificate chains, with completion expected by October 22. Customers are advised to update Node.js, other language runtimes and HTTP libraries, operating-system certificate packages, and container images, particularly for services making HTTPS connections or receiving Courier webhooks. The PHP flaws, CVE-2026-109618 and CVE-2026-109619, could permit unauthenticated remote code execution on vulnerable web servers, but Courier does not use PHP in production; users of its PHP SDK should update their own PHP installations to the specified fixed releases.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.