Is the Internet a Threat? eMudhra's Cracked Certificate Keys, PHP2Shell, Node.js and the Railway Breach: One Week of Vulnerabilities, and What It Costs You

Every time you see the small padlock beside a website's address, you are trusting a chain of strangers: a company that vouched for the site, the browser that trusts that company, and the software running on the site itself. In one week that chain cracked in four places. On 17 October 2026 a researcher showed that eight certificate authority keys belonging to eMudhra, a listed Indian company, could be worked out in milliseconds; one of them was simply the number 4. On 21 October the PHP project shipped emergency fixes for PHP2Shell, two flaws that let a stranger take over a server running the language behind most of the web. The same day Node.js fixed ten flaws, and Railway, a cloud platform used by more than 2 million developers, paused every deployment after an intruder reached its customers' secrets. None of this has yet been tied to a confirmed theft from an ordinary Indian user. But each crack shows how much of daily life, from bank logins to GST filing, now rests on systems few of us ever see. Here is what happened, what it means for your money and your data, and what to do.

Written on 22 October 2026, while two of these stories are still moving. Facts come from the companies' and projects' own disclosures (eMudhra, Google, Mozilla, Cloudflare, php.net, Node.js, Railway), CERT-In's advisories, eMudhra's stock exchange filings and NSE's price data, and Government replies in Parliament published by PIB. Where sources disagree, the article says who says what.

The short answer: what broke, and does it touch you?

eMudhra: when the internet's ID cards could be forged

A website's certificate works like an identity card: it proves that the site you reached really is your bank and not an impostor. Certificate authorities (CAs) issue these cards, and browsers trust a short list of them. eMudhra, which is listed on NSE and BSE, is one of those CAs worldwide, and separately a licensed CA in India for the digital signature certificates (DSCs) used to sign income tax returns, GST returns and company filings.

What went wrong. On 30 April 2025 eMudhra created a batch of intermediate certificates, the middle links of its chain of trust. Because of a flaw in how the keys were wrapped for export, eight of them ended up with private keys that were tiny numbers, all below 256. Mozilla's engineers described them as effectively all zeroes apart from the last byte. Security researcher Scott Helme recovered all eight on a laptop in under a second, and wrote that one of them was the number 4. A key like that is no lock at all: anyone holding it could have issued a convincing certificate for any website. The weak keys sat in public view for about 17 months.

How fast the fix came. The timeline, all in UTC on 17 and 18 October:

1. 18:05, 17 October. A researcher's report reached Google's Chrome Root Program.
2. 19:45. Chrome pushed a block on the eight certificates to users without any update on their part.
3. 20:06. Mozilla received the report. It rebuilt the keys itself within two hours and had Firefox users protected by 22:59.
4. 18 October. eMudhra revoked all eight between 09:24 and 09:38. The company says this was within 14 hours of discovery.

Mozilla then decided on an emergency removal of eMudhra's ECC root, the top of that chain, and Google says Chrome removes it on 27 October. Cloudflare, Go and Node.js shipped their own fixes.

Was anyone harmed? Nothing found so far:

• Google says no website certificate chaining to the six affected website intermediates was logged in Certificate Transparency, the public record browsers check, before Chrome's block.
• eMudhra says seven of the eight were never used in production and the eighth issued no certificates.
• Cloudflare found no active exploitation on its network.

The risk that remains sits in software that does not check those public logs or update its trusted list on its own: older scripts and servers, internet-of-things devices, and tools built on curl, Python, Java or Go. Until those are updated, they would accept a forged certificate. Cloudflare's advice to developers is blunt: never "fix" a certificate error by switching verification off.

Your digital signature certificate is safe. This is the question most Indian taxpayers, professionals and directors will ask. CERT-In's advisory CIAD-2026-0050 of 21 October separates eMudhra's two businesses and says digital signature certificates and eSign services, regulated by the Controller of Certifying Authorities (CCA) under MeitY, are not impacted. eMudhra's filings with NSE and BSE on 21 and 22 October say the same: its Indian DSC and eSign services run on separate infrastructure. You do not need to replace your DSC because of this incident. If someone calls asking for your DSC token, PIN or OTP "because of the eMudhra problem", that is not how this incident works; do not share them.

The money. eMudhra's shares closed at ₹540 on 19 October. NSE was shut on 20 October for Dussehra. On 21 October, the first trading day after the news, the stock fell to its 20% lower limit and closed at ₹432; on 22 October it hit the lower limit again, at ₹345.60, a 52-week low. That is a fall of about 36% in two sessions, with about ₹126 crore and ₹317 crore of shares changing hands on the two days. The same evening eMudhra told the exchanges that its board had decided to withdraw from the global SSL/TLS certificate business. Its chairman put that business at about 1% of revenue, and the company's earlier filing flagged a reputational risk it could not quantify. Shareholders are now pricing that risk, not the 1%.

The trust question. Google's root program criticised eMudhra's public notice for not naming the affected root or telling customers how to check. eMudhra's chairman blamed "social media amplification". Both can be true at once. For a company whose product is trust, the speed and clarity of disclosure is part of the product.

PHP2Shell: a flaw under most of the web

PHP is the language that quietly runs most websites. W3Techs counts it on 69.3% of websites whose server-side language is known, and WordPress, written in PHP, on 39.6% of all websites. Many small Indian businesses, schools, hospitals and news sites sit on it, often on a cheap shared host.

The flaws. CVE-2026-109618 and CVE-2026-109619 are two memory bugs in PHP's core. The PHP project rates each "critical", 9.2 on the CVSS v4.0 scale. Either lets an outsider send a crafted web request and run their own code on the server before the website's own code even starts: no password, no login. The project says every PHP setup that serves web requests is exposed, and it considers the risk highest for the classic Apache "mod_php" setup.

Wiz, one of the teams credited with finding them, showed full takeovers of WordPress, Drupal and Joomla and the theft of passwords and keys from server memory. Wiz says it used AI models in the hunt.

The fix. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were released on 21 October; details had leaked the day before, according to watchTowr, a security firm. Versions 8.1 and older get no official release. The PHP security team published source-only backports for 7.4, 8.0 and 8.1 for those who build PHP themselves. The interim settings it lists "reduce exposure to specific attack paths but do not make an installation safe".

Is it being exploited? Sources disagree.

• Yes:
  • Amazon's threat intelligence team saw an attempt on its decoy servers on 17 October, four days before disclosure, and says PHP2Shell "is now being broadly exploited in the wild", while adding that it is unclear whether any attempt succeeded.
  • CERT-In's alert of 22 October says "Multiple reports confirm large scale exploitation in the wild, users are advised to patch urgently."
• Not confirmed:
  • Cisco Talos said it had not seen exploitation as of 14:00 UTC on 21 October.
  • The US cyber agency CISA had not added either flaw to its list of known exploited vulnerabilities when we checked on 22 October.

For a website owner the difference does not matter: patch now.

The social cost is in old versions. Among sites running PHP, W3Techs finds 26.9% still on version 7 and 7.7% on version 5. Neither gets official updates any more. Talos estimates that about half of PHP systems will not be patched. These are disproportionately the sites of small firms and institutions that set up a website years ago and have not touched it since, and the customers whose data they hold.

Node.js and npm: cracks in the software supply chain

Node.js runs JavaScript on servers, and npm is its library of ready-made building blocks. In the week of 12 to 18 October alone, packages were downloaded from npm more than 110 billion times. That reuse is what makes modern apps cheap to build. It is also why one weak block can spread to thousands of products.

Ten flaws, one serious. On 21 October the Node.js project released fixes for ten vulnerabilities, four rated high, three medium and three low, across its 26, 24 and 22 release lines:

• The worst, CVE-2026-111497, is a write beyond the end of a memory buffer in the Brotli decompressor, which can allow remote code execution.
• The fixed versions are 26.12.1, 24.22.1 and 22.23.4.
• End-of-life versions are, in the project's words, "always affected". Node.js 20 reached end of life on 30 April 2026.
• Linked to eMudhra: the same release updated the certificates Node.js carries, to drop eMudhra's compromised intermediates.
• In India, CERT-In rated the release HIGH in note CIVN-2026-0512.

Packages anyone could take over. Two separate problems hit npm itself:

• A publishing gap. Bloom Security reported that a gap in npm's "trusted publishing" let an outsider publish new versions of other people's packages. It counted more than 1,500 exposed packages with over 10 million downloads between them. Bloom reported it to GitHub, which runs npm, on 6 June. GitHub's fix came on 2 October, nearly four months later: unverified publishing settings now expire after 48 hours. Bloom says it tested only on its own packages and saw no misuse.
• Booby-trapped packages. In a separate campaign, called MALFEX, eight malicious npm packages carrying password-stealing and remote-control malware for Windows had been downloaded 40,767 times by early October, according to Checkmarx.

For businesses the lesson is that a product is only as safe as the code it borrows. That is a cost, in reviews and audits, which small software firms rarely budget for.

Railway: when the keys to the cloud leak

Railway is a platform where developers deploy apps without managing servers; its homepage says more than 2 million developers use it. On 21 October it disclosed that it "detected anomalous activity involving systems that store customer environment variables". Environment variables are where apps keep their passwords and API keys: the keys to payment gateways, databases and AI services. Railway said an unauthorised party may have accessed the encrypted variables "and, for some of them, obtained the decrypted contents". It believes this was "part of a series of attacks recently targeting platform companies with the aim of compromising AI inference providers".

What Railway did:

• It paused every deployment and invalidated login sessions, every API token and its storage credentials.
• It told every customer to "immediately roll all environment variables, including any API keys" and to review their logs.
• It says the impact "may be limited to a subset of users", gave no count, and will email those affected.
• On its status page, deployments came back first for Enterprise customers, then Pro. Hobby, Free and Trial users were still waiting the next morning.

The money. Taylor Monahan, an independent blockchain security researcher, says crypto keys stored on Railway were used to drain about $371,000 across more than 19 blockchains in over 500 transactions, starting at 19:36 UTC on 21 October. That was about two hours before Railway's public notice on X. Railway has not confirmed the figure, and it may grow. The lesson is old but expensive: a secret stored in one place is only as safe as that place, and it must be changed the moment that place is breached.

The money: what cyber failures cost India

None of the four incidents has yet produced an Indian loss figure. India's own numbers, though, show where the money goes:

Three more figures complete the picture.

• Money saved: the Citizen Financial Cyber Fraud Reporting and Management System, behind the 1930 helpline, had saved more than ₹11,158 crore across 32.80 lakh complaints by 30 June 2026, by freezing money before it left the system.
• Money returned: very little. For 2023-24 to 2025-26 the Government reported ₹56,087 crore of complaints, ₹9,079 crore placed under lien, and only ₹206 crore refunded to victims, about 0.37%.
• Cost to companies: IBM's 2026 Cost of a Data Breach study, a survey rather than official data, puts the average cost of a breach to an Indian organisation at ₹25.5 crore, up 15.9%, and ₹40.9 crore in financial services.

The law is catching up, slowly. Since 2022, CERT-In's directions require organisations to report a cyber incident, including a data breach, within six hours of noticing it, and to keep logs for 180 days. The Digital Personal Data Protection Act, 2023 adds penalties of up to ₹250 crore for failing to protect personal data, and up to ₹200 crore for not reporting a breach to the Data Protection Board and the people affected. The DPDP Rules, 2025 add a detailed report to the Board within 72 hours. But under the notification of 13 November 2025, those duties and penalties take effect 18 months after it, in May 2027. Today the main legal lever after a breach is still CERT-In reporting.

The social side: trust, AI and the people hit hardest

• Trust is the real currency. Taxpayers sign returns with DSCs, banks send OTPs, and governments run services online. Each depends on certificates and software most people never see. When a trusted name stumbles, the cost is paid in caution: people hesitate to transact online. That is why CERT-In's clear statement that Indian DSCs and eSign are safe matters as much as the technical fix.
• AI cuts both ways. Wiz says it used AI models to find PHP2Shell, and Scott Helme writes that a simple prompt to an AI agent recovered eMudhra's keys. Finding flaws is becoming cheaper for defenders and attackers alike, so the time between a flaw's discovery and its abuse is shrinking.
• Small players carry the most risk. The sites still on old PHP, the free-tier developers who waited longest for Railway, and the small firms without a security team are the least able to patch quickly. They often hold customer data all the same.
• Victims rarely get money back. With 0.37% of reported fraud refunded, prevention is not just advice but the only reliable protection most families have.

Is the internet a threat? The case for and against

On the evidence of this week, the internet itself is not the threat. Unpatched software, old versions nobody owns, and secrets stored carelessly are. The systems that update themselves were protected within hours; the ones that do not stay exposed until someone acts.

What to do now: a checklist

For everyone

1. Update your browser, phone and computer today. Chrome and Firefox blocked eMudhra's compromised certificates within hours. Other software and older devices get the same protection only once updated.
2. Never click through a certificate warning on a banking, tax or shopping site; close the tab instead.
3. Keep your DSC as it is. It is not affected. Never share its token PIN or an OTP with anyone who calls about it.
4. If money is taken, call 1930 at once or report on cybercrime.gov.in. Money can be frozen only while it is still moving.

For website owners and small businesses

1. Find your PHP version in your hosting panel and move to 8.2.35 or later, or ask your host in writing whether PHP2Shell is patched.
2. Update WordPress and plugins, and drop any you no longer use.
3. If you have customer data, know your CERT-In six-hour reporting duty, and start preparing for the DPDP duties that begin in May 2027.

For developers and IT teams

1. Update Node.js to 26.12.1, 24.22.1 or 22.23.4, and plan off any end-of-life version.
2. Update certificate stores in containers, build pipelines and devices: the operating system's store, Go, Python and Java. Never disable certificate verification to silence an error.
3. If you use Railway, rotate every key and password stored in its environment variables: payment, database, cloud and AI keys. Then check usage logs.
4. Review your npm dependencies, and the publishing settings on any package you maintain.

Frequently Asked Questions

Is my digital signature certificate (DSC) safe after the eMudhra incident? Yes. CERT-In's advisory CIAD-2026-0050 says digital signature certificates and eSign services regulated by the Controller of Certifying Authorities under MeitY are not impacted, and eMudhra's stock exchange filings say its Indian DSC and eSign services run on separate infrastructure. You can keep signing ITR, GST and MCA filings as before.

What exactly happened at eMudhra? Eight intermediate certificate authority certificates created on 30 April 2025 had private keys so small, all below 256, that they could be worked out from the public certificates in milliseconds. Anyone holding them could have issued fake website certificates. Browsers blocked them on 17 October 2026, eMudhra revoked them on 18 October, and no misuse has been found.

Why did eMudhra's share price fall? The stock hit its 20% lower limit on 21 and 22 October, falling from ₹540 to ₹345.60, after the incident and browsers' decision to stop trusting one of its roots. On 22 October the board decided to exit the global SSL/TLS certificate business, which the chairman put at about 1% of revenue. This article explains the events; it is not a view on the stock.

What is PHP2Shell? The name for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, each scored 9.2 out of 10. They let an outsider run code on a web server that runs PHP, without logging in. They are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

How do I know if my website is affected by PHP2Shell? If your site runs PHP on any version older than the fixed releases, assume it is. Check the version in your hosting control panel, or ask your host in writing. Sites on PHP 8.1 or older get no official fix and need an upgrade.

Which Node.js versions fix the latest security release? 26.12.1, 24.22.1 and 22.23.4. They fix ten flaws, including a high-severity remote code execution bug in the Brotli decompressor (CVE-2026-111497). End-of-life versions such as Node.js 20 are not fixed.

What happened at Railway, and what should its users do? Railway detected an intruder in the systems storing customers' environment variables, where apps keep passwords and API keys, and paused all deployments. It has asked every customer to change all keys and passwords stored there and to check their logs.

How much money do Indians lose to cyber fraud? Complaints on the National Cyber Crime Reporting Portal reported ₹22,495 crore in 2025, from 24,02,579 financial-fraud complaints, according to the Government's reply in the Rajya Sabha. These are amounts reported by victims, not proven losses.

Where do I report cyber fraud in India? Call 1930 or file a complaint on cybercrime.gov.in, as soon as possible. Through this system more than ₹11,158 crore had been saved by 30 June 2026, by freezing money before it was withdrawn.

When do the DPDP Act's data breach penalties start? The duty to protect personal data, to report breaches to the Data Protection Board and to affected people, and the penalties of up to ₹250 crore and ₹200 crore, take effect 18 months after the notification of 13 November 2025, in May 2027. CERT-In's six-hour incident reporting rule applies already.

Facts are as eMudhra, Google, Mozilla, Cloudflare, the PHP and Node.js projects, Railway, CERT-In, NSE and the Government of India published them, read on 21 and 22 October 2026. Exploitation reports, Railway's scope and the crypto figure may change as investigations continue. The share price figures describe what happened and are not a recommendation. This is a guide to the events and to sensible precautions, not a security audit of any particular system.

Sources

The rules and figures in this article can be checked against these official sources.

• CERT-In advisory CIAD-2026-0050: compromise of eMudhra intermediate CA certificates; CCA-regulated DSC and eSign not impacted (21 October 2026) Indian Computer Emergency Response Team (CERT-In)
• eMudhra statement on recent certificate security incident (updated 22 October 2026) eMudhra
• eMudhra Limited: press release filed with NSE and BSE on the distrust of select global TLS intermediates (21 October 2026) eMudhra Limited (NSE filing)
• eMudhra Limited: board decides to exit the global SSL/TLS certificate business (22 October 2026) eMudhra Limited (NSE filing)
• Protecting Chrome and Android users from compromised eMudhra intermediate CA certificates Google
• Bug 2083449: eMudhra private key compromise of intermediate certificates (timeline, key values, root distrust) Mozilla
• 8 eMudhra certificates are compromised. Here’s what you need to know Cloudflare
• Eight bits of trust: eMudhra’s CA keys cracked in milliseconds Scott Helme
• Mozilla Foundation Security Advisory 2026-111 (CVE-2026-113470, Firefox 158.0.1) Mozilla
• crypto/x509: mitigation for security concerns with a specific certificate authority (Go issue 82345) The Go project
• PHP news archive: PHP2Shell security releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and interim mitigations The PHP Group
• php-src security advisory GHSA-w8hw-w9fx-j79w: RCE via OOM corruption (CVE-2026-109618) The PHP Group
• php-src security advisory GHSA-6wmf-4rv5-p3rp: RCE via stale global state (CVE-2026-109619) The PHP Group
• PHP2Shell: critical remote code execution in PHP core Wiz
• Amazon threat intelligence identifies PHP2Shell exploitation prior to public disclosure Amazon Web Services
• Two critical RCEs in PHP core Cisco Talos
• Security advisory 2026-018: critical vulnerabilities in PHP CERT-EU
• CERT-In current activity CICA-2026-3650: PHP2Shell, large-scale exploitation reported (22 October 2026) Indian Computer Emergency Response Team (CERT-In)
• Known Exploited Vulnerabilities catalog Cybersecurity and Infrastructure Security Agency (US)
• Usage statistics and market share of PHP for websites W3Techs
• Usage statistics and market share of WordPress W3Techs
• Node.js security releases of 21 October 2026: ten vulnerabilities, fixed in 26.12.1, 24.22.1 and 22.23.4 Node.js project (OpenJS Foundation)
• CERT-In vulnerability note CIVN-2026-0512: multiple vulnerabilities in Node.js (22 October 2026) Indian Computer Emergency Response Team (CERT-In)
• Unvalidated npm trusted publishing configurations now expire (2 October 2026) GitHub
• SlugFest: npm packages exposed through trusted publishing Bloom Security
• MALFEX npm malware campaign: three payloads and an adversary that signs their work Checkmarx
• Security disclosure: Wednesday October 21st Railway
• Railway platform outage: incident updates Railway
• Cyber security incidents handled by CERT-In, 2023 to 2025 (Lok Sabha reply, 12 August 2026) Press Information Bureau (MeitY)
• Cybercrime reporting and investigation: financial fraud complaints and amounts reported, 2024 and 2025 (Rajya Sabha reply, 11 February 2026) Press Information Bureau (MHA)
• National cyber crime data: amount saved through the Citizen Financial Cyber Fraud Reporting and Management System (21 July 2026) Press Information Bureau (MHA)
• National cybercrime response mechanism: amounts reported, placed under lien and refunded (22 July 2026) Press Information Bureau (MHA)
• CERT-In directions under section 70B(6) of the IT Act: reporting within 6 hours, logs for 180 days (28 April 2022) Indian Computer Emergency Response Team (CERT-In)
• Digital Personal Data Protection Act, 2023 Ministry of Electronics and Information Technology
• Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), 13 November 2025) Ministry of Electronics and Information Technology
• Notification G.S.R. 843(E): commencement of the DPDP Act’s provisions, breach duties after 18 months (13 November 2025) Gazette of India
• Cost of a Data Breach 2026: India records its highest average cost of a data breach IBM India