# Important advisory on recent industry security disclosures

Canonical: https://brew.new/templates/render/important-advisory-on-recent-industry-security-disclosures

Brand: render.com
Category: general

![Preview of Important advisory on recent industry security disclosures](https://cdn.brew.new/email-preview-0b9e830112eb4970-tracking_r57xz1adk0zj4pdg5sqfrmexh98gtw9y-1792776150482.png)

## Email content

Render

Hello,

This week, major security issues were disclosed in software and infrastructure widely used across the internet. These issues may require you to update your applications. Review the guidance below and update any affected applications as soon as possible.

Render's platform remains secure, and we are not aware of any breaches or compromises. If you have already updated your applications and dependencies, you do not need to take additional action.

What's potentially affected

Any application that sends HTTPS requests to destinations over the internet

Any application running Node.js, regardless of framework

Any application running PHP, regardless of framework

What happened

eMudhra certificate compromise: On October 19, a public disclosure confirmed the compromise of private keys for eight intermediate certificates issued by eMudhra, a widely trusted certificate authority. Attackers can use these keys to impersonate websites and services to applications that still trust the affected certificates, circumventing the protection normally provided by HTTPS.

Node.js security release: On October 21, Node.js released patches for multiple vulnerabilities, including flaws that can bypass TLS certificate hostname checks and a flaw in Brotli decompression that can allow remote code execution. These releases also address the eMudhra certificate compromise.

PHP2Shell: On October 21, PHP released patches for two critical vulnerabilities discovered in the PHP runtime. These vulnerabilities can allow unauthenticated attackers to execute code on affected services or read sensitive information from memory, including passwords, tokens, and API keys. PHP applications can be affected regardless of which framework they use.

What you need to do

Update affected dependencies and rebuild your services.

Follow our eMudhra advisory for instructions specific to your runtime. For all native runtimes, rebuilding your service updates its system certificate store. However, some languages and libraries bundle their own certificates and require separate updates. For Docker-based services, update the certificate store and affected dependencies in your image before redeploying.

If you run Node.js, update its version and redeploy every affected service.

Update to 22.23.4, 24.22.1, or 26.12.1, or a later release in the same major version. These are the same versions recommended in our eMudhra advisory. For native runtimes, set your service's Node.js version. For Docker services, update Node.js in your image.

If you run PHP, update its version and redeploy every affected service.

All PHP apps on Render use Docker. Follow our PHP2Shell advisory to update the PHP installation in your Docker image and confirm that your deployed services use a patched version.

We will update these advisories as additional fixes and guidance become available. Please refer to them for the latest instructions.

Under Render's Shared Responsibility Model, customers are responsible for the security of their application-level configurations, dependencies, and secrets. This includes ensuring that the packages and libraries your applications depend on are secure and up to date.

If you have questions or need assistance, contact our support team in the Render Dashboard.

Thank you,

The Render Team

© 2026 Render, 525 Brannan St #300, San Francisco, CA 94107

[Open and remix this design](https://brew.new/templates/render/important-advisory-on-recent-industry-security-disclosures)

[Browse email designs](https://brew.new/browse/templates)