---
title: "Customer Notice: eMudhra CA Compromise & PHP2Shell"
author: "Bradford Fults"
date: 2026-10-21
canonical_url: https://bonsai.io/blog/emudhra-ca-compromise-customer-notice/
license: CC BY-SA 4.0
license_url: https://creativecommons.org/licenses/by-sa/4.0/
copyright: Bonsai.io, 2026
---

## eMudhra CA Compromise

On October 18, [it was made public](https://bugzilla.mozilla.org/show_bug.cgi?id=2083449) that the certificate authority eMudhra had private keys for several of its intermediate certificates compromised. With those keys, an attacker could create TLS certificates that look valid to any client that still trusts eMudhra's affected root certificate. Browsers and operating systems are removing that trust now. Here's [a short explainer on the issue](https://emudhra.we-have-a-problem.com/).

### How this affects Bonsai services

-   **Our certificates are unaffected.** None of the TLS certificates for Bonsai, Websolr or our dashboards come from eMudhra, so nothing needs to be re-issued and nothing changes in how you connect.
-   **Risk to search clusters is very low, by its nature.** This compromise is a much bigger threat to clients that connect outward to SSL-authenticated hosts. Search clusters make few outbound connections, mostly to cloud storage within cloud providers' own networks, and we are removing the affected trust from those too. That said, we strongly recommend that all customers update their CA certificate bundles and stores on their _client_ side machines, as a matter of good security practice (see below).
-   **Your data and credentials are unaffected.** We have investigated and found no evidence that this compromise has affected our systems or your clusters. Cluster access still depends on your cluster credentials and our non-affected SSL certificates, not on any certificate from this authority.
-   **Our infrastructure is being updated.** Like most systems on the internet, parts of our infrastructure held the affected CA certificate roots in their stores. We have already removed that trust from our application platform and many of our servers, and we are finishing the rest of our fleet and build systems now.

### One thing we recommend you check

The remaining risk sits on the client side, and it applies to every HTTPS service, not just ours. If your application connects to Bonsai or Websolr from a server whose trust store still includes the compromised root, an attacker who can intercept that traffic could pretend to be your cluster. They could then capture the credentials in your cluster URL. We have no way to detect this from our side, because the attacker's connection would never reach us.

To close that gap, keep the CA certificates up to date on the servers and runtimes that talk to your cluster:

-   **Linux:** install your distribution's latest `ca-certificates` update.
-   **Java:** use a JDK whose `cacerts` no longer includes `emSign ECC Root CA - G3`, or delete that entry with `keytool`.
-   **Python:** upgrade `certifi` to 2026.10.19 or later.
-   **Node.js:** upgrade to 22.23.4, 24.22.1, 26.12.1 or later.
-   **Other stacks and tools:** consult providers and maintainers.

If you think your cluster credentials may have been exposed, you can rotate them from your dashboard at any time, or contact us and we'll be happy to help.

## PHP2Shell

Coincidentally, [CVE-2026-109618](https://nvd.nist.gov/vuln/detail/CVE-2026-109618) and [CVE-2026-109619](https://nvd.nist.gov/vuln/detail/CVE-2026-109619) were published about a critical vulnerability in PHP. Bonsai and Websolr do not use PHP and are not affected by this vulnerability in any way.

If you have any questions about the above, please email us at [support@bonsai.io](mailto:support@bonsai.io).

_Copyright ©️ Bonsai.io, 2026 · By Bradford Fults · Originally published at https://bonsai.io/blog/emudhra-ca-compromise-customer-notice/ · CC BY-SA 4.0_