Our Response to Recent Security Incidents: PHP CVE-2026-109618/CVE-2026-109619 and the eMudhra Intermediate CA Compromise

This week, two critical security incidents were announced: two vulnerabilities in core PHP, and the compromise of eMudhra intermediate CA certificates. This post explains how they affected our websites and EmEditor, what we have done, and what we recommend you do.

Summary

Our websites are not affected by the PHP vulnerabilities. The PHP that our WordPress sites run on has already been patched, and we publish only static pages.
EmEditor v22.3 through v26.3 are affected by the eMudhra Intermediate CA Compromise, through the Node.js bundled for the Language Server Protocol (LSP) feature. This was the only affected area.
Please update EmEditor to the latest version, currently v26.4.0. It includes Node.js v26.12.1, which fixes the issue.

1. PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619

On October 21, 2026, the PHP project announced two critical vulnerabilities in core PHP: CVE-2026-109618 (remote code execution via out-of-memory corruption) and CVE-2026-109619 (remote code execution via stale global state). Both can allow unauthenticated remote code execution on PHP installations that serve web requests.

Our websites are built with WordPress, which runs on PHP. Our websites are protected in three ways:

The PHP of our WordPress sites has already been updated with the latest patches for CVE-2026-109618 and CVE-2026-109619.
Our WordPress sites are exported to static pages, and we publish only those static pages. The public websites do not run PHP.
The source WordPress sites are blocked from all IP addresses except those of our offices.

The Emurasoft Customer Center and our other sites do not use PHP and are not affected.

2. eMudhra Intermediate CA Compromise

On October 20, 2026, the eMudhra Intermediate CA Compromise was disclosed. The private keys of eight eMudhra intermediate CA certificates were compromised. These intermediates chain to roots trusted by major operating systems and browsers, so an attacker with one of the keys could impersonate any website or service to a client that still trusts them. The intermediates have been revoked, but clients that do not check revocation need a software update.

2-1. What Was Affected in EmEditor

EmEditor uses Node.js for the Language Server Protocol (LSP) feature, and Node.js was affected by this incident. All versions of EmEditor released between v22.3 (released on April 11, 2023) and v26.3 (released on October 7, 2026), inclusive, contain Node.js and are affected. This applies to both the Professional and Free versions, and to both the 64-bit and 32-bit versions.

In EmEditor v26.4, we updated Node.js to v26.12.1, which addresses the issue.

2-2. Other Parts of EmEditor Are Not Affected

We performed a full security scan of the EmEditor source code and found that LSP was the only affected area. No other part of EmEditor is vulnerable as long as your Windows system has the latest updates:

EmEditor uses the Windows CA certificates rather than bundling its own, so it relies on the revocation that Microsoft has already delivered through Windows.
The WebPreview and ChatAI plug-ins use the Microsoft Edge installed on your system.
None of our TLS or code signing certificates were issued by eMudhra. The digital signatures of EmEditor and the certificates of our websites are not affected.

3. What We Recommend

Update EmEditor to the latest version, currently v26.4.0. If you use the legacy MSI installer, select Help > Check for Updates, or download the latest version. If you download the MSI installer directly, please verify that its digital signature is issued by Emurasoft, Inc.
Keep Windows and your web browser up to date, including Microsoft Edge, which the WebPreview and ChatAI plug-ins use.

If you have any questions, please contact us.

Thank you for your continued support of EmEditor.
— Yutaka Emura