Security Update: PHP, Node.js and the eMudhra Certificate Incident

Published: 21 October 2026
The InfiniteGaming Group

Critical security updates for PHP

On 21 October, the PHP project released emergency security updates addressing two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. Under certain conditions, these vulnerabilities could allow unauthenticated attackers to execute code on vulnerable servers.

These are serious issues affecting PHP installations across a wide range of hosting environments and applications. The PHP project has urged users to update immediately, with security agencies also recommending that vulnerable systems be taken offline where immediate remediation is not possible.

Official advisory from PHP.net

What this meant for IGG

Our infrastructure uses Appwrite for backend services, including authentication and application data. Appwrite relies on PHP, meaning the PHP security advisories were directly relevant to our infrastructure.

Rather than leave potentially vulnerable services exposed while preparing updates, we temporarily took our affected websites offline until the necessary security patches could be applied.

We recognise that downtime is inconvenient. However, when a critical vulnerability carries the potential for remote code execution, protecting our infrastructure and the information entrusted to our services takes priority over maintaining uninterrupted availability at any cost.

Our response was precautionary. A service being taken offline for security maintenance is not, in itself, evidence that it has been compromised.

Following the updates, we restored the affected services once the necessary changes had been applied.

Node.js security releases

The Node.js project also published security updates on 21 October, covering its supported 22.x, 24.x and 26.x release lines.

These releases address several security issues, including vulnerabilities involving DNS resolution and TLS certificate hostname verification, alongside dependency updates relating to the eMudhra certificate incident.

Official advisory from NodeJS.org

What we've done

Across our other websites and services running Node.js, we have updated Node.js to address the relevant security advisories.

Keeping runtimes and their bundled dependencies current is an important part of maintaining a secure hosting and application environment. These updates help ensure that our services benefit from the latest available security fixes rather than continuing to rely on versions with known vulnerabilities.

The eMudhra certificate authority incident

A separate security incident involving eMudhra, a provider of digital certificates used within the internet's public trust infrastructure, has also attracted significant attention.

The incident concerns a number of intermediate certificate authority (CA) certificates whose associated private keys were generated with insufficient cryptographic randomness. This weakness made the affected private keys recoverable, undermining the trust that those certificates were intended to provide.

Intermediate CAs play an important role in the web's certificate system. They help establish the chain of trust that allows browsers and other software to verify the identity of websites and secure connections. A compromise of their private keys can therefore have implications well beyond a single website.

Browser vendors and other ecosystem participants have responded by blocking or removing trust in affected certificates.

Further information:

• eMudhra's statement: from eMudhra
• CERT-In advisory: from cert-in.org.in

Were IGG services affected?

We have not identified any impact to IGG from the eMudhra certificate incident.

Our response has included updating our Node.js environments in line with the available security releases, including the relevant certificate-related dependency updates.

The eMudhra incident is separate from the PHP vulnerabilities discussed above. Although both developments required attention today, they involve different components of the wider technology ecosystem and should not be confused with one another.

For clarity, the temporary website outages described in this update were a precautionary measure in response to the PHP security advisories, not an indication that the eMudhra incident had compromised our services.

Security is an ongoing responsibility

Today's events are a reminder that maintaining secure online services involves more than securing application code. It also requires keeping runtimes updated, monitoring upstream advisories, maintaining trusted dependencies and responding appropriately when new risks emerge.

At IGG, we operate across technology, infrastructure, gaming and creator-focused services. We take that responsibility seriously, and we would rather communicate an interruption caused by responsible security maintenance than knowingly leave a critical vulnerability unaddressed.

We will continue to monitor relevant security advisories and apply further updates where necessary.

Thank you for your patience while we carried out this work, and for continuing to be part of The InfiniteGaming Group.

The InfiniteGaming Group
Building useful, reliable and enjoyable digital experiences.