October 28, 2026
Keeping CI HUB secure: this week's PHP and eMudhra updates
We take the security of your data seriously and act on new vulnerabilities as soon as fixes are available.
This week, two security incidents outside CI HUB affected widely used software. We assessed our exposure and started patching right away:
- PHP vulnerabilities: we updated the one CI HUB component that uses PHP 2 hours and 10 minutes after PHP released the fix.
- eMudhra CA incident: we assessed it on 22 October 2026 and updated our backend services and CI HUB Drive for macOS on 23 October 2026.
Neither incident is a breach of CI HUB, and after reviewing our systems, we have seen no sign that either was used against us. Even so, we took additional precautions to be extra sure.
Summary
| Incident | CI HUB Status | What you need to do |
|---|---|---|
| PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 |
Fixed on 21 October 2026 |
Nothing for the CI HUB service |
| eMudhra CA incident | Backend services fixed on 23 October 2026. CI HUB Drive for macOS fixed in version 1.49.4. |
Update CI HUB Drive, and keep your operating system, browsers, and Adobe and Microsoft Office apps up to date |
PHP vulnerabilities
Which CI HUB components use PHP?
Only one small operational component of CI HUB uses PHP. It runs separately from the CI HUB connectors and doesn't handle the assets or content you work with in CI HUB.
The CI HUB connector platform, meaning the connector plugins, SDKs, APIs, and the backend that handles the DAM integrations, doesn't use PHP. CI HUB Drive doesn't include PHP either.
We plan to retire this component in Q1 2027. After that, CI HUB's hosted services won't use PHP at all.
What we did
- On 21 October 2026, the day PHP released the fix, we updated this component to a fixed PHP version in all environments.
- We reviewed the production logs and files of this component and found no sign that anyone gained access.
- As a precaution, we rotated critical passwords and access tokens across our backend. You don't need to reconnect or change anything.
What you need to do
Nothing for the CI HUB service.
If you run a CI HUB extension inside your own PHP application, such as our WordPress plugin, the extension uses your server's PHP. You should therefore update that server to PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35, or later. We've confirmed that our WordPress plugin works on the updated PHP. If you think your WordPress server was compromised, also replace the CI HUB credentials stored in the plugin.
PHP 8.1 and older no longer get fixes from the PHP project. Upgrade to a supported version, or ask your Linux distribution or LTS vendor for a backported fix. For details, see the PHP security advisory.
eMudhra CA incident
eMudhra, a certificate authority (CA), generated the private keys of eight intermediate CA certificates incorrectly. Anyone can recover these keys and use them to create a certificate that impersonates any website or service. The issue was reported to browser and OS vendors on 17 October 2026, and made public on 20 October 2026. For details, see the incident page.
Current versions of Chrome, Edge, Firefox, and Safari reject these certificates because they require certificates to be publicly logged. Many other HTTPS clients, such as Node.js, Python, and curl, accept them until they're updated.
How it affects CI HUB
We don't use eMudhra certificates, so none of our own certificates need replacing. That alone doesn't protect against forgeries: anyone with the recovered keys can create a certificate for ci-hub.com or our API, and software that hasn't been updated would accept it.
Our backend services and CI HUB Drive connect to DAM systems and to our API. Like most software, they trusted these certificates, so we updated them. An attack would also need control of the network in between, such as a public Wi-Fi network. This is hard for our cloud backends and easier for CI HUB Drive on a laptop, which is why the CI HUB Drive update matters most.
Connectors that run in a web browser, such as Figma, Canva, Adobe Express, Google Workspace, and Office on the web, are protected by the browser. Connectors that run inside desktop apps, such as Adobe Creative Cloud and Microsoft Office, send every request through the app's built-in browser engine. Whether they reject the affected certificates depends on the app and the operating system, which are outside CI HUB's control. Installing the latest updates for both, where available, is the best protection.
Our updates
We have completed these updates:
| Component | Update | Status |
|---|---|---|
| Backend services and APIs | Updated backend certificate packages to versions that block the affected certificates. | Done on 23 October 2026 |
| Operational component that uses PHP |
Updated certificate package | Done on 23 October 2026 |
| CI HUB Drive for macOS |
Version 1.49.4 with the updated certificate |
Available since 23 October 2026 |
What you need to do
- CI HUB Drive for macOS: update to version 1.49.4 through the update check in CI HUB Drive or from our official download page.
- Keep your operating system, browsers, and the Adobe and Microsoft Office apps you use with CI HUB up to date. Microsoft started blocking the affected certificates on 20 October 2026, and Apple on 22 October 2026. On Windows, make sure automatic root certificate updates aren't turned off.
- If your DAM server uses a certificate from eMudhra, replace it with one from another certificate authority. Updated software may no longer trust eMudhra certificates, so connections to that server can fail.
- If your company runs its own scripts or applications that call the CI HUB API or other web services, ask your developers to update their development tools.
How we contact you about updates
We never send CI HUB Drive installers by email. Neither incident requires you to re-enter credentials or reconnect a DAM. If a message asks you to do either, don't follow it and forward it to support@ci-hub.com.
Questions?
If you have questions, contact support@ci-hub.com.
Article by
Salim Melliti
CTO at CI HUB