[{"data":1,"prerenderedAt":108},["ShallowReactive",2],{"zh-cn:CommonContent:\u002Fnews\u002F2026-10-21-php-nodejs-emudhra":3},{"id":4,"title":5,"body":6,"categories":97,"date":99,"description":91,"extension":100,"home":101,"important":102,"meta":103,"navigation":102,"path":104,"seo":105,"stem":106,"__hash__":107},"zhCN\u002Fnews\u002F2026-10-21-php-nodejs-emudhra.md","安同 OS 重要安全公告 (2026\u002F10\u002F21)：PHP 及 eMudhra 证书",{"type":7,"value":8,"toc":90},"minimark",[9,16,19,24,41,45,54,58,61,70],[10,11,12],"p",{},[13,14],"img",{"alt":5,"src":15},"\u002Fassets\u002Fnews\u002Fcve-php-and-emudhra-20261021.webp",[10,17,18],{},"近两日有多个严重安全漏洞被披露，我们也已收到用户朋友们的关切，故发布该公告说明修补进展。",[20,21,23],"h2",{"id":22},"php-8512cve-2026-109618-及-cve-2026-109619","PHP 8.5.12：CVE-2026-109618 及 CVE-2026-109619",[10,25,26,27,34,35,40],{},"2026 年 10 月 21 日，PHP 公布了两个严重级别的远程任意代码执行漏洞 ",[28,29,33],"a",{"href":30,"rel":31},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002Fcve-2026-109618",[32],"nofollow","CVE-2026-109618"," 和 ",[28,36,39],{"href":37,"rel":38},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002Fcve-2026-109619",[32],"CVE-2026-109619","，评分均为 9.2。鉴于漏洞的严重性及且该漏洞可能已经被利用，我们推荐任何使用 PHP 对外提供服务的用户立即升级 PHP 版本至 8.5.12。",[20,42,44],{"id":43},"nodejs-222342422126121","Node.js 22.23.4\u002F24.22.1\u002F26.12.1",[10,46,47,48,53],{},"今日随 ",[28,49,52],{"href":50,"rel":51},"https:\u002F\u002Fnodejs.org\u002Fen\u002Fblog\u002Fvulnerability\u002Foctober-2026-security-releases",[32],"Node.js 2026 年 10 月 21 日安全更新公告","发布的 Node.js 长期支持 (LTS) 分支更新 (22.23.4\u002F24.22.1\u002F26.12.1) 包含远程代码执行 (RCE) 漏洞在内的多个高危漏洞修复，我们正在着手推送相关更新，预计在未来数小时内完成，请注意及时更新。",[20,55,57],{"id":56},"关于-emudhra-相关证书吊销进展的说明","关于 eMudhra 相关证书吊销进展的说明",[10,59,60],{},"2026 年 10 月 20 日，多方报道称 eMudhra emSign Root CA - C1\u002FG3 及 emSign ECC Root CA - C3 证书私钥被破解，产生中间人攻击 (Man-in-the-Middle) 等安全风险，我们决定吊销这些证书。此外，由于 Comodo AAA Services 根证书先前为 eMudhra 交叉签名过部分中间证书，以及该根证书使用 SHA-1 签名算法，实际上已过时，因此也将被一并吊销。",[10,62,63,64,69],{},"安同 OS 维护者已在 Dennis Jackson 及社区贡献者们一同维护的 ",[28,65,68],{"href":66,"rel":67},"https:\u002F\u002Femudhra.we-have-a-problem.com\u002F",[32],"eMudhra Intermediate CA Compromise"," 站点的帮助下辨认了第一批含 NSS、oma 及 Node.js 等在内共 26 个常用且须修复的软件包。我们目前正在对这些软件包进行构建和使用测试，预计在周末前可以推送这些更新。",[10,71,72,73,77,78,83,84,89],{},"此外，考虑到大量 Rust 程序可能仍在使用受影响的 ",[74,75,76],"code",{},"rustls-webpki"," \u003C 0.103.16 库 (",[28,79,82],{"href":80,"rel":81},"https:\u002F\u002Frustsec.org\u002Fadvisories\u002FRUSTSEC-2026-0382.html",[32],"RUSTSEC-2026-0382",")，我们计划在未来一周内着手预防性地重构所有基于 Rust 的软件包，并利用 Autobuild 中基于 ",[28,85,88],{"href":86,"rel":87},"https:\u002F\u002Frustsec.org\u002F",[32],"cargo-audit"," 实现的自动依赖修补流程完成证书吊销工作。",{"title":91,"searchDepth":92,"depth":92,"links":93},"",2,[94,95,96],{"id":22,"depth":92,"text":23},{"id":43,"depth":92,"text":44},{"id":56,"depth":92,"text":57},[98],"security","2026-10-21","md",false,true,{},"\u002Fnews\u002F2026-10-21-php-nodejs-emudhra",{"title":5,"description":91},"news\u002F2026-10-21-php-nodejs-emudhra","p_F7ATu9ve6kok9LREXJ-WbQBtXIfOL90QhqbBRBJzw",1792597474265]