Courier's Response to the eMudhra and PHP Security Issues

This week brought two security issues that customers have asked us about: a compromise at the certificate authority eMudhra, and a critical PHP security release. This post covers what happened, our assessment of each, the steps we're taking, and what you may want to check in your own environment.

The short version

• Courier's certificates are not affected by the eMudhra compromise, and your connections to Courier don't rely on any eMudhra certificate.
• We are rolling out the latest Node.js security releases, which remove trust in the affected certificates, to Courier's services. We expect to complete the rollout by October 22, 2026.
• Courier's platform is not affected by the PHP vulnerabilities. Our production services don't run PHP.
• We have found no impact to customer data or services.

The eMudhra certificate authority compromise

What happened

A certificate authority vouches for a website's identity. Its keys sign the certificates browsers and servers use to set up a secure connection. On October 17, 2026, the private keys of eight intermediate certificates operated by eMudhra under its emSign brand were reported compromised. Anyone holding one of those keys could issue certificates that look legitimate.

The industry responded quickly:

• October 17: Chrome and Firefox blocked the affected certificates.
• October 18 and 19: eMudhra revoked the certificates. Apple and Android blocked them.
• October 20: Mozilla removed the root certificate behind them from its trust store, which much of the industry relies on.
• October 21: Node.js and other platforms released security updates that remove trust in the affected certificates.

If you use an up-to-date browser, you're already protected. Mozilla's announcement has the full details.

What this means for Courier

Connections to Courier. No Courier certificate is issued by eMudhra or emSign. When you call Courier's API, sign in to the Courier app or visit our website, the connection doesn't depend on any affected certificate.

Connections from Courier. Courier also makes outbound connections, for example when we deliver webhooks to your endpoints or send messages through delivery providers. We are rolling out the Node.js security releases published October 21, 2026, to these services. These releases remove the affected eMudhra roots from Node.js's trusted certificates and reject any certificate chain that uses one of the compromised keys. The rollout is in progress, and we expect to complete it by October 22, 2026.

Customer data. We have found no impact to customer data or services.

What you should check

Browsers handle this automatically. Servers often don't. If your own services make HTTPS connections, including services that receive Courier webhooks or use Courier's SDKs, make sure you're running current versions of:

• Node.js: 22.23.4, 24.22.1, 26.12.1 or later
• Other language runtimes and HTTP libraries, such as Python, Go, Java or PHP: the latest security releases and certificate bundles
• Your operating system's certificate package and any container base images

The PHP security release

What happened

On October 21, 2026, the PHP project released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 under CVSS v4.0, and both could allow unauthenticated remote code execution on PHP servers that handle web requests. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

What this means for Courier

Courier's platform is not affected. Courier's production services don't run PHP.

If you use Courier's PHP SDK: the SDK is open source and runs in your environment, on your own PHP installation and HTTP client. The vulnerabilities are in PHP itself, not the SDK, so the SDK doesn't need a change. Update PHP to one of the fixed versions above.

Questions

We'll keep monitoring both issues and will update this post once our rollout is complete. If you have questions or need documentation for a security review, contact us at security@courier.com.