Critical Security Updates: e-Mudhra Certificate Revocation, PHP Vulnerabilities, Oracle Patches, and Fortinet Exploit

Eight intermediate CA certificates belonging to e-Mudhra, an Indian company, have been revoked due to a script error during certificate creation that resulted in private keys being only one byte long. The issue occurred during the key creation ceremony in their hardware security module, though most of their hundreds of millions of certificates are personal signing certificates rather than web certificates. Two critical vulnerabilities in PHP affecting all versions back to version 5 will be patched on Wednesday, October 21st at 10:00 a.m. Eastern, with CVSS scores ranging from 9.2 to 10; the patch release was accelerated after vulnerability information leaked. Oracle released its October critical patch update fixing 1,295 security vulnerabilities, including a SQL injection vulnerability (CVE-2026-10-17-67) in Oracle E-Business Suite that Horizon 3 will publish details about. A proof-of-concept exploit now exists for a Fortinet FortiSIEM vulnerability patched on October 13th, which is a path traversal file write vulnerability in the gRPC service on port 27918 that enables remote code execution.