SANS Stormcast Wednesday, October 28th, 2026: eMudhra CA Revocation for Windows, macOS, Linux; PHP RCE Exploited on Palo Alto PAN-OS; Microsoft Authenticator Android Token Leak; GoAhead TLS Bugs

The ongoing Imhotra situation highlights vulnerabilities in several digital ecosystems due to weak private keys associated with certain signing certificates. Microsoft has released an out-of-band patch for Windows 10 and 11, while macOS has also issued an update addressing issues with its networking stack, although some command line utilities may still be affected. Users are urged to update their systems and Python scripts to ensure they are using an up-to-date certificate authority file that excludes the compromised Imhotra certificate.

In related cybersecurity news, confirmed compromises of Palo Alto devices have raised alarms, with the company acknowledging successful attacks. These devices are particularly vulnerable due to a lack of address-based layout randomization, making them attractive targets for ransomware gangs. Users are advised to apply patches promptly and review the Palo Alto advisory for additional mitigation strategies.

Additionally, a security flaw in Microsoft's Authenticator application on Android has been addressed, which previously allowed other applications on the same device to access authentication tokens. Researchers have also identified vulnerabilities in the GoAhead web server, commonly used in IoT devices, particularly concerning TLS certificate validation. Users of affected devices will need to await vendor updates to resolve these issues.

In this episode: updates on revoking the compromised eMudhra certificate authority certificates on Windows, macOS, Linux and Python, confirmed exploitation of the PHP vulnerabilities against Palo Alto Networks devices, a token leak in Microsoft Authenticator for Android, and TLS certificate validation flaws in the GoAhead embedded web server.

eMudhra Certificate Revocation Updates for Windows, macOS, Linux and Python

Microsoft released out-of-band updates for Windows 10 and 11 to distrust the compromised eMudhra intermediate certificate authority (CA) certificates, and Apple now blocks them in Safari, Mail and apps that use Apple's networking frameworks. Command-line tools that rely on /etc/ssl/cert.pem, Homebrew, Python's certifi package and Linux CA bundles may still trust them until updated. Because the private keys are known, anyone could issue certificates that appear valid.

https://support.microsoft.com/en-us/servicing/os/windows-11/2026/10/kb5134133-windows-11-24h2-25h2-26h2-update

https://support.microsoft.com/en-us/servicing/os/windows-10/2026/10/kb5134125-windows-10-21h2-22h2-update

https://support.apple.com/en-us/149555

PHP RCE Vulnerabilities Exploited on Palo Alto Networks PAN-OS (CVE-2026-109618, CVE-2026-109619)

Palo Alto Networks has confirmed active exploitation of the critical PHP remote code execution (RCE) flaws against PAN-OS management interfaces exposed to the internet. Some Palo Alto appliances apparently don't always support address space layout randomization (ASLR), which makes exploitation easier, so apply the hotfixes and the advisory's mitigations quickly.

https://security.paloaltonetworks.com/CVE-2026-109618

Microsoft Authenticator for Android Token Theft Flaw (CVE-2026-80097)

Ofek Levin of Enclave.ai found that any other app on the same Android device could obtain authentication tokens from Microsoft Authenticator, breaking a core assumption of using a phone as a second factor. Microsoft has fixed the flaw; versions before 6.2606.4246 are affected.

https://enclave.ai/blog/authmask-we-made-microsoft-authenticator-hand-over-tokens

GoAhead Embedded Web Server TLS Flaws (CVE-2026-115881, CVE-2026-115884)

Researchers from FoxIO found TLS certificate validation flaws in GoAhead, an embedded web server common in IoT devices, including one where certificate revocation lists (CRLs) are loaded but ignored. GoAhead 6.1.1 fixes the bugs, but most users will have to wait for their device vendor to ship an update.

https://foxio.io/blog/choose-your-backend-three-tls-bugs-in-goahead

My Upcoming Classes

https://www.sans.org/profiles/dr-johannes-ullrich

SANS Difference Maker Awards

Dr. Johannes Ullrich is up for the SANS Difference Maker Lifetime Award this year. Please vote:

https://www.sans.org/go/difference-makers-awards-2026