SANS Stormcast Wednesday, October 28th, 2026: eMudhra CA Revocation for Windows, macOS, Linux; PHP RCE Exploited on Palo Alto PAN-OS; Microsoft Authenticator Android Token Leak; GoAhead TLS Bugs (#)

SANS Stormcast Wednesday, October 28th, 2026: eMudhra CA Revocation for Windows, macOS, Linux; PHP RCE Exploited on Palo Alto PAN-OS; Microsoft Authenticator Android Token Leak; GoAhead TLS Bugs In this episode: updates on revoking the compromised eMudhra certificate authority certificates on Windows, macOS, Linux and Python, confirmed exploitation of the PHP vulnerabilities against Palo Alto Networks devices, a token leak in Microsoft Authenticator for Android, and TLS certificate validation flaws in the GoAhead embedded web server. eMudhra Certificate Revocation Updates for Windows, macOS, Linux and Python Microsoft released out-of-band updates for Windows 10 and 11 to distrust the compromised eMudhra intermediate certificate authority (CA) certificates, and Apple now blocks them in Safari, Mail and apps that use Apple's networking frameworks. Command-line tools that rely on /etc/ssl/cert.pem, Homebrew, Python's certifi package and Linux CA bundles may still trust them until updated. Because the private keys are known, anyone could issue certificates that appear valid. https://support.microsoft.com/en-us/servicing/os/windows-11/2026/10/kb5134133-windows-11-24h2-25h2-26h2-update https://support.microsoft.com/en-us/servicing/os/windows-10/2026/10/kb5134125-windows-10-21h2-22h2-update https://support.apple.com/en-us/149555 PHP RCE Vulnerabilities Exploited on Palo Alto Networks PAN-OS (CVE-2026-109618, CVE-2026-109619) Palo Alto Networks has confirmed active exploitation of the critical PHP remote code execution (RCE) flaws against PAN-OS management interfaces exposed to the internet. Some Palo Alto appliances apparently don't always support address space layout randomization (ASLR), which makes exploitation easier, so apply the hotfixes and the advisory's mitigations quickly. https://security.paloaltonetworks.com/CVE-2026-109618 Microsoft Authenticator for Android Token Theft Flaw (CVE-2026-80097) Ofek Levin of Enclave.ai found that any other app on the same Android device could obtain authentication tokens from Microsoft Authenticator, breaking a core assumption of using a phone as a second factor. Microsoft has fixed the flaw; versions before 6.2606.4246 are affected. https://enclave.ai/blog/authmask-we-made-microsoft-authenticator-hand-over-tokens GoAhead Embedded Web Server TLS Flaws (CVE-2026-115881, CVE-2026-115884) Researchers from FoxIO found TLS certificate validation flaws in GoAhead, an embedded web server common in IoT devices, including one where certificate revocation lists (CRLs) are loaded but ignored. GoAhead 6.1.1 fixes the bugs, but most users will have to wait for their device vendor to ship an update. https://foxio.io/blog/choose-your-backend-three-tls-bugs-in-goahead My Upcoming Classes https://www.sans.org/profiles/dr-johannes-ullrich SANS Difference Maker Awards Dr. Johannes Ullrich is up for the SANS Difference Maker Lifetime Award this year. Please vote: https://www.sans.org/go/difference-makers-awards-2026 keywords: eMudhra; PHP; CVE-2026-109618; Palo Alto; PAN-OS; Microsoft Authenticator; Android; GoAhead; TLS