Resolved
FedRAMP and Virtual Appliance Update, October 30, 2026: Vasion has released fixes for both of the two third-party, industry-wide security issues described in our October 21 notice. We have updated Vasion-hosted FedRAMP services and released an updated Virtual Appliance for the compromise of multiple eMudhra intermediate certificate authorities.
Resolution:
Vasion immediately began working on fixes to address both third-party, industry-wide security issues. As of October 30, Vasion has addressed the compromise of multiple eMudhra intermediate certificate authorities in the Vasion-hosted FedRAMP services and the Virtual Appliance. Below are any additional next steps based on your specific environment:
Vasion-hosted FedRAMP services:
Our Fall release included a fix for the compromise of multiple eMudhra intermediate certificate authorities. Please review the release notes in our documentation here: https://docs.vasion.com/fed/Release_Notes/Automate-Fed.htm.
While your Vasion software was updated automatically, there are some steps that you may need to take manually, depending on your settings. It is recommended that all customers update the Agent and Service Agent binaries to protect against man-in-the-middle attacks. You should manually update everything that you don't already have set to automatically update, and ensure all of your Agents and Service Agents are running the latest versions.
Please visit the release notes at this link: https://docs.vasion.com/fed/Release_Notes/Automate-Fed.htm for instructions on how to update your Agent and Service Agent binaries.
Vasion Virtual Appliance (VA):
Customers on the Virtual Appliance should complete two steps:
Step 1: Upgrade the Virtual Appliance. We have released an updated version that includes these fixes and it is recommended to upgrade to the updated VA release (Host: 26.2.362) now. Please visit this link: https://docs.vasion.com/v/Release_Notes/VirtualAppliance.htm for access to the download.
Step 2: Update the Agent and Service Agent binaries. To protect against man-in-the-middle attacks, we recommend that all customers make sure their Agents and Service Agents are running the latest versions. Customers who don’t have automatic updates enabled will need to update these binaries manually. Please visit the release notes at this link: https://docs.vasion.com/v/Release_Notes/VirtualAppliance.htm for instructions on how to update the Agent and Service Agent binaries.
Conclusion:
This completes Vasion’s server-side updates for the two third-party, industry-wide security issues described in our October 21 notice. Customers who do not have automatic updates enabled should update their Agent and Service Agent binaries to complete the process. We will continue to monitor and follow any further updates or changes that arise. Details on Vasion’s security and privacy practices are available in our Trust Center at https://trust.vasion.com/.
If you have questions, contact Vasion Support at support@vasionfed.com (for FedRAMP customers) or printsupport@vasion.com (for Virtual Appliance customers) or reach out to your account manager. Thank you for your partnership.
Posted Oct 30, 2026 - 14:07 UTC
Update
Update, October 28, 2026: Vasion has now released fixes for both issues for Vasion-hosted services, except FedRAMP and the Virtual Appliance, where eMudhra updates are in progress.
Background:
On October 21, the PHP Foundation released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to address the two critical vulnerabilities that could allow unauthenticated remote code execution. Separately, the private keys of multiple eMudhra intermediate certificate authorities (together with their cross-signed variants) were reported compromised, which could allow an attacker to impersonate websites and services for clients that still trust them.
Resolution:
Vasion immediately began working on fixes to address both third-party, industry-wide security issues. As of October 28, Vasion has addressed the compromise of multiple eMudhra intermediate certificate authorities in the Vasion-hosted services (except FedRAMP and the Vasion Virtual Appliance, which are in process). Below are any additional next steps based on your specific environment:
Vasion-hosted services (except FedRAMP):
Our Fall release included a fix for the compromise of multiple eMudhra intermediate certificate authorities. Please review the release notes in our documentation here: https://docs.vasion.com/a/Release_Notes/Automate.htm.
While your Vasion software was updated automatically, there are some steps that you may need to take manually, depending on your settings. It is recommended that all customers update the Agent and Service Agent binaries to protect against man-in-the-middle attacks. You should manually update everything that you don't already have set to automatically update, and ensure all of your Agents and Service Agents are running the latest versions.
Please visit the release notes at this link: https://docs.vasion.com/a/Release_Notes/Automate.htm#:~:text=Certificate%20Authority%20Distrust%20(eMudhra) for instructions on how to update your Agent and Service Agent binaries.
Vasion Virtual Appliance (VA): Updates are underway and being validated. If you have not yet installed VA host 26.2.352 for the PHP fix, please do so now. Please continue to monitor this page for updates.
Vasion-hosted FedRAMP services: Updates are underway and being validated. No customer action is required at this time. Please continue to monitor this page for updates.
Conclusion:
This completes Vasion’s server-side updates (except FedRAMP and the Virtual Appliance, which are in progress) for the two third-party, industry-wide security issues described in our October 21 notice. Customers who do not have automatic updates enabled should update their Agent and Service Agent binaries to complete the process. We will continue to monitor and follow any further updates or changes that arise. Details on Vasion’s security and privacy practices are available in our Trust Center at https://trust.vasion.com/.
If you have questions, contact Vasion Support at printsupport@vasion.com or reach out to your account manager. Thank you for your partnership.
Posted Oct 28, 2026 - 13:36 UTC
Update
FedRAMP Update, October 25, 2026: Vasion has released fixes for one of the two third-party, industry-wide security issues described in our October 21 notice. We have updated Vasion-hosted FedRAMP services to patched versions of PHP to address the remote code execution vulnerabilities (CVE-2026-109618, CVE-2026-109619).
We continue to work on the second issue, the compromise of multiple eMudhra intermediate certificate authorities, and are updating certificates and affected components. We will update this notice as we have more information.
Resolution:
Vasion immediately began working on fixes to address these two third-party, industry-wide security issues. As of October 23, Vasion has patched the PHP vulnerabilities in the Vasion-hosted FedRAMP services. Below are any additional next steps based on your specific environment:
Vasion-hosted FedRAMP services: We generated an emergency patch to deploy the PHP fix to FedRAMP customers. Please review the patch release notes in our documentation here: https://docs.vasion.com/fed/Release_Notes/Automate-Fed.htm. Your Vasion environment has been updated and no customer action is required at this time.
Vasion will continue to actively update certificates and address technology impacted by the eMudhra compromise. Updates are underway and being validated. No action is required at this time for the eMudhra compromise but an additional update is expected. We will continue to update this bulletin as remediation and validation progress.
If you have questions, contact Vasion Support at support@vasionfed.com or reach out to your account manager. Thank you for your partnership.
Posted Oct 25, 2026 - 17:48 UTC
Monitoring
Update, October 23, 2026: Vasion has released fixes for one of the two third-party, industry-wide security issues described in our October 21 notice. We have updated Vasion-hosted services (except FedRAMP, which is in progress) to patched versions of PHP to address the remote code execution vulnerabilities (CVE-2026-109618, CVE-2026-109619).
We continue to work on the second issue, the compromise of multiple eMudhra intermediate certificate authorities, and are updating certificates and affected components. We will update this notice as we have more information.
Background:
On October 21, the PHP Foundation released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to address the two critical vulnerabilities that could allow unauthenticated remote code execution. Separately, the private keys of multiple eMudhra intermediate certificate authorities (together with their cross-signed variants) were reported compromised, which could allow an attacker to impersonate websites and services for clients that still trust them.
Resolution:
Vasion immediately began working on fixes to address these two third-party, industry-wide security issues. As of October 23, Vasion has patched the PHP vulnerabilities in the Vasion-hosted services (except FedRAMP, which is in process) and released an updated VA version for customers to install. Below are any additional next steps based on your specific environment:
Vasion-hosted services (except FedRAMP): We generated an emergency patch overnight to deploy the PHP fix to all customers. Please review the patch release notes in our documentation here: https://docs.vasion.com/a/Release_Notes/Automate.htm. Your Vasion environment has been updated and no customer action is required at this time.
Vasion Virtual Appliance (VA): For customers running the Vasion Virtual Appliance (VA), we have released an updated VA version that includes the PHP fix. It is an emergency security update, and Customers should upgrade to the updated VA release (host 26.2.352) as soon as possible. Please visit this link https://docs.vasion.com/v/Release_Notes/VirtualAppliance.htm for access to the download.
Vasion-hosted FedRAMP services: Updates are underway and being validated. No customer action is required at this time. Please continue to monitor this page for updates.
Vasion will continue to actively update certificates and address technology impacted by the eMudhra compromise. Updates are underway and being validated. No action is required at this time for the eMudhra compromise but an additional update is expected. We will continue to update this bulletin as remediation and validation progress.
Conclusion:
We are actively monitoring these issues and will update this notice as we have more information. Details on Vasion’s security and privacy practices are available in our Trust Center at https://trust.vasion.com/. If you have questions, contact Vasion Support at printsupport@vasion.com or reach out to your account manager. Thank you for your partnership.
Posted Oct 23, 2026 - 17:42 UTC
Update
October 22, 2026: External Security Advisory Affecting Vasion Products (PHP Remote Code Execution Vulnerabilities and eMudhra Intermediate CA Compromise)
Vasion continues to remediate the two third-party, industry-wide security issues described in our October 21 notice: the PHP remote code execution vulnerabilities (fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35) and the compromise of multiple eMudhra intermediate certificate authorities.
Vasion-hosted services: Updates are underway and being validated. No customer action is required at this time.
Vasion Virtual Appliance (VA): For customers running the Vasion Virtual Appliance (VA), we will be releasing an updated VA version that includes these fixes. It is an emergency security update, and Customers should upgrade to the updated VA release as soon as it is available.
We will continue to update this bulletin as remediation and validation progress.
For more information, see the PHP announcement (https://www.php.net/archive/2026.php#2026-10-21-5) and the eMudhra security incident notice (https://emudhra.com/en/post/certificate-security-incident).
Customers with questions can contact Vasion Support at printsupport@vasion.com or reach out to their account manager.
Posted Oct 22, 2026 - 19:00 UTC
Identified
October 21, 2026: External Security Advisory Affecting Vasion Products (PHP Remote Code Execution Vulnerabilities and eMudhra Intermediate CA Compromise)
Vasion is remediating two third-party and industry-wide security issues.
Vasion is aware of two issues affecting the third-party PHP language runtime and eMudhra certificates used in software around the world. Vasion has been actively investigating and remediating both issues since becoming aware of them.
On October 21, the PHP Foundation released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to address the two critical vulnerabilities that could allow unauthenticated remote code execution [see https://www.php.net/index.php#2026-10-21-5 for more details].
Separately, the private keys of multiple eMudhra intermediate certificate authorities (together with their cross-signed variants) were reported compromised, which could allow an attacker to impersonate websites and services for clients that still trust them [see https://emudhra.com/en/post/certificate-security-incident for more details].
Vasion-hosted services are being updated by Vasion and will require no customer action.
For customers running the Vasion Virtual Appliance (VA), we will be releasing an updated VA version that includes these fixes. It is an emergency security update, and Customers should upgrade to the updated VA release as soon as it is available.
We will update this bulletin as remediation and validation progress. Customers with questions can contact Vasion Support at printsupport@vasion.com or get in touch with your account manager.
Posted Oct 21, 2026 - 19:56 UTC
This incident affected: VasionNow - US Region (Administrative Console, Client - Chrome OS, Client - Linux OS, Client - Mac OS, Client - Mobile (Android), Client - Mobile (iOS), Client - Windows OS, Control Panel Application (CPA), Data Manager, Driver/Profile Management, Email Printing, MSP Portal, Off Network Cloud Printing (ONCP), Off-network Printing (ONP), Offline Secure Release Printing (OSRP), Output Automation (OM), QR-Release, Quota/Cost Management, Reporting/Notifications, Self-Service Portal, Service Manager, SNMP, User Authentication, Web Print), Scheduled Release - US Region (SRS Platform (Maintenance) - US Region, Administrative Console, Client - Chrome OS, Client - Linux OS, Client - Mac OS, Client - Mobile (Android), Client - Mobile (iOS), Client - Windows OS, Control Panel Application (CPA), Data Manager, Driver/Profile Management, Email Printing, MSP Portal, Off-Network Cloud Printing (ONCP), Off-network Printing (ONP), Offline Secure Release Printing (OSRP), Output Automation (OM), QR-Release, Quota/Cost Management, Reporting/Notifications, Self-Service Portal, Service Manager, SNMP, User Authentication, Web Print), Scheduled Release - EMEA Region (SRS Platform (Maintenance) - EMEA Region, Administrative Console, Client - Chrome OS, Client - Linux OS, Client - Mac OS, Client - Mobile (Android), Client - Mobile (iOS), Client - Windows OS, Control Panel Application (CPA), Data Manager, Driver/Profile Management, Email Printing, MSP Portal, Off-Network Cloud Printing (ONCP), Off-network Printing (ONP), Offline Secure Release Printing (OSRP), Output Automation (OM), QR-Release, Quota/Cost Management, Reporting/Notifications, Self-Service Portal, Service Manager, SNMP, User Authentication, Web Print), Scheduled Release - Singapore Region (SRS Platform (Maintenance) - Singapore Region, Administrative Console, Client - Chrome OS, Client - Linux OS, Client - Mac OS, Client - Mobile (Android), Client - Mobile (iOS), Client - Windows OS, Control Panel Application (CPA), Data Manager, Driver/Profile Management, Email Printing, MSP Portal, Off-Network Cloud Printing (ONCP), Off-network Printing (ONP), Offline Secure Release Printing (OSRP), Output Automation (OM), QR-Release, Quota/Cost Management, Reporting/Notifications, Self-Service Portal, Service Manager, SNMP, User Authentication, Web Print), Scheduled Release - North Europe Region (SRS Platform (Maintenance) - North Europe Region, Administrative Console, Client - Chrome OS, Client - Linux OS, Client - Mac OS, Client - Mobile (Android), Client - Mobile (iOS), Client - Windows OS, Control Panel Application (CPA), Data Manager, Driver/Profile Management, Email Printing, MSP Portal, Off-Network Cloud Printing (ONCP), Off-network Printing (ONP), Offline Secure Release Printing (OSRP), Output Automation (OM), QR-Release, Quota/Cost Management, Reporting/Notifications, Self-Service Portal, Service Manager, SNMP, User Authentication, Web Print), Scheduled Release - APAC Region (SRS Platform (Maintenance) - APAC Region, Administrative Console, Client - Chrome OS, Client - Linux OS, Client - Mac OS, Client - Mobile (Android), Client - Mobile (iOS), Client - Windows OS, Control Panel Application (CPA), Data Manager, Driver/Profile Management, Email Printing, MSP Portal, Off-Network Cloud Printing (ONCP), Off-network Printing (ONP), Offline Secure Release Printing (OSRP), Output Automation (OM), QR-Release, Quota/Cost Management, Reporting/Notifications, Self-Service Portal, Service Manager, SNMP, User Authentication, Web Print), and Scheduled Release - Canada Region (SRS Platform (Maintenance) - Canada Region, Administrative Console, Client - Chrome OS, Client - Linux OS, Client - Mac OS, Client - Mobile (Android), Client - Mobile (iOS), Client - Windows OS, Control Panel Application (CPA), Data Manager, Driver/Profile Management, Email Printing, MSP Portal, Off-Network Cloud Printing (ONCP), Off-network Printing (ONP), Offline Secure Release Printing (OSRP), Output Automation (OM), QR-Release, Quota/Cost Management, Reporting/Notifications, Self-Service Portal, Service Manager, SNMP, User Authentication, Web Print).