SecuriThings Security Advisory

SecuriThings is aware of several recently disclosed security issues that have received broad public attention. Our engineering and security teams assess each such disclosure against the components used across our deployments as soon as reports emerge. This update summarizes our assessment and response for each.

PHP vulnerabilities — CVE-2026-109618 and CVE-2026-109619 (reported as PHP2Shell)

SecuriThings is aware of the two critical PHP vulnerabilities announced in the PHP project advisory published on October 20, 2026.

SecuriThings does not use PHP in any product, service, or supporting component. These vulnerabilities are therefore not applicable to SecuriThings services, and no remediation is required.

eMudhra certificate authority incident

SecuriThings is aware of publicly reported information concerning a security incident involving eMudhra, a public certificate authority. Our engineering and security teams began assessing potential exposure across the components used in our deployments as soon as those reports emerged. To date, we have not identified any impact to SecuriThings services or customer data.

Brotli decompression vulnerability — CVE-2026-111497 (reported as Node2Shell / HTTP2Shell)

SecuriThings is aware of the recently disclosed Brotli decompression vulnerability and the associated public reporting under the names Node2Shell and HTTP2Shell. Our engineering and security teams began assessing exposure immediately upon disclosure.

Out of an abundance of caution, web application firewall rules covering the known request paths associated with this vulnerability are in place. To date, we have not identified any impact to SecuriThings services or customer data, and no evidence of exploitation.

Remediation status and availability of fixes

Cloud deployments. Fixes have been deployed to SecuriThings cloud platform as part of normal service operation and require no action from cloud customers. Fixed Connector components are available.

On-premise deployments. All available fixes have been incorporated into the on-premise codebase. A new on-premise release containing them is scheduled for availability on or before 3 November 2026. We will notify on-premise customers directly when the release is published, together with upgrade guidance. Customers running on-premise deployments will need to apply this release in order to receive the fixes.

Across all items

We are continuing to monitor these situations closely and will update this statement if material new information becomes available. If you have questions specific to your deployment, please contact your Customer Success Manager.