eMudhra/emSign CA compromise (October 2026): what Cloud SDK PHP Libraries developers need to do
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Newbie friendliness
- 8/100
Research direction
This is a locked security advisory notice with no code change requested and no contribution path, so there is nothing to implement. A contributor should not pick it up; the actions it lists (updating grpc/grpc to 1.84.1 or google/gax to 1.51.2 in a project's composer.json, and refreshing the OS trust store) belong to downstream users. Done would mean nothing for a newcomer here; questions belong in a new issue.
Written by the indexing model from the issue text.
Description
Summary
Eight eMudhra (emSign) intermediate CA certificates have recoverable private keys (Mozilla bug 2083449). Clients whose trust store still contains emSign ECC Root CA - G3, emSign Root TLS CA - G3 or AAA Certificate Services can be impersonated by an on-path attacker.
The following packages and trust stores are affected
- Composer package
grpc/grpcearlier than 1.84.1 (gRPC transports). The package loads its bundled trust store and does not read the operating system trust store. - The operating system's trust store (REST transports).
You can take the following actions to resolve these issues
- Run
composer update grpc/grpcto 1.84.1 or later. - Alternatively, run
composer update google/gaxto 1.51.2 or later; it requiresgrpc/grpc1.84.1 or later and pulls it in. - Update the operating system trust store.
Advisory: GHSA-gvrc-7wf9-p7hg (grpc/grpc).
Google Cloud Security Bulletin: GCP-2026-075.
This issue is locked. Please open a new issue for questions.
- Dominant language
- PHP
- Stars
- 1.2k
- Forks
- 466
- Avg merge
- 1d 17h
- Merged PRs (30d)
- 40
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from googleapis/google-cloud-php
-
[Gax] RetryMiddleware keeps a reference to itself since v1.43.1, leaking the handler chain and its sockets in long-running processesPossibly taken @Hectorhammett claimed this 21 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
googleapis/google-cloud-php#9813 · 1 comment · 1 assignee ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
googleapis/google-cloud-php#9811 ·
Maintainers usually reply within 1 day
-
Consider clarifying which RFCs are supportedPossibly taken @bshaffer claimed this 14 days ago. Opentype: feature request
Difficulty 1/5 Under an hour Newbie friendliness 75/100
googleapis/google-cloud-php#9716 · 11 reactions ·
Maintainers usually reply within 1 day
-
Release verification failedPossibly taken @bshaffer claimed this 13 days ago. Open:rotating_light: critical
googleapis/google-cloud-php#9838 · 12 comments · 1 assignee ·
Maintainers usually reply within 1 day
-
[firebase/php-jwt] Support ML-DSA signing algorithmsPossibly taken @bshaffer claimed this 36 days ago. Open
Difficulty 5/5 Over a week Newbie friendliness 35/100
googleapis/google-cloud-php#9777 · 4 comments · 2 reactions · 1 assignee ·
Maintainers usually reply within 1 day
All issues in googleapis/google-cloud-php
Similar issues
-
Difficulty 1/5 Under an hour Newbie friendliness 89/100
backdrop-contrib/commerce#65 ·
-
backend enhancement good first issue php
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 1 day
-
enhancement good first issue help wanted
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Evalogical-Inc/devReady#66 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
mollie/PrestaShop#1627 ·
Maintainers usually reply within 5 days
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
FriendsOfFlarum/follow-tags#118 ·