Heroku has mitigated an eMudhra certificate authority compromise by automatically updating system certificate packages across several base stacks. However, resolving two critical remote code execution vulnerabilities requires developers to redeploy their PHP applications to adopt patched runtimes ranging from version 8.1.34 up to 8.5.12. Local development environments must also be updated, as the Heroku Command Line Interface requires a new release to fix its bundled Node runtime. Furthermore, teams managing custom certificate bundles in applications using Go, Ruby, or Node.js must manually audit and update those dependencies.
Key points
Application owners must rebuild and redeploy their workloads by pushing an empty commit o…: Application owners must rebuild and redeploy their workloads by pushing an empty commit or triggering their standard pipeline.
Developers must upgrade their local Heroku Command Line Interface to version v11.12.1 to…: Developers must upgrade their local Heroku Command Line Interface to version v11.12.1 to patch the bundled Node runtime.
Teams utilizing libraries with internal certificate authorities, such as Ruby Excon or Go…: Teams utilizing libraries with internal certificate authorities, such as Ruby Excon or Go tools, must manually audit and update those dependencies.
Sources checked by our analysis pipeline: 1
- Last Updated: October 29, 2026
Keeping up with vulnerabilities and dependency updates takes a lot of engineering teams’ time.
Recently, two critical remote code execution vulnerabilities were disclosed in PHP: CVE-2026-109618 and CVE-2026-109619. Around the same time, teams were also responding to the eMudhra private key compromise, which required updating root certificates across base images and system packages.
Issues that impact both root certificates and language runtimes usually require separate patching workflows. Because Heroku manages your runtime images and base stacks, the update process is much more straightforward for our users. You can deploy the language runtime updates with a standard rebuild and the root certificates patch in Heroku-22, Heroku-24, and Heroku-26 required no action on your part.
More details on the recent security updates
Two security issues recently prompted updates:
- The PHP Foundation released patches for CVE-2026-109618 and CVE-2026-109619. These two critical vulnerabilities stem from request cleanup and memory handling flaws, affecting PHP versions 5.4 through 8.5.11.
- A private key compromise at eMudhra required operating systems to distrust intermediate certificates, which prompted updates to the system
Meta is stepping up its direct competition with rival video platforms by targeting established digital talent. According to reporting from Business Insider, the company is deploying targeted financial incentives to persuade creators to bring their existing long-form catalogs over to a dedicated format. The push represents a calculated effort to expand beyond short-form clips and secure deeper audience engagement.
The latest platform release delivers 25 improvement proposals alongside nearly a thousand code commits to bolster cluster management and client performance. Administrators gain advanced tooling to unregister controllers, while storage directory formatting changes impose stricter version parity requirements on brokers. These architectural refinements and scheduled deprecations help engineering teams prepare their event-streaming infrastructure for upcoming major milestones.
Regional professionals gathered at London's Amazon UK Corporate Office throughout three quarterly meetups to build practical skills and share best practices. The sessions aimed to help attendees make data-driven business decisions through collaborative discussions and direct tool engagement. This growing platform ecosystem fostered deeper local industry connections following its initial launch.