Securing Your Stack: Recent PHP and eMudhra Updates on Heroku

Keeping up with vulnerabilities and dependency updates takes a lot of engineering teams’ time.

Recently, two critical remote code execution vulnerabilities were disclosed in PHP: CVE-2026-109618 and CVE-2026-109619. Around the same time, teams were also responding to the eMudhra private key compromise, which required updating root certificates across base images and system packages.

Issues that impact both root certificates and language runtimes usually require separate patching workflows. Because Heroku manages your runtime images and base stacks, the update process is much more straightforward for our users. You can deploy the language runtime updates with a standard rebuild and the root certificates patch in Heroku-22, Heroku-24, and Heroku-26 required no action on your part.

Why managed runtimes matter

On self-managed infrastructure, resolving runtime issues and certificate revocations requires auditing every server, updating base container images, and verifying individual trust stores. Heroku removes this low-level maintenance by managing the stack beneath your code. We have dedicated teams of language maintainers and security experts keeping our customers safe and buildpacks for supported languages up-to-date.

• Dyno containerization and runtime isolation keep applications separate, ensuring non-PHP apps remain secure from PHP-specific vulnerabilities.
• Managed base images (stack) receive system-level patches directly from Heroku, including updates to the ca-certificates package.
• Standard rebuilds apply language runtime updates and base image fixes together through your normal deployment pipeline.

Action required for PHP apps and CLI users

If you have not already rebuilt your PHP applications, we strongly recommend deploying an update to pick up the patched runtimes: PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.

For applications deployed directly to Heroku, trigger a rebuild with an empty commit:

git commit --allow-empty -m "rebuild app"
git push heroku main

If you deploy to Heroku through GitHub, push a new commit to trigger the build.

If you run end-of-life PHP 8.1 on Heroku-22, a backported mitigation is available in release 8.1.34. We recommend planning an upgrade to a fully supported PHP version.

Updating the Heroku CLI

The Heroku CLI runs locally on developer machines and packages a bundled Node runtime. If you have not updated your CLI recently, update to release v11.12.1 so your local environment receives the patched Node version.

Run the update command in your terminal:

heroku update stable

Checking your certificate dependencies

Heroku patched the ca-certificates system package in our base images, protecting your dynos from the eMudhra compromise with no action required on your part.

Some applications bundle their own root certificates inside specific language runtimes or third-party libraries. If your projects rely on Go packages, Node.js libraries, or Ruby gems like Excon that manage internal certificate stores, inspect those project dependencies directly. Make sure they are updated to versions that remove the compromised intermediate authorities and if changes are required, rebuild and redeploy your app.

Protecting your applications moving forward

Running a firewall in front of your application adds an extra layer of defense against remote exploits. Several security providers quickly deployed WAF protections to block traffic targeting these PHP vulnerabilities.

For specific release notes and patch details, check the Heroku Changelog for PHP runtime updates, Node.js updates, and base image certificate changes.

If you have questions about your application configurations or need assistance with upgrades, reach out through Heroku Support.