Padrino and the October 2026 PHP and certificate security incidents
Our services team at Padrino Systems will check it for you.
Two security incidents made headlines in October 2026: PHP2Shell, a PHP vulnerability that allowed a server takeover with one request, and the eMudhra certificate compromise, in which eight certificate signing keys belonging to eMudhra were exposed. Here is what each one meant for Padrino and for the AI assistants you connect to it.
The Padrino app does not run on PHP.
The app, its API and the MCP server your assistant talks to are built on Node.js. PHP2Shell could not reach them. This website does use PHP, and on October 22, the day after the fix came out, we updated it along with every other server we run.
Your connection to Padrino is still the real Padrino.
The eMudhra keys could, in theory, be used to make a fake site look secure. Padrino's certificates come from Let's Encrypt, so a fake certificate from those keys would not be ours. On our side, we updated Node.js and our servers' lists of trusted issuers so the app refuses the exposed keys when it connects to the services it relies on.
Your AI assistant does not need anything new.
Claude, ChatGPT, Grok and Muse connect through the same sign-in and the same API keys as before. Nothing about how your assistant connects has changed.
What you do not need to do: change your password, reconnect your assistant, or create new API keys.
If you run your own servers alongside Padrino, the fixed PHP releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the fixed Node.js releases are 26.12.1, 24.22.1 and 22.23.4.
Need someone to check your website?
Our services team at Padrino Systems will check your website and servers and fix what is out of date.
Get help securing your siteFor plain advice anyone can follow, read what to do as a user.