The private keys of eight eMudhra intermediate certificate authorities are compromised, and every Python environment on an older certifi bundle trusts certificates they sign. Update certifi, pip and uv today; Node.js has merged the same fix but hasn't released it. Pillow 13.0.0 fixes 40 flaws, a 9.8 among them, but Gradio, Streamlit and Open WebUI still cap Pillow below 13. vLLM published nine advisories, all fixed in the 0.32.0 this digest recommended yesterday.

Scanners will miss most of this. GitHub's database holds the certifi and uv records and 9 of the 41 Pillow advisories, but neither Pillow critical. None of the vLLM or MCP Java SDK advisories is there, and nothing will flag Node.js at all.

Worth your morning

eMudhra: compromised intermediate keys, and a fix that depends on where your trust store lives. Mozilla reported yesterday that the private keys of eight eMudhra intermediate CAs are compromised. Chrome counts six of them as TLS issuers. Whoever holds one of those keys can issue a certificate for any hostname, and anyone on the network path can then read or alter TLS traffic from a client that trusts the root, emSign ECC Root CA - G3. Firefox and Chrome blocked the intermediates on October 17, within hours of the report. Chrome says no TLS certificate from the six appeared in Certificate Transparency logs before the block. Runtimes that ship their own CA bundle don't receive browser block lists, so they stay exposed until the bundle changes:

• certifi: 2026.10.18 (Sunday) removed every emSign root, and 2026.10.19 (yesterday) restored three that eMudhra's compromised intermediates don't chain to. Take 2026.10.19. It sits under requests, httpx and with them the OpenAI and Anthropic Python SDKs.
• pip always uses its vendored certifi, alongside the system store, so a patched OS doesn't protect it. pip 26.2.2 carries certifi 2026.10.19. Upgrade it inside every virtual environment. CPython merged 26.2.2 into its bundled copy yesterday but hasn't released it, so python -m venv still seeds the older pip unless you pass --upgrade-deps.
• uv 0.13.4 drops the root from its vendored bundle; run uv self update. sigstore 4.5.1 is the other Python fix named so far.
• Rust tools that compile in webpki-roots or webpki-root-certs need a rebuild against 1.0.10 (October 19).
• Node.js bundles the root in 22.23.3, 24.22.0 and 26.12.0. The update to NSS 3.131.1 merged to main yesterday and removes three emSign roots, G3 among them, but no release carries it. Until one does, Node trusts that root by default, and that includes MCP servers, Angular tooling and anything else calling fetch or https.
• Container images vendor certifi and system certificates at build time, so rebuild them. FastMCP 4.1.3 and 3.4.11 now require certifi 2026.10.19. They also note that FastMCP 4 trusts the system store by default, so the operating system and container stores need updating too.

Chrome also notes Sectigo-issued cross-certificates that share the compromised keys. The Sectigo root behind them left Chrome's store in April 2025. Trigger.dev 4.7.6 identifies it as Sectigo's AAA root and removes it from its images. Neither certifi 2026.10.19 nor Node's bundle contains AAA Certificate Services.

Pillow: 40 fixes in 13.0.0, and three popular frameworks that can't take it. Pillow 13.0.0 shipped late on October 16, and the project published 40 advisories against it the next day. This digest missed them because Pillow wasn't on its watch list. The worst, GHSA-v9pv (9.8, versions 11.0.0 – 12.3.0), lets one crafted multi-frame image run code in a service that opens it with Pillow. The second critical is a heap overflow in FlashPix decoding, and an 8.1 covers the OpenJPEG library bundled in every wheel since 11.1.0. The 13 highs are mostly memory errors and resource exhaustion in TIFF, JPEG and PDF handling. Pillow hasn't released a fix for 12.x, and the newest 12.x is 12.3.0 from July. Anything that decodes images it didn't create, which describes most multimodal serving, document parsing and upload handling, should move to 13.0.0. Three widely used projects stop that:

• Gradio 6.30.0 requires pillow<13.0, and its main branch still does.
• Streamlit 1.66.0 requires pillow<13. A pull request to allow 13 opened yesterday.
• Open WebUI 0.12.3 pins pillow==12.3.0, on both main and dev.

vLLM 0.32.0, Transformers and LlamaIndex accept 13.0.0. Installing 13.0.0 under Gradio, Streamlit or Open WebUI means overriding their constraint, which pip will report as a conflict. If you can't, keep untrusted images away from those apps until they lift the cap. One advisory stays open on 13.0.0. GHSA-654x (6.3 on v4) leaks stale heap memory, including other users' pixels, when an application sets PILLOW_ALIGNMENT and exports images to Arrow. Don't combine the two on shared services.

vLLM: nine more advisories, all fixed in 0.32.0. vLLM published them yesterday morning, two days after releasing 0.32.0. None is in GitHub's database.

• GHSA-h3rc-j82p (8.1): an image endpoint that accepts EPS input can lead to command execution on hosts whose Ghostscript is still vulnerable to CVE-2024-29510. Hosts without Ghostscript, or with a fixed build, are outside that chain.
• GHSA-6757 (7.5): any authenticated caller can run code in the worker on deployments that set --mm-processor-cache-type shm. The default is lru. The record's range stops at 0.25.1, but the fix isn't in 0.31.0 either: the signed-handle check is absent at that tag and present at 0.32.0.
• GHSA-x567 (6.5): the Responses API accepts request-supplied chat templates even when --trust-request-chat-template is off. Its range stops at 0.23.0 and its fix is also 0.32.0.
• Five more 6.5s: unbounded chat-template rendering that blocks every tenant on the replica, an out-of-vocabulary token ID that crashes the GPU worker, a DeepSeek-OCR image that kills the engine without authentication, a Phi-4 audio input that exhausts memory, and the P2P connection exhaustion this digest has followed as CVE-2026-94624 since September.
• A 3.4 for the old permissive CORS default, which 0.32.0 changed.

If 0.32.0 is already running, there is nothing more to do.

MCP Java SDK: browser-reachable tool calls. Three advisories went up yesterday, fixed in 0.18.5, 1.1.5 and 2.1.0, released October 16. In GHSA-hp8w (7.1), the default stateless Servlet transport accepts cross-origin requests, so a web page open in a user's browser can call tools on any server that browser can reach, local ones included. GHSA-2hm9 (high) lets a flood of initialize requests pile up sessions and take the server down. A 5.3 returns handler exception messages, with their full cause chain, to the peer. None has a CVE. In one record the package name starts with a space, so a scanner matching on names may not catch it even after it's indexed.

Also on the AI stack.

• rmcp (the official Rust MCP SDK) GHSA-4432 (7.5): unauthenticated clients can grow a cache in the Streamable HTTP server transport without limit, in 3.0.0 through 3.5.x. Fixed in 3.6.0 (yesterday).
• FastMCP ×2: tool authorization applied after transforms is skipped on direct calls (GHSA-7xgj, 6.8). On 4.x only, client wrappers build machine-to-machine OAuth providers without binding the issuer (5.9). Both are fixed in 3.4.10 and 4.1.2. Take 3.4.11 or 4.1.3 for the certifi requirement; the floor moves from Monday's 3.4.9 / 4.1.1.
• Pydantic AI GHSA-4whf (7.5): fetching attacker-controlled HTML with web_fetch_tool can stall other work in the same process, from 1.77.0. Fixed in 1.107.9 and 2.59.0, released this morning.
• Trigger.dev GHSA-65rr (7.5): on self-hosted webapps through 4.7.4, a CLI login can reactivate a revoked personal access token. The record lists 4.7.4 as both affected and fixed. Take 4.7.6, which also drops the emSign roots from its images.
• mem0 GHSA-5324 (6.3): colliding session-scope keys can leak one tenant's conversations to another. It was fixed in August, in 2.0.18 (Python) and 3.1.6 (npm), but published only yesterday. The newest releases are 2.2.1 and 3.3.1.
• Langflow 1.12.7, released at 01:17 UTC today, lists ten fix(security) changes that have no advisories yet. The CVE floor stays at 1.12.5 from Monday, but take 1.12.7.

On the Venicecom stack. Vite's three dev-server advisories from October 6 reached GitHub's database yesterday. The worst two (6.3 on v4) can serve files outside server.fs.allow, or the first bytes of them, to anyone who can reach the dev server. They're fixed in 6.4.4, 7.3.7, 8.1.6, 8.2.4 and 8.3.3. Angular's @angular/build pins Vite exactly: 8.3.0 on 22.2.3 and 7.3.6 on the 21 and 20 LTS lines. Every current Angular release therefore sits inside the file-serving range, and a lockfile refresh can't reach the fix. The records don't say whether ng serve reaches these paths. Keep it on its default localhost binding, and don't pass --host 0.0.0.0 on a shared network. In follow-redirects, only 1.16.0 (April) can send credential headers on a cross-origin redirect (GHSA-8r9p and GHSA-q3jh, 8.2 on v4). 1.16.1 fixed both on October 1, and axios 1.20.0 accepts it, so refreshing the lockfile is enough. markdown-it has two 7.5 denial-of-service bugs, fixed in 14.3.3 and 15.0.3 (GHSA-gfr2), which matters where it renders untrusted text. On .NET, CVE-2026-70197 is still at revision 2.0 ("has not been addressed"). None of the 165 October entries Microsoft added or revised yesterday touches .NET, ASP.NET Core or Azure.

Paperwork your scanner may raise. GitHub's database added the last five aiohttp advisories yesterday, so all eight from October 7 are there now (fixed in 3.14.4). It rated the file-descriptor exhaustion record 8.2 on v4. The database also added the MCP TypeScript SDK ×5, A2A Java SDK ×5 and Angular ×4 records that this digest covered on Monday and earlier. VulnCheck filed seven vLLM CVEs (CVE-2026-114049 to CVE-2026-114055) against the October 6 advisories, all fixed in 0.31.0. The CVE text for the mm_processor_kwargs record gives it the upper bound its advisory lacked when this digest flagged it on October 7. VulnCheck also filed five Trigger.dev CVEs (CVE-2026-114067, -114070 and -114090 to -114092) on July to September advisories, fixed by 4.6.2. Three Vibe-Trading CVEs (CVE-2026-114106 to -114108) cover the July advisories this digest noted on October 3, fixed in 0.1.7. Google ADK for TypeScript gained CVE-2026-105772 (9.1 on v4), an unauthenticated path traversal in FileArtifactService affecting @google/adk 0.4.0 – 0.5.x. Its repository advisory dates from September 29, and the fix shipped in 0.6.0 in March, so anything from the past seven months is clear; 2.3.0 is current. virtualenv's sixteen October advisories now carry CVEs (CVE-2026-113713 to -113726, -113732 and -113776). One low-severity record among them now lists no fixed version.

Standing items. MLflow 3.17.2, released this morning, doesn't fix CVE-2026-53995. The trace-ID check from PR 26842 is absent at the tag and the PR is still open, so keep file-backed servers private. SGLang's four fix PRs (45017, 42098, 44314 and 44653) remain unmerged, the dumper flaw still has no fix PR, and 0.5.22 is still the newest. DB-GPT is still on 0.8.2, with issue 3167 open. Xoscar 0.12.1 (yesterday) doesn't touch its authentication code, so XOSCAR_AUTH_KEY stays opt-in. Xinference 4.0.1 still lacks the Windows path fix. picomatch PR 194 is open. No Node.js release has carried the undici backports since they merged on October 18 and 19. Unchanged: Archon 0.12.1, Kubeflow Model Registry 0.3.17, Chroma 1.5.9, Portkey AI Gateway 1.15.2, BotSharp, Unla 0.10.0, Plano 0.4.37, the MCP Kotlin SDK 0.15.0, Vearch 3.5.9, openapi-typescript-codegen 0.31.0, cc-connect, AstronRPA 1.1.6, Mooncake 0.3.13.post1, pandas-ai 3.0.0, LightLLM v1.2.0, GPT-SoVITS, Langchain-Chatchat 0.3.1.3, BentoML 1.4.39, BrowserSkill (PR 363 unmerged), hyper-mcp (nightlies only) and mcp-remote, whose 0.15.2 is a bug fix. The n8n 2.45.0 pre-release and the GitLab MCP server 2.3.5 shipped without advisories. No PrimeNG advisories today.