PHP Vulnerabilities

October 21, 2026

NinjaOne’s security team is aware of the PHP vulnerabilities reported on October 21, 2026, specifically CVE-2026-109618 and CVE-2026-109619.

There has been no impact on customers, customer data or systems, or any NinjaOne data or services to date. NinjaOne is not exposed or at risk given the reported vulnerabilities.

NinjaOne continues to be vigilant and monitor for ongoing threats and vulnerabilities to all of our systems and services. Customers and their data security remain NinjaOne’s top priority.

eMudhra Certificate Update

October 17, 2026

On October 17, 2026, it was reported that the private keys behind eight intermediate certificates issued by eMudhra, a certificate authority (CA), had been compromised. In response, Mozilla, Chrome, Apple, and Microsoft are removing trust in the affected root, and NinjaOne is doing the same in the NinjaOne agent.

This is an industry-aligned precaution and not a NinjaOne security incident. Most customers will see nothing. For customers who use eMudhra certificates, we strongly suggest you replace them.