Treasure AI is assessing recently disclosed PHP and Node.js vulnerabilities, the eMudhra certificate security incident, and the PingCAP/TiDB security incident.
This page summarizes potential impact to the Treasure AI service, the actions we are taking, and any steps customers may need to take. We will update it when there are material changes to our findings, remediation status, or customer guidance.
|
Item |
Treasure AI assessment |
|
PHP vulnerabilities |
Treasure AI’s production services are not built in PHP. A small number of legacy sites using PHP outside the Treasure AI service have been shut down. We are completing a final review of production systems, including third-party components, to determine whether any further remediation is needed. |
|
Node.js vulnerabilities |
Our remediation relies primarily on AWS’s automatic runtime updates as AWS makes patched versions available. We are monitoring patch availability and rollout, verifying that applicable updates reach our workloads, and addressing components that require separate updates. |
|
eMudhra certificate incident |
Certificate trust remediation and customer-impact assessment are in progress. |
|
PingCAP/TiDB incident |
No internal use identified in the preliminary review. No impact to the Treasure AI service is currently expected; final verification remains pending. |
Our review of production infrastructure and software dependencies has not identified PHP in the environment supporting the Treasure AI service. We are completing the exposure assessment to confirm whether any remediation is needed. This finding remains preliminary, and we have not yet reached a final impact determination for CVE-2026-109618 or CVE-2026-109619. Details are available in the official PHP advisory.
We have identified Node.js components requiring security updates, including components used in production. Automatic runtime updates are already enabled for the AWS-managed Lambda workloads reviewed to date. Supported runtimes will apply applicable fixes through AWS’s managed rollout as patched versions become available. We are monitoring availability and verifying deployment, while addressing components that require separate updates. Details are available in the official Node.js advisory.
We have identified certificate trust updates required in our environment in response to the eMudhra incident. Our engineering teams are updating relevant trust stores and runtimes and validating that affected certificates are rejected. Remediation remains in progress while we verify deployment coverage and complete our assessment of any impact to the Treasure AI service. Details are available in the official eMudhra statement.
Our preliminary review has not identified internal use of PingCAP/TiDB Cloud by Treasure AI, and we do not currently expect an impact to Treasure AI’s customer data and/or the Treasure AI service. Final verification of any current or historical exposure remains pending before we make a final impact determination. Details of the incident are available in the official PingCAP notice.
If our investigation identifies actions customers need to take, we will provide specific instructions here and communicate directly with affected customers as appropriate.
We will publish our next update on this page within the next 24 hours, or sooner if there are material developments. For questions specific to your organization, please contact Treasure AI Support through your usual support channel.
