Treasure AI is assessing recently disclosed PHP and Node.js vulnerabilities, the eMudhra certificate security incident, and the PingCAP/TiDB security incident.
This page summarizes potential impact to the Treasure AI service, the actions we are taking, and any steps customers may need to take. We will update it when there are material changes to our findings, remediation status, or customer guidance.
Latest update - October 23, 2026, 12:50 AM EST: Node.js updates and eMudhra certificate-trust remediation remain in progress. Certificate-trust updates have been deployed and tested in selected production services. We are also assessing Apache Tomcat security advisories following customer inquiries.
|
Item |
Treasure AI assessment |
|
PHP vulnerabilities |
Our investigation is complete and has not identified PHP in the production environment supporting the Treasure AI service. Previously identified legacy PHP sites outside the service have been shut down. Based on our findings, no known customer impact or additional remediation for the Treasure AI service is currently indicated. |
|
Node.js vulnerabilities |
Runtime updates and deployment verification remain in progress. Automatic runtime updates are enabled for the AWS-managed Lambda workloads reviewed to date, and we are addressing components requiring separate updates. |
|
eMudhra certificate incident |
Certificate-trust updates have been deployed to selected production services. Broader remediation, deployment verification and customer-impact assessment remain in progress, including work across Java and Python environments. |
|
Apache Tomcat security advisories |
Tomcat usage has been identified in the production environment supporting the Treasure AI service. The deployment reviewed is restricted to internal network access and is not directly accessible from the public internet. The broader assessment of the reported advisories and any required remediation remains in progress. |
|
PingCAP/TiDB incident |
Our investigation is complete and has not identified current or historical use of PingCAP/TiDB Cloud in the production environment supporting the Treasure AI service. Based on our findings, no known customer impact or remediation for the Treasure AI service is currently indicated. |
Our IR teams have completed their investigation into potential exposure to CVE-2026-109618 and CVE-2026-109619. The review did not identify PHP in the production environment supporting the Treasure AI service, and we did not identify a need for additional remediation in that environment. As previously reported, the identified legacy sites using PHP outside the Treasure AI service have been shut down. We consider this investigation complete and will reassess our findings if new information becomes available. Details are available in the official PHP advisory.
We have upgraded selected Node.js components to supported versions and continue to address components requiring separate updates. Automatic runtime updates are enabled for the AWS-managed Lambda workloads reviewed to date. We are working with AWS to confirm deployment of applicable fixes and verify deployment across relevant workloads. Remediation remains in progress. Details are available in the official Node.js advisory.
Production rollout of updated system images is underway. Certificate-trust updates have been deployed to selected production services. Validation performed to date has confirmed rejection of the affected certificate chains used in testing. Broader rollout, verification of deployment coverage and customer-impact assessment remain in progress.
Our review includes Java environments (including OpenJDK), Python, and certificate bundles packaged with client libraries and data-ingestion components. Our engineering teams are assessing these dependencies, applying updates where required and confirming patch status with relevant providers. Details are available in the official eMudhra statement.
Following customer inquiries about Apache Tomcat security advisories, we are assessing their applicability to Tomcat components identified in the production environment supporting the Treasure AI service. An initial review has confirmed that a Tomcat deployment in the production environment supporting the Treasure AI service is restricted to internal access. The broader assessment of the reported advisories and any required remediation remains in progress.
This assessment concerns Tomcat software vulnerabilities. Java certificate-trust updates associated with the eMudhra incident are covered in the eMudhra assessment above. The Tomcat assessment remains in progress. Details are available in the official Apache announcement.
Our IR teams have completed their investigation into potential exposure to the PingCAP/TiDB security incident. The review has not identified current or historical use of PingCAP/TiDB Cloud by Treasure AI, and we have not identified customer impact or a need for remediation within the Treasure AI service. We consider this investigation complete and will reassess our findings if new information becomes available. Details of the incident are available in the official PingCAP notice.
If our investigation identifies actions customers need to take, we will provide specific instructions here and communicate directly with affected customers as appropriate.
We will continue to update this page when there are material changes to our findings, remediation status or customer guidance. For questions specific to your organization, please contact Treasure AI Support through your usual support channel.
