Virtualization Watch 005: eMudhra Intermediate CA Key Compromise Reaches the Virtualization Stack; VCF Management Plane Hit by Node2Shell

The ZSvirt Team · November 1, 2026 · Biweekly · Coverage window: 2026-10-17 to 2026-11-01

Highlights

The trust chain was the story. Proof-of-compromise for eight eMudhra intermediate CA keys forced emergency trust-store updates across browsers, runtimes, and the XCP-ng / Xen Orchestra appliance.
Node2Shell reached the management plane. VCF SDDC Manager is exposed through its bundled Node.js; VMSA-2026-0008.1 has workarounds but no patch, and CISA added the CVE to its KEV catalog.
Proxmox’s 24/7 support took effect on October 19, and the Lightbits native NVMe/TCP storage plugin shipped on October 29.
KVM Forum 2026 is two weeks out; the schedule is live, and XSA-523 goes public on November 3.

Editorial Note

The main thread of this issue is not a new hypervisor feature — it is the chain of trust.

On October 17, a researcher submitted evidence to the major browser root programs: the private keys of eight eMudhra intermediate CA certificates were weak to the point of being “integers below 256” — recoverable by anyone from the certificates themselves. Within a week, Mozilla, Chrome, Apple and Microsoft had all blocked the intermediates, and eMudhra announced its exit from the global SSL/TLS business. The virtualization world was not spared: the system trust stores of XCP-ng 8.3 and the Xen Orchestra Appliance were squarely on the affected list (VSA-2026-050).

In the very same week, what the security community dubbed “Black October” detonated: the Node.js Brotli decoder RCE (Node2Shell), two PHP zero-days (PHP2Shell), a CVSS 10.0 GitLab RCE, and the LiteLLM supply-chain poisoning. On October 27, Broadcom published VMSA-2026-0008 (updated to VMSA-2026-0008.1 on October 28): VCF’s SDDC Manager is exposed to Node2Shell through its bundled Node.js runtime — a workaround exists, but no patch as of press time, and CISA has added the CVE to its Known Exploited Vulnerabilities catalog. Supply-chain risk on the management plane has rarely been this concrete.

Meanwhile, the industry kept moving: Proxmox’s 24/7 enterprise support took effect, a native storage integration with Lightbits was announced, and the KVM Forum 2026 schedule went up. Vancouver in two weeks.

Catch-Up: Last Issue’s Window (9/28–10/18)

Issue 004 is live on zsvirt.io; below is a brief recap of the window’s major items — see Issue 004 for full coverage.

VMware Explore on Tour Frankfurt (10/13–14): the anticipated vSphere Standard comeback details never materialized — no pricing, no core cap, no GA date, only a verbal “aimed at smaller estates around 128 cores.” Broadcom partner AceMQ confirmed in an October 22 fact-check that vSphere Standard is still absent from the price list they quote from: the “return” remains a statement, not a product (AceMQ’s analysis, which cited this newsletter’s Issue 004 Frankfurt report).
TalosCon 2026, Amsterdam (10/15–16): public alpha debut of Talos Hypervisor — native KVM built into Talos Linux as a system extension, no KubeVirt required, MPL-2.0 open source, GA targeted for December 2026; the companion Talos Director management plane was shown on stage, and parent company Yardi has already migrated thousands of VMs off VMware onto it (official press release).
QEMU 11.1.2 (9/28): stable-branch maintenance release, shipped alongside 11.0.5 and 10.0.14 (source tarball).
OpenStack 2026.2 “Hibiscus” (9/30): the 34th release, ~600 contributors and 11,500 code changes; Nova adds AMD SEV-SNP and Intel TDX confidential computing, Cyborg manages vGPU-class mediated devices, Neutron gains BGP EVPN Type-5 advertisement and cuts HA router monitoring memory by over 15x; a non-SLURP release (Release Highlights).

OpenStack 2026.2 Hibiscus release highlights page ▲ openstack.org: the 2026.2 “Hibiscus” release highlights, covering Nova, Cyborg, Neutron and more.

Harvester v1.9.1: still not GA — a status update. Issue 004 already corrected the earlier “v1.9.1 GA” tip: it was rc3 (10/8) when Issue 004 went to press, has advanced to rc5 (10/31) this window, and v1.10.0-rc1 has also appeared — but no stable tag exists yet (GitHub Releases). RC builds support neither upgrades from older versions nor upgrades to later ones; do not use in production.
Azure NVv4 retirement (effective 9/30): unmigrated NVv4 instances have been deallocated, stopped billing, and lost SLA coverage; Microsoft recommends NVadsA10_v5 (GRID license included), with NCasT4_v3 for latency-insensitive inference. Note the reported failure when resizing NVv4 directly to NVads_V710_v5 — use the temp-disk migration procedure instead (Microsoft’s retired-sizes list, migration field guide).
Two more security items from the 004 window: Microsoft’s October 13 Patch Tuesday fixed two Hyper-V guest-to-host RCEs — CVE-2026-102214 and CVE-2026-105733 (both CVSS 8.8, the latter in the nested-virtualization case) — plus VBS Enclave elevation-of-privilege CVE-2026-96914; the same update stops VMConnect enhanced sessions from sharing printers, smart cards and WebAuthn devices by default (MSRC: CVE-2026-102214).

In Focus

Focus 1: The eMudhra Intermediate CA Key Compromise — a Trust-Store Cleanup for the Virtualization Stack

This may be the most bizarre CA incident since DigiNotar in 2011: not an intrusion, but a defective key-ceremony script. During an April 30, 2025 key ceremony, eMudhra’s wrap/unwrap process generated a second, weak key set for eight intermediate CAs — P-384 private keys that were integers below 256, recoverable in under a second from the public certificates. Six of the eight were TLS-issuing, two were code-signing, and all eight were cross-signed by Sectigo’s AAA Certificate Services root, putting 16 certificates in scope.

Cloudflare: 8 eMudhra certificates are compromised ▲ Cloudflare’s incident write-up, published October 20: eight eMudhra intermediate certificates were compromised.

Timeline (UTC):

10/17: Researcher “Wayne” submits signed proof of control over all eight keys to Apple, Chrome, Microsoft, Mozilla and eMudhra; Chrome pushes a CRLSet block the same evening, Firefox follows via OneCRL.
10/18: eMudhra revokes all eight intermediates with reason caCompromise.
10/19: Sectigo revokes the cross-signs; Apple blocks; Mozilla begins notifying downstream trust-store operators; Python’s certifi 2026.10.19 removes the related root.
10/20: Microsoft blocks; Mozilla decides to remove emSign ECC Root CA - G3 entirely (NSS 3.131.1); Go 1.26.10 / 1.27.3 ship with a hardcoded denylist (CVE-2026-111943); Cloudflare publishes its incident response (Cloudflare blog).
10/21: the Node.js security releases remove the root as well.
10/22: eMudhra announces its exit from the global SSL/TLS certificate business; roughly 30,000 certificates under the G3 root need replacement, though eMudhra says the affected intermediates issued no end-entity certificates.
10/27: Chrome Stable removes emSign ECC Root CA - G3.

The direct hit for virtualization practitioners landed on October 22: Vates published VSA-2026-050 (Important), confirming that the system trust stores (ca-certificates package) of XCP-ng 8.3 and Xen Orchestra Appliance contained the compromised chains; an attacker holding the leaked keys could forge certificates for arbitrary sites to mount man-in-the-middle attacks. Fixed packages are released.

VSA-2026-050: eMudhra compromise affects XCP-ng 8.3 and Xen Orchestra ▲ Vates VMS documentation: VSA-2026-050 rates the impact Important for XCP-ng 8.3 and the Xen Orchestra Appliance.

Editor’s take: browsers blocked the intermediates within hours, but the residual exposure for virtualization and infrastructure software lives outside the browser — out-of-band management interfaces, backup software’s outbound connections, and Go-written controllers mostly rely on bundled or system trust stores and skip revocation checks. The lesson for every infrastructure team: trust stores are assets that need inventory and patch management too. For exposure-hunting methodology, see Endor Labs’ analysis.

Focus 2: “Black October” Reaches the Management Plane — VMSA-2026-0008.1 and Node2Shell

Between October 17 and 22, the security community saw an unusually dense cluster of disclosures now referred to as “Black October”:

Node2Shell (CVE-2026-111497, High): an out-of-bounds write in Node.js’s bundled Brotli decoder allowing remote code execution. Fixed October 21 in 22.23.4 / 24.22.1 / 26.12.1, in a release batch of 10 CVEs that also removed the eMudhra root (Node.js security advisory). Note: Node compiles Brotli into its binary — updating the OS Brotli library is not enough; the Node runtime itself must be replaced; EOL lines (20.x and older) get no fix. CISA added CVE-2026-111497 to its KEV catalog on October 27.
PHP2Shell (CVE-2026-109618 / 109619, CVSS 9.2): two memory-corruption bugs in PHP core — one out-of-memory state-corruption flaw and one use-after-free — exploitable unauthenticated, patched October 21 in 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35.
An unauthenticated GitLab RCE (CVE-2026-110264, CVSS 10.0) and the LiteLLM 1.107.0 supply-chain poisoning (an unrevoked platform master key led to stolen release tokens pushing a malicious build) broke in the same window.

The virtualization angle arrived on October 27: Broadcom published VMSA-2026-0008.1 (initial advisory October 27; updated October 28), confirming that VMware Cloud Foundation’s SDDC Manager is affected by CVE-2026-111497 through its bundled Node.js. The CVSS range is 7.5–9.8: 9.8 Critical for SDDC Manager 9.1.1.x, 7.5 Important for 9.0.x, 9.1.0 and 5.2.x. As of press time there is no patch, only documented workarounds (KB460732 for 9.1.1.x, KB460734 for older branches). CISA added the CVE to its KEV catalog on October 27 with a November 10 remediation deadline (CISA KEV).

VMware Security Blog listing VMSA-2026-0008 ▲ VMware Security Blog: VMSA-2026-0008 was published October 27 and updated to VMSA-2026-0008.1 on October 28.

Editor’s take: SDDC Manager is the lifecycle hub of a VCF private cloud, and its Node.js dependency turns a language-runtime flaw into a Critical exposure of the private-cloud management plane. The pattern is now unmistakable: the attack surface of the virtualization control plane is increasingly defined by the general-purpose software stack it embeds. Runtime inventories (Node, PHP, Java versions) of management-plane components belong in your vulnerability-response scope — don’t wait for a vendor advisory to learn what you’re running.

Releases & Product News

Proxmox: 24/7 support takes effect; Lightbits native storage integration ships

Proxmox’s 24/7 enterprise support — announced September 2 and covered in Issue 002 — took effect on October 19: Premium subscriptions immediately, Standard through a Q4 onboarding window, Basic unchanged. The Proxmox North America Inc. subsidiary in Kingston, Ontario, announced at the same time, handles regional sales and support (Proxmox press releases).
On October 29, Proxmox and Lightbits Labs announced a partnership bringing native NVMe-oF/TCP block storage integration to Proxmox VE: the Apache-2.0 plugin pve-lightbits provisions VM disks directly as Lightbits volumes, with snapshots and rollback driven by qm snapshot/qm rollback and cluster-wide shared capacity. For teams replacing vSphere + vSAN with Proxmox, Lightbits positions this as a path to SAN-class performance.

Proxmox press releases: Lightbits partnership (Oct 29), 24/7 support and North America entity (Sept 2) ▲ Proxmox press-release index: the 24/7 support and North America announcement is dated September 2; the Lightbits partnership was announced October 29.

pve-lightbits: native Lightbits storage plugin for Proxmox VE ▲ GitHub: the pve-lightbits repository, an Apache-2.0 Proxmox VE storage plugin for Lightbits NVMe/TCP volumes.

VirtualBox 7.2.22 (10/20)

Released the same day as Oracle’s October Critical Patch Update, 7.2.22 fixes multiple high-severity issues across local and adjacent-network attack vectors (CVSS up to 8.4); desktop virtualization users should update promptly (Oracle October 2026 CPU).

Oracle Critical Patch Update Advisory – October 2026 ▲ Oracle: the October 2026 Critical Patch Update advisory.

Harvester v1.9.1-rc5 (10/31)

Steady progress toward GA; mainline v1.10.0-rc1 has also appeared. Once again: pre-releases have no supported upgrade path — test environments only (GitHub Releases).

Harvester releases page showing v1.9.1-rc5 and v1.10.0-rc1 pre-releases ▲ GitHub: Harvester v1.9.1-rc5 (10/31) and v1.10.0-rc1 (10/30), both marked pre-release.

Industry Watch: Silence Again in Tokyo; London Is the Next Checkpoint

VMware Explore on Tour Tokyo (10/20–21) has concluded. VMware’s official season recap covers VCF and private AI at length and never mentions vSphere Standard. Combined with AceMQ’s October 22 fact-check (no price, no SKU, no route to market; vSphere 8 Standard general support still ends October 11, 2027), the “Standard comeback” has now gone two tour stops without substance. Next checkpoint: London (11/18–19).

Number of the Week: 256

The eight eMudhra P-384 private keys were integers below 256 — 256 guesses exhaust the key space of what should have held 384 bits of entropy. Researchers recovered all eight keys, covering 16 certificates, in under a second.

Security Advisories

Advisory	Date	What	Action
VMSA-2026-0008.1	10/27, updated 10/28	VCF SDDC Manager affected by Node.js Brotli RCE (CVE-2026-111497); CVSS 9.8 Critical on 9.1.1.x, 7.5 Important on older branches	Patch pending; apply workaround KB460732 / KB460734; CISA KEV due 11/10
VSA-2026-050	10/22	eMudhra compromise reaches XCP-ng 8.3 / Xen Orchestra Appliance trust stores, Important	Apply the released security updates
Node.js October security releases	10/21	10 CVEs (incl. Node2Shell) + eMudhra root removal	Upgrade to 22.23.4 / 24.22.1 / 26.12.1
Oracle October CPU	10/20	VirtualBox 7.2.22 fixes multiple high-severity flaws	Update desktop virtualization estates promptly

Embargo alert: the Xen Project’s advisory index shows XSA-523 pre-released under embargo, going public November 3, 12:00 UTC; XSA-529 and XSA-530 are scheduled for November 10, 18:00 UTC. Teams running Xen / XCP-ng should reserve a patching window on November 3 (XSA index).

Xen advisory index showing embargoed XSA-523, XSA-529 and XSA-530 ▲ Xen Project: XSA-523, XSA-529 and XSA-530 are listed as pre-released but embargoed.

Community Buzz

CSDN: “Twenty Years of KVM: KVM Forum 2026 Trends and Field Guide” (10/22) — a Chinese-community preview (not the official agenda): AI and heterogeneous computing moving into virtualization’s main channel, with virtio-gpu, dynamic VRAM migration and multi-tenant inference SLAs expected to feature (article).
Cloud Hypervisor community momentum: PR #9094, bringing postcopy live migration to vhost-user backends, has drawn 68 review comments; PR #9183 explores letting virtio backends accept device (GPU) memory directly — both pointing at VMM evolution for AI workloads.
This newsletter got cited: AceMQ’s vSphere Standard fact-check (10/22) lists our Issue 004 Frankfurt report among its sources — thanks to every reader who keeps sending tips and corrections (AceMQ article).

Tools & Good Reads

What the VDDK public-download removal means for migration toolchains (ModernOps, 9/15, updated 9/16) — required reading if your backup/migration tooling depends on VDDK.
Azure NVv4 retirement migration field guide (Refonte Learning, 9/10) — includes the workaround for the reported direct-resize failure.

ZSvirt Community News

This newsletter is produced by the ZSvirt community; this section covers the publisher’s own updates, disclosed as such.

October 27–28: the two-part “ZSvirt Open-Source FAQ” went live (Part 1: installation, GPU support, networking & storage; Part 2: migration & backup, API, community and selection), answering the 20 most frequent questions since open-sourcing — OVA/qcow2 deployment, GPU passthrough and vGPU, and the three migration paths (ZMigrate / OVF / VMDK).

ZSvirt Open-Source FAQ, Part 1 ▲ zsvirt.io: the first of the two ZSvirt open-source FAQ posts, published October 27.

Next Issue Preview

KVM Forum 2026 (11/12–13, Coast Coal Harbour Hotel, Vancouver): the schedule is live; admission is $75, free for accepted speakers. Twenty years into KVM, expect confidential computing, virtio device evolution and AI-workload support to dominate (site & schedule).

KVM Forum 2026 site: schedule now available ▲ kvm-forum.qemu.org: KVM Forum 2026 runs November 12–13 in Vancouver.

XSA-523 public disclosure (11/3, 12:00 UTC), followed by XSA-529/530 on 11/10.
VMware Explore on Tour London (11/18–19) — the third checkpoint for vSphere Standard details (see Industry Watch).
Progress on Harvester v1.9.1 GA and Talos Hypervisor’s December GA commitment.

References

Virtualization Watch is produced by ZSvirt community volunteers and published biweekly. Tips and corrections are welcome through the community channels. Please credit the source when reposting.