# Virtualization Watch 005: eMudhra Intermediate CA Key Compromise Reaches the Virtualization Stack; VCF Management Plane Hit by Node2Shell

> Issue 005: eight eMudhra intermediate CA keys proven recoverable force trust-store updates across XCP-ng, Xen Orchestra and major runtimes; Node2Shell reaches VCF SDDC Manager (VMSA-2026-0008.1, patch pending, CISA KEV); Proxmox 24/7 support takes effect and the Lightbits integration ships; the KVM Forum 2026 schedule is live.

- Published: 2026-11-01
- Updated: 2026-11-01
- Author: [Virtualization Watch Editorial Desk](https://github.com/ZSvirt)
- Category: VirtWatch Weekly
- Tags: Virtualization, ZSvirt, VMware, Proxmox, KVM, Security Advisories, Newsletter, virtualization weekly, eMudhra intermediate CA compromise, emSign ECC Root CA G3, XCP-ng VSA-2026-050, Node2Shell, CVE-2026-111497, VMSA-2026-0008, SDDC Manager, CISA KEV, Proxmox 24/7 support, Proxmox Lightbits, KVM Forum 2026, Xen XSA-523

The ZSvirt Team · November 1, 2026 · Biweekly · Coverage window: 2026-10-17 to 2026-11-01

## Highlights

- **The trust chain was the story.** Proof-of-compromise for eight eMudhra intermediate CA keys forced emergency trust-store updates across browsers, runtimes, and the XCP-ng / Xen Orchestra appliance.
- **Node2Shell reached the management plane.** VCF SDDC Manager is exposed through its bundled Node.js; VMSA-2026-0008.1 has workarounds but no patch, and CISA added the CVE to its KEV catalog.
- **Proxmox's 24/7 support took effect** on October 19, and the Lightbits native NVMe/TCP storage plugin shipped on October 29.
- **KVM Forum 2026 is two weeks out**; the schedule is live, and XSA-523 goes public on November 3.

## Editorial Note

The main thread of this issue is not a new hypervisor feature — it is the **chain of trust**.

On October 17, a researcher submitted evidence to the major browser root programs: the private keys of eight eMudhra intermediate CA certificates were weak to the point of being "integers below 256" — recoverable by anyone from the certificates themselves. Within a week, Mozilla, Chrome, Apple and Microsoft had all blocked the intermediates, and eMudhra announced its exit from the global SSL/TLS business. The virtualization world was not spared: the system trust stores of XCP-ng 8.3 and the Xen Orchestra Appliance were squarely on the affected list (VSA-2026-050).

In the very same week, what the security community dubbed "Black October" detonated: the Node.js Brotli decoder RCE (Node2Shell), two PHP zero-days (PHP2Shell), a CVSS 10.0 GitLab RCE, and the LiteLLM supply-chain poisoning. On October 27, Broadcom published VMSA-2026-0008 (updated to VMSA-2026-0008.1 on October 28): VCF's SDDC Manager is exposed to Node2Shell through its bundled Node.js runtime — **a workaround exists, but no patch as of press time**, and CISA has added the CVE to its Known Exploited Vulnerabilities catalog. Supply-chain risk on the management plane has rarely been this concrete.

Meanwhile, the industry kept moving: Proxmox's 24/7 enterprise support took effect, a native storage integration with Lightbits was announced, and the KVM Forum 2026 schedule went up. Vancouver in two weeks.

## Catch-Up: Last Issue's Window (9/28–10/18)

> Issue 004 is live on [zsvirt.io](https://zsvirt.io/blog/virtwatch-weekly-issue-004); below is a brief recap of the window's major items — see Issue 004 for full coverage.

- **VMware Explore on Tour Frankfurt (10/13–14)**: the anticipated vSphere Standard comeback details **never materialized** — no pricing, no core cap, no GA date, only a verbal "aimed at smaller estates around 128 cores." Broadcom partner AceMQ confirmed in an October 22 fact-check that vSphere Standard is still absent from the price list they quote from: the "return" remains a statement, not a product ([AceMQ's analysis](https://acemq.com/blogs/vsphere-standard-return/), which cited this newsletter's Issue 004 Frankfurt report).
- **TalosCon 2026, Amsterdam (10/15–16)**: public alpha debut of Talos Hypervisor — native KVM built into Talos Linux as a system extension, no KubeVirt required, MPL-2.0 open source, GA targeted for December 2026; the companion Talos Director management plane was shown on stage, and parent company Yardi has already migrated thousands of VMs off VMware onto it ([official press release](https://www.prnewswire.com/news-releases/talos-linux-adds-native-hypervisor-and-edge-container-support--see-it-live-at-taloscon-2026-302877040.html)).
- **QEMU 11.1.2 (9/28)**: stable-branch maintenance release, shipped alongside 11.0.5 and 10.0.14 ([source tarball](https://download.qemu.org/qemu-11.1.2.tar.xz)).
- **OpenStack 2026.2 "Hibiscus" (9/30)**: the 34th release, ~600 contributors and 11,500 code changes; Nova adds AMD SEV-SNP and Intel TDX confidential computing, Cyborg manages vGPU-class mediated devices, Neutron gains BGP EVPN Type-5 advertisement and cuts HA router monitoring memory by over 15x; a non-SLURP release ([Release Highlights](https://releases.openstack.org/hibiscus/highlights.html)).

[Image available on the canonical HTML page: OpenStack 2026.2 Hibiscus release highlights page](https://zsvirt.io/blog/virtwatch-weekly-issue-005/)
*▲ openstack.org: the 2026.2 "Hibiscus" release highlights, covering Nova, Cyborg, Neutron and more.*

- **Harvester v1.9.1: still not GA — a status update.** Issue 004 already corrected the earlier "v1.9.1 GA" tip: it was rc3 (10/8) when Issue 004 went to press, has advanced to **rc5 (10/31)** this window, and v1.10.0-rc1 has also appeared — but no stable tag exists yet ([GitHub Releases](https://github.com/harvester/harvester/releases)). RC builds support neither upgrades from older versions nor upgrades to later ones; do not use in production.
- **Azure NVv4 retirement (effective 9/30)**: unmigrated NVv4 instances have been deallocated, stopped billing, and lost SLA coverage; Microsoft recommends NVadsA10_v5 (GRID license included), with NCasT4_v3 for latency-insensitive inference. Note the reported failure when resizing NVv4 directly to NVads_V710_v5 — use the temp-disk migration procedure instead ([Microsoft's retired-sizes list](https://learn.microsoft.com/en-us/azure/virtual-machines/sizes/lifecycle/retired-sizes-list), [migration field guide](https://www.refontelearning.com/blog/azure-nvv4-gpu-vm-retirement-migration)).
- **Two more security items from the 004 window**: Microsoft's October 13 Patch Tuesday fixed two Hyper-V guest-to-host RCEs — CVE-2026-102214 and CVE-2026-105733 (both CVSS 8.8, the latter in the nested-virtualization case) — plus VBS Enclave elevation-of-privilege CVE-2026-96914; the same update stops VMConnect enhanced sessions from sharing printers, smart cards and WebAuthn devices by default ([MSRC: CVE-2026-102214](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102214)).

## In Focus

### Focus 1: The eMudhra Intermediate CA Key Compromise — a Trust-Store Cleanup for the Virtualization Stack

This may be the most bizarre CA incident since DigiNotar in 2011: **not an intrusion, but a defective key-ceremony script**. During an April 30, 2025 key ceremony, eMudhra's wrap/unwrap process generated a second, weak key set for eight intermediate CAs — P-384 private keys that were integers below 256, recoverable in under a second from the public certificates. Six of the eight were TLS-issuing, two were code-signing, and all eight were cross-signed by Sectigo's AAA Certificate Services root, putting 16 certificates in scope.

[Image available on the canonical HTML page: Cloudflare: 8 eMudhra certificates are compromised](https://zsvirt.io/blog/virtwatch-weekly-issue-005/)
*▲ Cloudflare's incident write-up, published October 20: eight eMudhra intermediate certificates were compromised.*

Timeline (UTC):

- **10/17**: Researcher "Wayne" submits signed proof of control over all eight keys to Apple, Chrome, Microsoft, Mozilla and eMudhra; Chrome pushes a CRLSet block the same evening, Firefox follows via OneCRL.
- **10/18**: eMudhra revokes all eight intermediates with reason caCompromise.
- **10/19**: Sectigo revokes the cross-signs; Apple blocks; Mozilla begins notifying downstream trust-store operators; Python's certifi 2026.10.19 removes the related root.
- **10/20**: Microsoft blocks; Mozilla decides to remove **emSign ECC Root CA - G3** entirely (NSS 3.131.1); Go 1.26.10 / 1.27.3 ship with a hardcoded denylist (CVE-2026-111943); Cloudflare publishes its incident response ([Cloudflare blog](https://blog.cloudflare.com/emudhra-certificate-compromise)).
- **10/21**: the Node.js security releases remove the root as well.
- **10/22**: eMudhra announces its **exit from the global SSL/TLS certificate business**; roughly 30,000 certificates under the G3 root need replacement, though eMudhra says the affected intermediates issued no end-entity certificates.
- **10/27**: Chrome Stable removes emSign ECC Root CA - G3.

**The direct hit for virtualization practitioners** landed on October 22: Vates published [VSA-2026-050](https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-050/) (Important), confirming that the system trust stores (ca-certificates package) of **XCP-ng 8.3 and Xen Orchestra Appliance** contained the compromised chains; an attacker holding the leaked keys could forge certificates for arbitrary sites to mount man-in-the-middle attacks. Fixed packages are released.

[Image available on the canonical HTML page: VSA-2026-050: eMudhra compromise affects XCP-ng 8.3 and Xen Orchestra](https://zsvirt.io/blog/virtwatch-weekly-issue-005/)
*▲ Vates VMS documentation: VSA-2026-050 rates the impact Important for XCP-ng 8.3 and the Xen Orchestra Appliance.*

**Editor's take**: browsers blocked the intermediates within hours, but the residual exposure for virtualization and infrastructure software lives outside the browser — out-of-band management interfaces, backup software's outbound connections, and Go-written controllers mostly rely on bundled or system trust stores and skip revocation checks. The lesson for every infrastructure team: **trust stores are assets that need inventory and patch management too**. For exposure-hunting methodology, see [Endor Labs' analysis](https://www.endorlabs.com/learn/emudhra-intermediate-ca-compromise-the-trust-stores-you-patched-and-the-ones-you-didnt-know-you-had).

### Focus 2: "Black October" Reaches the Management Plane — VMSA-2026-0008.1 and Node2Shell

Between October 17 and 22, the security community saw an unusually dense cluster of disclosures now referred to as "Black October":

- **Node2Shell (CVE-2026-111497, High)**: an out-of-bounds write in Node.js's bundled Brotli decoder allowing remote code execution. Fixed October 21 in 22.23.4 / 24.22.1 / 26.12.1, in a release batch of 10 CVEs that also removed the eMudhra root ([Node.js security advisory](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)). Note: Node compiles Brotli into its binary — **updating the OS Brotli library is not enough; the Node runtime itself must be replaced**; EOL lines (20.x and older) get no fix. CISA added CVE-2026-111497 to its KEV catalog on October 27.
- **PHP2Shell (CVE-2026-109618 / 109619, CVSS 9.2)**: two memory-corruption bugs in PHP core — one out-of-memory state-corruption flaw and one use-after-free — exploitable unauthenticated, patched October 21 in 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35.
- An unauthenticated **GitLab RCE (CVE-2026-110264, CVSS 10.0)** and the **LiteLLM 1.107.0 supply-chain poisoning** (an unrevoked platform master key led to stolen release tokens pushing a malicious build) broke in the same window.

The virtualization angle arrived on October 27: Broadcom published **[VMSA-2026-0008.1](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/39445)** (initial advisory October 27; updated October 28), confirming that **VMware Cloud Foundation's SDDC Manager** is affected by CVE-2026-111497 through its bundled Node.js. The CVSS range is 7.5–9.8: **9.8 Critical** for SDDC Manager 9.1.1.x, **7.5 Important** for 9.0.x, 9.1.0 and 5.2.x. **As of press time there is no patch, only documented workarounds** (KB460732 for 9.1.1.x, KB460734 for older branches). CISA added the CVE to its KEV catalog on October 27 with a November 10 remediation deadline ([CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497)).

[Image available on the canonical HTML page: VMware Security Blog listing VMSA-2026-0008](https://zsvirt.io/blog/virtwatch-weekly-issue-005/)
*▲ VMware Security Blog: VMSA-2026-0008 was published October 27 and updated to VMSA-2026-0008.1 on October 28.*

**Editor's take**: SDDC Manager is the lifecycle hub of a VCF private cloud, and its Node.js dependency turns a language-runtime flaw into a Critical exposure of the private-cloud management plane. The pattern is now unmistakable: **the attack surface of the virtualization control plane is increasingly defined by the general-purpose software stack it embeds**. Runtime inventories (Node, PHP, Java versions) of management-plane components belong in your vulnerability-response scope — don't wait for a vendor advisory to learn what you're running.

## Releases & Product News

### Proxmox: 24/7 support takes effect; Lightbits native storage integration ships

- Proxmox's 24/7 enterprise support — **announced September 2 and covered in Issue 002** — took effect on October 19: Premium subscriptions immediately, Standard through a Q4 onboarding window, Basic unchanged. The **Proxmox North America Inc.** subsidiary in Kingston, Ontario, announced at the same time, handles regional sales and support ([Proxmox press releases](https://www.proxmox.com/en/about/company-details/press-releases)).
- On October 29, Proxmox and Lightbits Labs announced a partnership bringing **native NVMe-oF/TCP block storage integration** to Proxmox VE: the Apache-2.0 plugin [pve-lightbits](https://github.com/LightBitsLabs/pve-lightbits) provisions VM disks directly as Lightbits volumes, with snapshots and rollback driven by `qm snapshot`/`qm rollback` and cluster-wide shared capacity. For teams replacing vSphere + vSAN with Proxmox, Lightbits positions this as a path to SAN-class performance.

[Image available on the canonical HTML page: Proxmox press releases: Lightbits partnership (Oct 29), 24/7 support and North America entity (Sept 2)](https://zsvirt.io/blog/virtwatch-weekly-issue-005/)
*▲ Proxmox press-release index: the 24/7 support and North America announcement is dated September 2; the Lightbits partnership was announced October 29.*

[Image available on the canonical HTML page: pve-lightbits: native Lightbits storage plugin for Proxmox VE](https://zsvirt.io/blog/virtwatch-weekly-issue-005/)
*▲ GitHub: the pve-lightbits repository, an Apache-2.0 Proxmox VE storage plugin for Lightbits NVMe/TCP volumes.*

### VirtualBox 7.2.22 (10/20)

Released the same day as Oracle's October Critical Patch Update, 7.2.22 fixes multiple high-severity issues across local and adjacent-network attack vectors (CVSS up to 8.4); desktop virtualization users should update promptly ([Oracle October 2026 CPU](https://www.oracle.com/security-alerts/cpuoct2026.html)).

[Image available on the canonical HTML page: Oracle Critical Patch Update Advisory – October 2026](https://zsvirt.io/blog/virtwatch-weekly-issue-005/)
*▲ Oracle: the October 2026 Critical Patch Update advisory.*

### Harvester v1.9.1-rc5 (10/31)

Steady progress toward GA; mainline v1.10.0-rc1 has also appeared. Once again: pre-releases have no supported upgrade path — test environments only ([GitHub Releases](https://github.com/harvester/harvester/releases)).

[Image available on the canonical HTML page: Harvester releases page showing v1.9.1-rc5 and v1.10.0-rc1 pre-releases](https://zsvirt.io/blog/virtwatch-weekly-issue-005/)
*▲ GitHub: Harvester v1.9.1-rc5 (10/31) and v1.10.0-rc1 (10/30), both marked pre-release.*

## Industry Watch: Silence Again in Tokyo; London Is the Next Checkpoint

VMware Explore on Tour Tokyo (10/20–21) has concluded. VMware's official [season recap](https://blogs.vmware.com/explore/explore-on-tour-recap-2026/) covers VCF and private AI at length and **never mentions vSphere Standard**. Combined with AceMQ's October 22 fact-check (no price, no SKU, no route to market; vSphere 8 Standard general support still ends October 11, 2027), the "Standard comeback" has now gone two tour stops without substance. Next checkpoint: London (11/18–19).

## Number of the Week: 256

The eight eMudhra P-384 private keys were integers below 256 — 256 guesses exhaust the key space of what should have held 384 bits of entropy. Researchers recovered all eight keys, covering 16 certificates, in under a second.

## Security Advisories

| Advisory | Date | What | Action |
| --- | --- | --- | --- |
| [VMSA-2026-0008.1](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/39445) | 10/27, updated 10/28 | VCF SDDC Manager affected by Node.js Brotli RCE (CVE-2026-111497); CVSS 9.8 Critical on 9.1.1.x, 7.5 Important on older branches | Patch pending; apply workaround KB460732 / KB460734; CISA KEV due 11/10 |
| [VSA-2026-050](https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-050/) | 10/22 | eMudhra compromise reaches XCP-ng 8.3 / Xen Orchestra Appliance trust stores, Important | Apply the released security updates |
| [Node.js October security releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases) | 10/21 | 10 CVEs (incl. Node2Shell) + eMudhra root removal | Upgrade to 22.23.4 / 24.22.1 / 26.12.1 |
| [Oracle October CPU](https://www.oracle.com/security-alerts/cpuoct2026.html) | 10/20 | VirtualBox 7.2.22 fixes multiple high-severity flaws | Update desktop virtualization estates promptly |

**Embargo alert**: the Xen Project's advisory index shows XSA-523 pre-released under embargo, going public **November 3, 12:00 UTC**; XSA-529 and XSA-530 are scheduled for November 10, 18:00 UTC. Teams running Xen / XCP-ng should reserve a patching window on November 3 ([XSA index](https://xenbits.xen.org/xsa/)).

[Image available on the canonical HTML page: Xen advisory index showing embargoed XSA-523, XSA-529 and XSA-530](https://zsvirt.io/blog/virtwatch-weekly-issue-005/)
*▲ Xen Project: XSA-523, XSA-529 and XSA-530 are listed as pre-released but embargoed.*

## Community Buzz

- **CSDN: "Twenty Years of KVM: KVM Forum 2026 Trends and Field Guide" (10/22)** — a Chinese-community preview (not the official agenda): AI and heterogeneous computing moving into virtualization's main channel, with virtio-gpu, dynamic VRAM migration and multi-tenant inference SLAs expected to feature ([article](https://bbs.csdn.net/weixin_30647423/article/details/100664085)).
- **Cloud Hypervisor community momentum**: PR [#9094](https://github.com/cloud-hypervisor/cloud-hypervisor/pull/9094), bringing postcopy live migration to `vhost-user` backends, has drawn 68 review comments; PR [#9183](https://github.com/cloud-hypervisor/cloud-hypervisor/pull/9183) explores letting virtio backends accept device (GPU) memory directly — both pointing at VMM evolution for AI workloads.
- **This newsletter got cited**: AceMQ's vSphere Standard fact-check (10/22) lists our Issue 004 Frankfurt report among its sources — thanks to every reader who keeps sending tips and corrections ([AceMQ article](https://acemq.com/blogs/vsphere-standard-return/)).

## Tools & Good Reads

- [What the VDDK public-download removal means for migration toolchains](https://modernops.com/field-notes/vmware-vddk-removed.html) (ModernOps, 9/15, updated 9/16) — required reading if your backup/migration tooling depends on VDDK.
- [Azure NVv4 retirement migration field guide](https://www.refontelearning.com/blog/azure-nvv4-gpu-vm-retirement-migration) (Refonte Learning, 9/10) — includes the workaround for the reported direct-resize failure.

## ZSvirt Community News

> This newsletter is produced by the ZSvirt community; this section covers the publisher's own updates, disclosed as such.

- October 27–28: the two-part "ZSvirt Open-Source FAQ" went live ([Part 1: installation, GPU support, networking & storage](https://zsvirt.io/blog/zsvirt-faq-part-1); [Part 2: migration & backup, API, community and selection](https://zsvirt.io/blog/zsvirt-faq-part-2)), answering the 20 most frequent questions since open-sourcing — OVA/qcow2 deployment, GPU passthrough and vGPU, and the three migration paths (ZMigrate / OVF / VMDK).

[Image available on the canonical HTML page: ZSvirt Open-Source FAQ, Part 1](https://zsvirt.io/blog/virtwatch-weekly-issue-005/)
*▲ zsvirt.io: the first of the two ZSvirt open-source FAQ posts, published October 27.*

## Next Issue Preview

- **KVM Forum 2026 (11/12–13, Coast Coal Harbour Hotel, Vancouver)**: the schedule is live; admission is $75, free for accepted speakers. Twenty years into KVM, expect confidential computing, virtio device evolution and AI-workload support to dominate ([site & schedule](https://kvm-forum.qemu.org/)).

[Image available on the canonical HTML page: KVM Forum 2026 site: schedule now available](https://zsvirt.io/blog/virtwatch-weekly-issue-005/)
*▲ kvm-forum.qemu.org: KVM Forum 2026 runs November 12–13 in Vancouver.*

- **XSA-523 public disclosure (11/3, 12:00 UTC)**, followed by XSA-529/530 on 11/10.
- **VMware Explore on Tour London (11/18–19)** — the third checkpoint for vSphere Standard details (see Industry Watch).
- Progress on **Harvester v1.9.1 GA** and **Talos Hypervisor's December GA** commitment.

## References

1. [VSA-2026-050: eMudhra Intermediate CA Compromise — Vates](https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-050/)
2. [8 eMudhra certificates are compromised — Cloudflare Blog](https://blog.cloudflare.com/emudhra-certificate-compromise)
3. [eMudhra CA Compromise: The Trust Stores You Didn't Patch — Endor Labs](https://www.endorlabs.com/learn/emudhra-intermediate-ca-compromise-the-trust-stores-you-patched-and-the-ones-you-didnt-know-you-had)
4. [Node.js October 2026 security releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)
5. [VMware Security Blog (VMSA-2026-0008)](https://blogs.vmware.com/security/)
6. [VMSA-2026-0008.1 advisory text — Broadcom Support](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/39445)
7. [Proxmox Press Releases](https://www.proxmox.com/en/about/company-details/press-releases)
8. [LightBitsLabs/pve-lightbits — GitHub](https://github.com/LightBitsLabs/pve-lightbits)
9. [Oracle Critical Patch Update — October 2026](https://www.oracle.com/security-alerts/cpuoct2026.html)
10. [Harvester Releases — GitHub](https://github.com/harvester/harvester/releases)
11. [OpenStack 2026.2 Hibiscus Release Highlights](https://releases.openstack.org/hibiscus/highlights.html)
12. [QEMU 11.1.2 source tarball](https://download.qemu.org/qemu-11.1.2.tar.xz)
13. [Azure retired VM size series — Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/sizes/lifecycle/retired-sizes-list)
14. [Azure NVv4 retirement migration guide — Refonte Learning](https://www.refontelearning.com/blog/azure-nvv4-gpu-vm-retirement-migration)
15. [MSRC: CVE-2026-102214](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102214)
16. [Xen Security Advisories](https://xenbits.xen.org/xsa/)
17. [KVM Forum 2026](https://kvm-forum.qemu.org/)
18. [VMware Explore on Tour 2026 Season Recap](https://blogs.vmware.com/explore/explore-on-tour-recap-2026/)
19. [vSphere Standard Return: What Is Confirmed So Far — AceMQ](https://acemq.com/blogs/vsphere-standard-return/)
20. [Talos Linux adds native hypervisor — PR Newswire](https://www.prnewswire.com/news-releases/talos-linux-adds-native-hypervisor-and-edge-container-support--see-it-live-at-taloscon-2026-302877040.html)
21. [Virtualization Watch Issue 004 — ZSvirt](https://zsvirt.io/blog/virtwatch-weekly-issue-004)
22. [Twenty Years of KVM: Forum 2026 trends — CSDN](https://bbs.csdn.net/weixin_30647423/article/details/100664085)
23. [Cloud Hypervisor PR #9094: postcopy for vhost-user backends](https://github.com/cloud-hypervisor/cloud-hypervisor/pull/9094)
24. [Cloud Hypervisor PR #9183: virtio backend accepting device (GPU) memory](https://github.com/cloud-hypervisor/cloud-hypervisor/pull/9183)
25. [VMware Removed Public VDDK Downloads — ModernOps](https://modernops.com/field-notes/vmware-vddk-removed.html)
26. [ZSvirt FAQ Part 1](https://zsvirt.io/blog/zsvirt-faq-part-1) / [Part 2](https://zsvirt.io/blog/zsvirt-faq-part-2)
27. [Protecting Chrome and Android users from compromised eMudhra intermediate CA certificates — Chrome Security](https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/)
28. [CISA Known Exploited Vulnerabilities Catalog — CVE-2026-111497](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497)
29. [eMudhra to exit global SSL/TLS certificate business — eMudhra](https://emudhra.com/en/press-release/emudhra-to-exit-global-ssl-tls-certificate-business)

---

*Virtualization Watch is produced by ZSvirt community volunteers and published biweekly. Tips and corrections are welcome through the community channels. Please credit the source when reposting.*

## Official links


- [Canonical HTML page](https://zsvirt.io/blog/virtwatch-weekly-issue-005/)
- [Discuss on GitHub](https://github.com/ZSvirt/zsvirt/discussions)