Security update: PHP2Shell, eMudhra certificates and Node2Shell

This week, researchers disclosed several critical vulnerabilities in widely used software. Some of you have asked if NetBox Labs products are affected. We have not identified any indicators of compromise (IOCs) in our systems. This post covers what we have done and what is still in progress.

PHP2Shell

NetBox Labs products do not use PHP. PHP2Shell does not affect them. You do not need to take action for NetBox Labs products.

eMudhra certificates

The private keys of some eMudhra intermediate certificate authorities (CAs) are compromised. Software must stop trusting certificates that these CAs issued. We are updating the trust stores in our products to distrust the affected eMudhra certificates.

• NetBox Cloud: We updated the trust stores on all NetBox Cloud instances. You do not need to take action.
• NetBox Enterprise: We are updating NetBox Enterprise to distrust the affected certificates.  When the update is available, we will notify customers and include upgrade instructions. 
• Agents and integrations: We are releasing updated versions that distrust the affected certificates.
• NetBox Community: NetBox uses the trust stores of your Python environment and your operating system and does not require any updates to the core software itself. Update the certifi package to version 2026.10.19 or later, and update the ca-certificates package of your operating system.

Node2Shell

Node2Shell exploits a flaw in a compression library that Node.js includes. Flaws like this one are in dependent software: third-party components that many applications include. When researchers disclose a flaw in third-party software, we check whether our products use the affected component. If they do, we update or remove it. We also screen new releases of third-party packages before we use them, to reduce the risk that a malicious release reaches our products.

• NetBox Cloud: We apply these updates for you for NetBox Labs products and plugins. You do not need to take action for those. For customers with custom plugins, you are responsible for keeping them up to date – be aware that plugins can include their own third-party dependencies.
• NetBox Enterprise: We include these updates in NetBox Enterprise releases. Install each release when it is available. For customers with custom plugins, you are responsible for keeping them up to date – be aware that plugins can include their own third-party dependencies.
• NetBox Community: Keep NetBox and your plugins up to date. Plugins can include their own third-party dependencies.

A faster pace of vulnerabilities

We’ve entered an uncomfortable era where AI tools often discover vulnerabilities faster than the industry can respond to them. At NetBox Labs, we continuously monitor new disclosures and promptly fix the vulnerabilities that apply to our products. Beyond standard vulnerability management practices, we use frontier AI models to find and fix vulnerabilities in our own code before attackers can. NetBox Labs maintains a SOC 2 Type II report, under which an independent auditor reviews our vulnerability management and incident response controls.

AI is changing how fast vulnerabilities are found. We’re using it to change how fast they’re fixed.

Questions

Email support@netboxlabs.com or contact your customer support manager. NetBox Community users can ask in the #netdev-help channel of the NetDev Community.