Trust Center

SafeBreach Security Statement: eMudhra CA Keys, PHP2Shell, and LiteLLM 1.107.0

Last updated: October 22, 2026

We’ve received questions about three security events disclosed on October 20 and 21, 2026. Based on our investigation to date, SafeBreach is not affected by any of them. That covers the SafeBreach platform, our corporate environment, and the third party services we rely on to deliver them.

eMudhra certificate authority keys

eMudhra generated eight of its intermediate CA keys so weakly that anyone could recover them from the public certificates, and the major browsers and trust stores have since distrusted them. SafeBreach uses no TLS or code signing certificates that chain to eMudhra.

PHP2Shell (CVE-2026-109618 and CVE-2026-109619)

These are two unauthenticated remote code execution flaws in the PHP interpreter itself, fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Amazon reports they are now being exploited broadly. None of the systems SafeBreach operates serves PHP on an affected version.

LiteLLM 1.107.0

On October 21, an attacker published a backdoored LiteLLM release to PyPI and Docker that steals credentials as soon as Python starts. No SafeBreach system installed LiteLLM 1.107.0 or pulled the affected container images.

What we’re doing

We handled each event under our vulnerability management and incident response policies. Our security team continues to monitor vendor advisories, threat intelligence, and the CISA Known Exploited Vulnerabilities catalog, and we will update this page if anything changes our assessment.

Questions about this statement can go to security@safebreach.com

We are pleased to announce that we have completed our 2025 Penetration Test. Customers with an NDA can access and download a copy of the report from this portal.

The entire SafeBreach team would like to take a moment to wish you a wonderful and peaceful holiday season. We hope you enjoy this time with your loved ones and stay safe.

In line with our ongoing commitment to maintaining the highest security standards, we would also like to inform you that, following our Information Security Policy, SafeBreach's security policies have been thoroughly reviewed and updated. These updates have been reviewed and approved by our Executive Security Committee to ensure they continue to meet the ever-evolving needs of our organization and our valued partners. For you convenience, we have created a policy digest available here: https://security.safebreach.com/item/digest

Thank you for your continued trust and support. We look forward to working with you in the coming year to strengthen our security practices and keep our systems and information safe.

Wishing you a secure and joyous holiday season!

Warm regards,

Avishai Avivi
CISO | SafeBreach

We are pleased to announce that we have received our SOC 2 Type II report from EY. Customers with NDA can access and download a copy of the report from this portal.

Hi all,

To follow up, I am pleased to confirm that all SafeBreach machines have been patched with the correct version of the OpenSSH library to guarantee that they are no longer vulnerable. It's important to note that none of these environments were vulnerable to an attack from outside, and we've taken this extra step as a precaution and exercise of best practices.

Thank you,

Avishai Avivi
CISO | SafeBreach

Hi all,

SafeBreach is tracking the newly released information about the OpenSSH server component (CVE-2024-6387). While SafeBreach is running the impacted component, our hosted customer consoles are not vulnerable. We do not allow outside connections to the SSH service on these machines. All internal access to these machines is tightly controlled and monitored.

As always, your security is our paramount concern. We will keep an eye on any further developments on this issue,

Avishai Avivi CISO | SafeBreach