Recent third party security incidents, specifically eMudhra and PHP2Shell, have no direct impact on OMERO Plus, but Glencoe Software provides recommended mitigations for both client and server-side environments where OMERO workflows are run.

PHP2Shell

On October 20th a remote code execution (RCE) vulnerability (PHP2Shell) in PHP was publicly disclosed, and patches were made available by The PHP Project on October 21st. You can find out more about the vulnerability here.

eMudhra

Also on October 20th eMudhra, a digital trust services provider, announced that eight of its digital certificates had cryptographic weaknesses that meant their private keys could easily be recovered. With the private key of a globally trusted root certificate authority, an attacker can impersonate any website or service. Shortly after discovery, the affected certificates were revoked and major browser and operating system vendors took steps to block them. You can find out more about the incident here.

Is OMERO Plus affected?

Glencoe Software can confirm that OMERO Plus does not use, nor require, the installation of PHP, and therefore is unaffected by the PHP2Shell vulnerability.

OMERO Plus is also not directly affected by the eMudhra security incident, as it primarily affects installing Python packages within a virtual environment. As such, if you are not running pip install, you will be insulated from the security vulnerabilities. However, as a precaution, we would still recommend that you follow the mitigation steps below to ensure that your system is secured with the latest patch fixes.

Mitigations for eMudhra incident

OS Mitigation

Linux

A new version of ca-certificates has been released for all main distributions, and systems should be updated to the latest version. Instructions on how to validate your ca-certificates package on Ubuntu can be found here.

For RedHat details can be found here.

macOS

If you are running Homebrew, you should update/upgrade your homebrew packages, most specifically the ca-certificates package. You can find out more about macOS related patches here.

Browser Mitigation

Apple, Mozilla, Microsoft and Chrome have remediated the issue. Browsers must be upgraded to their latest versions.

Python Mitigation

System-wide Python should be patched so that new virtual environments can be created with a recent version of pip and certifi including the relevant patches.

New versions of Python (3.11.18, 3.12.16, 3.13.17, 3.14.9 and 3.15.1) as well as the pip (26.2.2) and certifi (2026.10.23) packages have been released, see here. There are no releases for Python 3.10 and older which are end-of-life.

For macOS users, if you are running Homebrew Python (Python 3.10, Python 3.11, Python 3.12, Python 3.13, Python 3.14), upgrading your package should install a patched version.

Virtual Environments Mitigation

All existing Python virtual environments must be patched according to the procedure below.

Within an environment, execute the following commands to upgrade pip safely and then certifi.

$ python -m pip install "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"
$ pip install -U certifi

Review that the correct versions are installed.

$ pip --version
pip 26.2.2 from /opt/omero/OMERO.venv/lib/python3.12/site-packages/pip (python 3.12)
$ pip freeze | grep certifi
certifi==2026.10.23
omero-certificates==0.4.0

What Next?

Glencoe customers should reach out to support@glencoesoftware.com with any concerns or questions about patching.