Important Snowflake Security Information

Two significant security issues have been making headlines over the past couple of weeks. We want you to know we’re aware of both and where we stand.

PHP: On 21 October, fixes were released for two critical flaws in PHP (CVE-2026-109618 and CVE-2026-109619), known as “PHP2Shell”. They let an attacker run code on a web server without needing to log in, and they’re now being actively exploited. The Haese Mathematics website and Snowflake do not use PHP anywhere in our infrastructure or application stack, so we’re not affected and no remediation is needed.

eMudhra: A certificate authority discovered that eight of its intermediate certificates were created with weak keys that could be recovered and used to forge certificates that browsers and operating systems would trust (tracked by vendors under CVEs including CVE-2026-111943). The certificates have since been revoked. Our systems don’t rely on the affected certificates.

This second one reaches well beyond any single product, so we’d encourage every organisation to make sure their operating systems, browsers and applications are up to date. Also check any software that bundles its own certificate list. Microsoft has published helpful guidance here:
https://www.microsoft.com/en-us/msrc/blog/2026/10/microsoft-response-to-compromised-emudhra-certificate-authority-keys
and Apple here:
https://support.apple.com/en-us/149555