> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/harness-platform/knowledge-base-and-faqs/articles/ci-cloud-vm-image-updates-for-emudhra.md). # CI Cloud VM image updates for eMudhra Review Harness Cloud Linux image changes, including the eMudhra certificate distrust and toolchain updates in v20261026 This page lists the changes in each Harness Cloud Linux image release. Check the Breaking changes section of each release before you upgrade pipelines that depend on a specific tool version or default. *** ## v20261026: emSign and eMudhra CA distrust and toolchain updates Images: Ubuntu 24.04 and Ubuntu 22.04, amd64 and arm64. ### Why Intermediate certificates issued under the emSign ECC Root CA - G3 root, including the chain cross-signed by Sectigo's AAA Certificate Services root, were compromised. Browsers, operating systems, and language runtimes have removed or distrusted these roots. References: * [Ubuntu USN-8944-1](https://ubuntu.com/security/notices/USN-8944-1) * Red Hat RHSB-2026-012 * [Mozilla bug 2083449](https://bugzilla.mozilla.org/show_bug.cgi?id=2083449) * CVE-2026-111943 (Go), CVE-2026-91403 (Java), CVE-2026-113812 (Perl Mozilla::CA) This release removes trust in these roots from every TLS client on the image that has a fix available. The emSign C1 and C3 roots are also removed from the system store, to match Mozilla NSS 3.131.1. They are not part of the compromise. Each image was tested against hosts that serve the compromised chains. On every image, all of these clients reject the compromised chains and still connect to normal HTTPS sites: curl, wget, git, openssl, Python (system, toolcache, and conda), pip, the AWS, Azure, and Google Cloud CLIs, Node.js, Java 8/11/17/21/25, Go, Ruby, PHP, and PowerShell. ### Breaking changes | Change | Before | After | What to do | | ---------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- | | Default Node.js | 20.19.2 (Ubuntu 24.04), 18.20.8 (Ubuntu 22.04) | 24.22.1 | Use a setup-node step or `n` to pin another version. Node.js 18 and 20 are still in the toolcache. | | Default Go | 1.23.x | 1.26.10 | Use a setup-go step to pin another version. Go 1.21, 1.22, and 1.23 are still in the toolcache. | | Superseded patch versions removed from the toolcache | Node.js 22.15 and 22.16, Python 3.10.17 and 3.10.18, 3.11.12 and 3.11.13, 3.12.10 and 3.12.11, 3.13.3 and 3.13.4, Ruby 3.2.8 and 3.3.8 | Replaced by the new patch versions below | A pipeline that pins an exact old patch version, for example Python 3.12.10, downloads it at runtime. Pin the minor version (`3.12`) instead. | ### Certificate stores | Component | Ubuntu 24.04 | Ubuntu 22.04 | | ------------------------------ | ------------------------------------------- | ------------------------------------------- | | ca-certificates (system store) | 20260601\~24.04.1 → 20260816ubuntu0.24.04.1 | 20240203\~22.04.1 → 20260816ubuntu0.22.04.1 | | Java (all Temurin JDKs) | Uses the system store, updated above | Same | | Conda ca-certificates | 2025.2.25 → 2026.10.20 | Same | | Conda certifi | 2025.4.26 → 2026.10.23 | Same | | Azure CLI certifi | 2024.7.4 → 2026.10.23 | Same | ### Languages and runtimes Versions are the same on amd64 and arm64 unless noted. | Tool | Before | After | | ------------------------------------------------------------------------------------ | ----------------- | ---------------------- | | Node.js 22 | 22.15.1 / 22.16.0 | 22.23.4 | | Node.js 24 | not installed | 24.22.1 (new, default) | | Python 3.10 | 3.10.17 / 3.10.18 | 3.10.22 | | Python 3.11 | 3.11.12 / 3.11.13 | 3.11.18 | | Python 3.12 | 3.12.10 / 3.12.11 | 3.12.16 | | Python 3.13 | 3.13.3 / 3.13.4 | 3.13.17 | | pip (toolcache Python and PyPy, pipx, conda, Azure CLI) | 25.0 – 25.1.1 | 26.2.2 | | pip bundled for new virtual environments (Python 3.10+, PyPy 3.10, conda, Azure CLI) | 23.0.1 – 25.0.1 | 26.2.2 | | Go 1.26 | not installed | 1.26.10 (new, default) | | Go 1.27 | not installed | 1.27.3 (new) | | Ruby 3.2 | 3.2.8 | 3.2.11 | | Ruby 3.3 | 3.3.8 | 3.3.13 | | Ruby 3.4 | not installed | 3.4.12 (new) | | Julia | 1.11.5 | 1.13.3 | Python's built-in `ssl` and `urllib` use the system certificate store, so they are covered by the ca-certificates update. The Python patch upgrades are general security releases. For pip, the fix comes from pip 26.2.2, which ships certifi 2026.10.19. ### Operating system packages These are security updates. | Package | Ubuntu 24.04 | Ubuntu 22.04 | | ------------- | ------------------------------------------------------- | --------------------------------------------------- | | System Python | python3.12 3.12.3-1ubuntu0.5 → 3.12.3-1ubuntu0.17 | python3.10 3.10.12-1\~22.04.9 → 3.10.12-1\~22.04.18 | | python3-pip | 24.0+dfsg-1ubuntu1.1 → 24.0+dfsg-1ubuntu1.3 | 22.0.2+dfsg-1ubuntu0.5 → 22.0.2+dfsg-1ubuntu0.7 | | PHP | php8.3 8.3.6-0ubuntu0.24.04.4 → 8.3.6-0ubuntu0.24.04.13 | php8.1 8.1.2-1ubuntu2.21 → 8.1.2-1ubuntu2.28 | | System Ruby | ruby3.2 3.2.3-1ubuntu0.24.04.5 → 3.2.3-1ubuntu0.24.04.8 | ruby3.0 3.0.2-7ubuntu2.10 → 3.0.2-7ubuntu2.13 | The default system Ruby is unchanged on both images: 3.2 on Ubuntu 24.04 and 3.0 on Ubuntu 22.04. ### PHP php2shell remote code execution (CVE-2026-109618, CVE-2026-109619) Two critical PHP vulnerabilities, nicknamed php2shell (CVSS 4.0 score 9.2), let an unauthenticated attacker with network access to a PHP application achieve remote code execution with the application's credentials, on any PHP application. The PHP update in the Operating system packages table above, php8.3 8.3.6-0ubuntu0.24.04.13 on Ubuntu 24.04 and php8.1 8.1.2-1ubuntu2.28 on Ubuntu 22.04, includes the fix for both CVEs. References: * [Ubuntu blog: php2shell vulnerability, fixes available](https://ubuntu.com/blog/php2shell-vulnerability-fixes-available) * Ubuntu USN-8948-1, USN-8948-2 ### Cloud CLIs and SDKs | Tool | Before | After | | ------------------------------- | ------------------- | -------- | | AWS CLI | 2.27.16 – 2.27.31 | 2.38.5 | | Azure CLI | 2.72.0 – 2.74.0 | 2.91.0 | | Google Cloud CLI (apt and snap) | 521.0.0 – 561.0.0 | 590.0.1 | | core22 snap | 20250408 / 20260128 | 20260909 | | aws-sdk-core gem | 3.224.0 – 3.225.1 | 3.260.0 |