Replit responds to eMudhra CA, Node.js, PHP, LiteLLM and Linux kernel disclosures with WAF rules and patches

Archive entry: this covers an event from October 22, 2026, and we published it on November 8, 2026. The details come from sources dated at the time and may have changed since.

On October 22, 2026, Replit published its response to a cluster of security disclosures in a blog post. Replit put firewall-level protections in place and asked users to open Security Center, apply the available patches and republish affected apps.

What Replit did

• eMudhra CA: eMudhra used weak, guessable private keys during an intermediate CA key-signing ceremony. Replit removed the CA from its base images, applied the fix automatically to 95% of published apps and patched its Python tooling. Python apps need to be republished.
• Node.js: Node.js disclosed several flaws, including a Brotli decoder bug that could allow remote code execution. Replit deployed WAF protections and made patched Node.js versions available, and Node.js apps need to be republished.
• PHP: for remote-code-execution vulnerabilities, Replit deployed WAF rules, patched its PHP tooling and recommends republishing PHP apps.
• LiteLLM: Replit says its Socket Firewall blocked all malicious package installs from a supply-chain attack on LiteLLM, a widely used open-source Python library.
• Linux kernel: for several disclosed kernel vulnerabilities, Replit says its microVM architecture prevented exploitation by construction, so no user action is needed.

What it means for people building with AI

Managed builders can absorb much of the patch work for the apps they host. Replit applied the eMudhra fix automatically to 95% of published apps and added WAF protections, although users still had to republish Python and Node.js apps and Replit recommended republishing PHP apps. Self-hosted AI-built apps would need each fix applied by their owners.

October 28 follow-up

In an October 28 follow-up, Replit said a hardened kernel configuration in that microVM architecture prevented exploitation of the kernel flaws. It also said it had run AI red teaming around the clock since early 2026, with hundreds of agents.

Sources

• Security vulnerabilities across the internet: How Replit is protecting your business (Replit, October 22, 2026, official)
• Replit’s Architecture Behind Secure Agent Work (Replit, October 28, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.