Replit says it auto-patched 95 percent of apps against the eMudhra CA

One bad certificate authority can break the HTTPS trust of every app a cloud platform runs. Replit's security team said on 22 October it had already removed one such CA from its base images. It also auto-applied the fix to 95 percent of its published apps. The same post recounts a week of back-to-back vulnerabilities. Node.js, PHP, LiteLLM and the Linux kernel were all touched.

The post is by Luis Héctor Chávez and Scott Kennedy. It reports what the platform did at each layer. It does not lead with what customers must do. The frame is that attacks are getting faster as AI lowers the cost of finding and chaining bugs. Teams on their own have less time to respond.

What Replit patched for them

For eMudhra, Replit says it removed the compromised CA from its base images. It then "automatically applied the fix to 95% of published apps." The remaining customers were notified directly to republish.

For Node.js, the week's remote-code-execution bug sat in the Brotli decoder. Replit says it deployed web application firewall rules against the exploit. It also pushed patched Node.js versions. The PHP response was the same shape. Replit still recommends republishing PHP apps even with the firewall in front of them.

The supply-chain block

The LiteLLM supply-chain attack was stopped at install time. Replit's Socket Firewall runs across every Replit environment. The post says it "blocked all malicious package install attempts." No rebuilds were required for customers on that one.

What the reader has to do

The post lists four republish actions and three non-actions. Customers must republish Python apps for tooling updates. They must republish Node.js apps for the patched runtime. They must also republish PHP apps for the patched version. No action is needed for LiteLLM or the Linux kernel bugs. The post trails an upcoming whitepaper on the microVM isolation that sits under it all.

The honest reader of that list learns how far a managed host's protection goes. The CA swap is invisible. Replit changed the image and the next build inherited the fix. The runtime patches are not invisible. The owner has to republish because Replit cannot redeploy a tenant app on its own. The firewall rules are a stopgap, not a cure. A platform that owns the base image and the egress is what makes 95 percent possible. Anyone running their own container image on their own cloud still has to patch all of theirs.

The post ends on an architecture claim it has not shown the receipts for yet. A whitepaper on the microVM boundary that holds tenants apart is said to be coming next.

Source

Security vulnerabilities across the internet: How Replit is protecting your business by Luis Héctor Chávez and Scott Kennedy, Replit.