Last week brought two serious security events: a certificate authority lost control of eight intermediate certificate keys, and a critical flaw surfaced in Google's Brotli decompression library. Our Microsoft 365 SharePoint & Outlook integration for monday.com was patched and in production within 37 hours of the first Node.js fix release, well ahead of monday's deadline. Here is what happened, what it means, and what we did.
eMudhra: eight intermediate certificate keys compromised
On October 17, 2026, a security researcher reported to Apple, Google, Microsoft, Mozilla and eMudhra that the private keys for eight eMudhra intermediate certificates were compromised. Whoever holds such keys can issue certificates that browsers and systems trust, which is why a leak like this matters well beyond the CA itself.
Broccoli2Shell: a critical flaw in Google's Brotli decoder
The second issue began life as "node2shell", because it first surfaced through Node.js. It is now clear that the bug is in the Brotli library itself, so it reaches many more products than Node.js alone. The vulnerability entry has since been updated, and the flaw has a new nickname, "Broccoli2Shell", complete with its own website and domain.
The issue is a potential buffer overflow in Google's Brotli decoder, in versions 1.0.3 through 1.2.0 on all platforms. An unauthenticated remote attacker can send a specially crafted Brotli data stream to trigger memory-management errors. Depending on the target, that can mean reading sensitive areas of memory, crashing the service (denial of service), or injecting and running arbitrary malicious code. It is tracked as CVE-2026-111497, scored CVSS4 9.2, rated critical.
Our timeline
All times UTC unless noted.
| When | What happened |
|---|---|
| 21 Oct 2026, 20:20 | Node.js releases security updates: 26.12.1, 24.22.1 and 22.23.4 |
| 23 Oct 2026, 04:31 | Our security fix is first committed for Microsoft 365 integration for monday.com for testing |
| 23 Oct 2026, 04:36 | We share the fix versions in the monday.com marketplace Slack channel |
| 23 Oct 2026, 09:25 | Our fix is deployed to production for Microsoft 365 integration for monday.com |
| 23 Oct 2026, 19:41 | monday.com recommends updating marketplace apps to the fix versions |
| 24 Oct 2026, 16:40 | monday.com issued a notice that marketplace apps must be patched and resubmitted by 4:30 PM ET (23:30 Israel time) the same day, four hours after the notice; unpatched apps may be disabled |
Our fix reached production 31 hours before monday's mandatory deadline notice.
Our commitment to security
At David Simpson Apps, we take the security of our service and our customers' data extremely seriously. We know that we could have moved a little faster in responding to the update. But once we were sure of the problem, we shared details of the fix with the entire monday.com marketplace vendor ecosystem, and our own fix was live in production well before monday set its mandatory deadline. No customer action is needed on our side.
Also this weekend: multi-region support
We have deployed full multi-region support for our Microsoft 365 integration for monday.com. monday users can now keep their data in their home region, meeting data residency needs.
Read the multi-region support docs for what this means for new and existing accounts.
