What it means
On October 20, 2026, eMudhra revoked eight intermediate certificates whose private keys were weak enough to recover: six for websites, two for code signing. A holder can impersonate any site. UnityTLS borrows roots from the operating system, checks the chain itself, and cannot see revocation. A player on hostile Wi-Fi, or behind a compromised router, can have traffic read or changed while the device still trusts that chain. Analytics, tokens, and API keys are the realistic target, and players close it by updating the device. Windows, Xbox, and UWP need Microsoft's October 20 certificate update. WebGL is covered by the browser. Android games are covered by the October 2026 Play Services update. Mac, iPhone, and Linux need the bad root removed: Ubuntu withca-certificates 20260816ubuntu0.X.1 or newer, SteamOS from 3.9.
CVE-2026-111497, disclosed on October 21, is an out-of-bounds write in Brotli 1.0.3 through 1.2.0. A crafted stream can crash the game or run code in the game’s process when the build decompresses attacker-controlled data with BrotliStream, BrotliDecoder, or HttpClient Brotli decompression. This can affect your WebGL Brotli builds if you download data from an untrusted source.
The Package Manager decompresses a registry response before it checks the signature. A malicious registry, or one impersonating a registry you trust, can crash the Editor on Windows and macOS and may run code in the Editor on Linux. Avoid scoped registries you do not control until the Editor is patched.
What you install
Unity's advisories, as of October 30, 2026:| Release | Affected versions | Patched release |
|---|---|---|
| Unity 6.3 LTS | 6000.3.0a1–6000.3.27f1 | 6000.3.27f2, available now |
| Unity 6.7 Beta | 6000.7.0a1–6000.7.0b6 | 6000.7.0b7, available now |
| Unity 6.0 LTS | 6000.0.0f1–6000.0.85f1 | Due next week |
| Unity 6.6 | 6000.6.0a1–6000.6.8f1 | Due next week |
| Unity 7.0 Alpha | 7000.0.0a7–7000.0.0a12 | Due next week |
