A hot potato: Security teams are dealing with two separate emergencies this week, and both go straight to the foundations of the web. The first is a certificate authority that shipped private keys anyone could guess. The second is a pair of critical PHP flaws that leaked before patches existed. Browsers fixed the certificate problem within hours. Everything else, from Linux servers to Docker images and IoT gear, needs someone to log in and patch.
Eight intermediate certificates issued by India-based certificate authority eMudhra were found to have private keys so weak they can be calculated from the certificates themselves. Those certificates chained to roots trusted by Chrome, Firefox, Safari and Windows, as well as by operating systems and countless software trust stores. Anyone holding one of the keys could issue a valid certificate for any domain and use it to impersonate that site, intercepting or modifying its traffic.
A properly generated P-384 key carries roughly 384 bits of entropy. eMudhra's keys had between 3 and 8 bits, and one of them was simply the number 4. Recovering all eight requires testing no more than 256 values. eMudhra blamed a script error during key generation, which were then used by mistake. That means the keys were exposed for roughly 18 months before a researcher reported the problem this month. The company says most of the certificates never went into production and it has found no evidence of misuse.
Browsers handled it quickly. Chrome and Firefox blocked the keys within hours through their remote revocation lists, with no update or restart required, and Apple and Microsoft followed by October 20.
The bigger problem is everything else that is not a browser. Servers, containers, command-line tools and embedded devices often rely on a static, bundled list of trusted roots and never check revocation. Go, Python's certifi, curl, Node.js and most major Linux distributions have shipped fixes, while Java, Bun and FreeBSD were still pending as of writing.
"This will be a massive cleanup job, bigger than Heartbleed," Go cryptography maintainer Filippo Valsorda told Ars Technica. An attack still requires sitting between a user and a server, which is easy on a shared network.
A second big emergency this same week comes from PHP. With PHP powering nearly 70% of all websites (including TechSpot), the potential impact is enormous. Websites based on WordPress, Drupal, MediaWiki and more are all affected. The PHP team released emergency fixes for two flaws, CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell and rated with severity 9.2 out of 10.
Both stem from PHP leaving its memory in a corrupted state when a request ends abnormally, which an attacker can turn into code execution or use to read sensitive data such as passwords and API keys from server memory. Because the bug is in the PHP runtime, a site is exposed even if its own code is secure.
The flaws were discovered by Wiz, Calif and OpenAI. Wiz says every PHP release from the past decade is affected by at least one of them, and that AI tools were what made the complex exploit chain practical to build. That suggests bugs once considered too difficult to exploit may no longer be safe to ignore.
The fixes arrived under big pressure after details leaked on October 20, ahead of the planned disclosure. PHP moved to patch this immediately, while Cloudflare's CTO reported early attacks were emerging before patches were even available.
Server admins should move to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 as soon as possible. Servers running Apache with mod_php face the highest risk, since a single unauthenticated request can trigger the attack before any application code runs. The FBI, NSA and the UK's National Cyber Security Centre advised organizations to patch immediately or take PHP systems offline until they can.