Let’s not forget about this certificate clusterfuck while everyone is busy with the PHP RCE news. Almost at the same time, another serious security incident became public. Eight intermediate CA certificates from eMudhra were found to use ridiculously weak private keys. We’re talking about P-384 keys where one private key was literally the number 4. FOUR! Six of these were TLS CAs, allowing anyone to recover their private keys and potentially issue trusted certificates for arbitrary domains. Major browsers have already blocked the affected CAs. But what about API clients, backend services, embedded devices, containers, and systems with outdated trust stores? Many don’t enforce Certificate Transparency or check revocation. Some could remain vulnerable for years. These weak keys have existed since April 2025. No confirmed malicious exploitation so far, but the implications are serious. Don’t overlook this one while focusing on PHP. Technical details and test endpoints: emudhra.we-have-a-problem.co…

This week has been quite a shitshow already, and there are still 2 days to go Here’s a quick recap of the security mess we’ve seen in just the last few days: 1. PHP Core RCE (CVSS 9.2) Two critical vulnerabilities (CVE-2026-109618/109619) allowing unauthenticated RCE. A huge number of PHP installations potentially affected, and there are already reports of reliable exploitation against patched versions. Great… Useful links: Official PHP advisory and patches: php.net/archive/2026.php#202… Practical hardening and mitigation guide by Vincent Schmalbach. nginx/Apache configurations, PHP settings, patch verification and compromise checks: vincentschmalbach.com/cve-20… Huntress analysis. What to monitor, suspicious child processes, webshells and post-exploitation activity: huntress.com/blog/php2shell-… Wiz technical deep dive. Exploit mechanics, memory disclosure, affected applications and the role of AI: wiz.io/blog/php2shell-php-rc… Corelight’s open-source Zeek and Suricata detection rules: github.com/corelight/php2she… 2. GitLab RCE (CVSS 10.0) CVE-2026-110264. An integer overflow in the regex compiler leading to unauthenticated RCE. Apparently affects around 12 years(!) of GitLab releases. docs.gitlab.com/releases/pat… 3. Node.js / Brotli RCE CVE-2026-111497. An out-of-bounds write in the Brotli decoder that can lead to RCE when processing malicious compressed data. Node.js 22, 24 and 26 affected. nodejs.org/en/blog/vulnerabi… 4. DNS-over-QUIC DoS CVE-2026-97206. A use-after-free in Unbound’s DNS-over-QUIC implementation. Remote attackers can crash affected multi-threaded DNS resolvers. nlnetlabs.nl/projects/unboun… 5. eMudhra CA disaster And then there’s this absolute PKI clusterfuck. Eight intermediate CA private keys turned out to be ridiculously easy to reconstruct. Browser vendors have started blocking the affected CAs, but outdated clients and applications with their own trust stores could keep accepting certificates from them. Cleaning up this mess is a lot harder than just patching a server. Google’s analysis and response: blog.google/security/protect… Mozilla’s public incident investigation, including the technical findings, timeline and eMudhra’s explanations: bugzilla.mozilla.org/show_bu… — And I can’t help wondering how much of this sudden wave of discoveries has to do with the latest AI models getting better at code review and vulnerability research. We now have models that can dig through massive codebases and potentially find bugs that have been sitting there for years. I’m not saying these particular vulnerabilities were discovered using AI. I haven’t seen evidence for that. But I do wonder whether we’re starting to see some of the effects. The eMudhra case is obviously a different story. That’s a spectacular failure of key management and quality control. Anyway, quite a week. And it’s only Thursday…