A newly disclosed vulnerability in PHP affecting versions since 2004 requires immediate patching, alongside separate certificate revocations due to weak private keys.
Read the technical details on the affected systems and updates.
The problem with the popular programming language
The first issue concerns the PHP programming language, which is used behind millions of websites and popular content management systems such as WordPress and Drupal. Research group watchTowr said the problem affects versions from 2004 onwards. According to estimates, the security flaw could allow unknown parties to run their own code on servers, potentially gaining control over them.
PHP Group has announced security updates with a severity rating of 9,2 out of 10. A cybersecurity firm estimated that mass attacks could begin within minutes of the patches being released, meaning administrators will need to act quickly.
The problem with digital certificates
The second issue concerns the security of certificates used to protect internet traffic. India-based company eMudhra announced that eight of its intermediate certificates were compromised due to extremely weak digital keys.
READ ALSO
Critical PHP warning: Security updates coming soon
These keys were 3 to 8 bits long, instead of the usual 384 bits, making them very easy to decrypt. The certificates were associated with roots that are widely trusted by Mozilla, Microsoft, Apple, and Chrome. With this data, the attackers could forge certificates and impersonate legitimate servers.
The reactions and impact
Mozilla, Google, and Apple have already blocked the problematic eMudhra certificates. The company itself attributed the problem to a penny used to generate the keys.
Experts point out that the greatest risk concerns remote connection services, smart home devices and unpatched servers, likening the cleanup effort to the well-known Heartbleed issue of 2014.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)