Two serious web security flaws put site administrators on alert
Affected servers need patches for a PHP bug, and some certificates from one authority may still be trusted by a macOS utility.
Two serious web security flaws surfaced at once, and administrators are racing to respond. A PHP remote code execution bug, rated 9.2 out of 10 and reportedly present in every PHP release from PHP 5 (2004) onward, can run attacker code on servers hosting WordPress, Drupal, MediaWiki and similar sites, and the PHP Foundation plans patches for it on a set date. Separately, eight intermediate certificate authority certificates issued by eMudhra were found to rest on keys of only 4 to 237 in size instead of the expected 384 bits, which lets anyone recompute the private keys with trivial effort and forge credentials. Browser makers Mozilla, Google and Apple have blocked the certificates and eMudhra has revoked them, but a macOS utility may keep trusting them because it does not check revocation status. Experts warn the exposure reaches VPNs and IoT devices, and cryptographer Filippo Valsorda predicts a cleanup larger than the Heartbleed incident of 2014.
Why it matters
The PHP flaw is rated 9.2 out of 10 and is reportedly present in every PHP release from PHP 5 onward, so sites running WordPress, Drupal or MediaWiki on that code face exposure until patched. The certificate problem is less direct for most readers, since browser makers have already blocked the affected certificates, but the macOS utility that does not check revocation means some trust may persist. Cryptographer Filippo Valsorda expects the cleanup to be larger than the Heartbleed incident of 2014, which suggests the work will take time and reach beyond a single product.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.
Sources
- Engadget