Two dangerous internet security issues are putting site admins on edge
Both problems could result in large-scale attacks and require massive cleanup.
Critical Vulnerabilities Surface
The web is experiencing significant disruption following the discovery of two severe vulnerabilities. The first involves TLS certificates with extremely weak encryption that could affect everything from VPNs to IoT devices. The other is a severe PHP programming language vulnerability impacting CMS systems including WordPress and Drupal. Both problems could result in large-scale attacks and require massive cleanup jobs, security experts said.
The PHP Foundation stated that it is releasing security patches for two critical vulnerabilities rated 9.2 out of 10 on the severity scale. The group advised PHP users to prepare for updates and to apply them promptly.
The advisory follows reports regarding a tool called PHP2Shell running code on web servers including the latest versions of WordPress, MediaWiki, Symphony, Drupal and other PHP-based sites. The security firm watchTowr claims it has confirmed the vulnerability and that it affects every version from PHP 5 onward, potentially allowing attackers to run custom code on vulnerable servers.
Security firm Sansec noted it expects mass attacks to start shortly after security releases are issued. Consequently, web administrators are scrambling to patch systems, which may cause brief downtime for some PHP-based websites.
Compromised TLS Certificates
The second major issue concerns TLS certificates. An India-based firm called eMudhra confirmed that eight of its intermediate CA certificates have been compromised. These certificates chain to roots trusted by Mozilla, Microsoft, Apple, and Chrome root programs, featuring private keys that are weak enough to let attackers forge credentials for various websites and applications.
The compromised private key sizes ranged from three to eight bits rather than the standard 384 bits. Specifically, the private keys used by eMudhra were measured at 4, 56, 66, 115, 155, 156, 230, and 237, potentially allowing attackers to recover them through testing.
The affected eMudhra certificates were widely trusted by hosts like Cloudflare, along with browsers, operating systems, and IoT devices. Once domain certificates are forged, malicious actors can use those domains to impersonate servers and intercept traffic.
Industry Response and Cleanup
Mozilla, Google, and Apple have blocked the compromised certificates in their browsers. However, experts warn that certain utilities or operating system components may continue trusting the compromised certificates if they do not adequately check revocation information. eMudhra has revoked the eight certificates and blamed a script used during generation.
The primary risk currently impacts VPNs, particularly in regions where traffic interception is prevalent, alongside IoT devices and unmaintained servers. Cryptography experts note that addressing these issues will require a massive cleanup effort across the internet.
