Cybersecurity experts are warning that two newly uncovered vulnerabilities could trigger large‑scale attacks and demand extensive remediation, according to security disclosures reviewed by Ars Technica. The first flaw concerns TLS certificates that use extremely weak encryption, a problem that could affect everything from VPN services to Internet‑of‑Things devices. The second is a critical PHP vulnerability that targets popular content‑management systems such as WordPress and Drupal.
The PHP Foundation announced on X that it will release patches for two critical bugs that score 9.2 out of 10 on the severity scale. The updates are scheduled for 14:00 UTC (10 a.m. ET) today, and the group urged PHP users to prepare for the upgrade. It added that an earlier release could be issued if details become public or evidence of active exploitation emerges.
The advisory follows a video that shows a tool called PHP2Shell executing code on web servers running the latest versions of WordPress, MediaWiki, Symfony, Drupal and other PHP‑based platforms. Security firm watchTowr says it has verified the flaw and that it impacts every PHP version from PHP 5, released in 2004, onward. An unverified report suggests the vulnerability could let an attacker run arbitrary code on a PHP server and potentially seize control. Sansec warned that mass attacks could begin within 15 minutes of the patch’s release, meaning many site operators may need to shut down PHP sites briefly while they apply the fixes.
The TLS issue involves an Indian certificate authority, eMudhra, whose eight intermediate CA certificates were found to have compromised private keys. Those keys chain to roots trusted by Mozilla, Microsoft, Apple, Chrome and many downstream trust stores. The private keys were unusually small, ranging from three to eight bits instead of the typical 384‑bit size. The specific key identifiers were 4, 56, 66, 115, 155, 156, 230 and 237, values that can be guessed by testing just 256 possibilities.
Because the affected certificates were widely trusted by services such as Cloudflare, browsers, operating systems and IoT devices, an attacker who forges domain certificates could impersonate legitimate servers and intercept traffic. Mozilla, Google and Apple have already blocked the compromised certificates in their browsers. However, Mozilla security specialist Dennis Jackson cautioned that a macOS utility may continue to trust the certificates, as it does not check revocation data—a problem that also affects many other clients.
eMudhra has revoked the eight certificates and blamed a flawed script used in their generation process. The most immediate danger appears to be to VPN services, especially in regions where governments actively try to monitor traffic, but the flaw could also impact IoT devices, unmaintained servers and other parts of the internet. Cryptography engineer Filippo Valsorda told Ars that the cleanup effort could surpass the scale of the 2014 Heartbleed incident.