eMudhra revokes eight compromised TLS certificates — Engadget
Indian company eMudhra has revoked eight intermediate TLS certificates with excessively weak private keys, while the PHP Foundation announced that it is preparing fixes for two critical PHP vulnerabilities. Both issues could create risks of large-scale attacks on web resources and require significant work to protect systems, Engadget reports.
PHP vulnerabilities
The PHP Foundation said it is preparing patches for two critical vulnerabilities rated 9.2 out of 10 on the severity scale. The organization urged PHP users to prepare for an update and noted that it may release it earlier if details of the issue become public or evidence of active exploitation emerges.
The announcement was preceded by the appearance of a video featuring the PHP2Shell tool, which runs code on web servers with current versions of WordPress, MediaWiki, Drupal, and other PHP platforms. The company watchTowr said it had confirmed the vulnerability and that it affects all PHP versions starting with PHP 5, released in 2004. At the same time, watchTowr's FAQ states that the possibility of an attacker running their own code on a server and potentially taking control of it is described in an unverified report. Sansec expects mass attacks to begin within 15 minutes after the update is released.
More current news is available on the UA.News Telegram channel Telegram.
Certificates with weak keys
eMudhra said that the eight compromised intermediate certificates are associated with root certificate authorities trusted by Mozilla, Microsoft, Apple, and Chrome applications, as well as other trust stores. Weak private keys could potentially allow attackers to forge domain certificates, impersonate servers, and intercept traffic.
According to Hacker News and other reports cited by Engadget, the private key sizes were 4, 56, 66, 115, 155, 156, 230, and 237 bits, while the article names 384 bits as the usual size. Mozilla, Google, and Apple have already blocked these certificates in their browsers. At the same time, Mozilla specialist Dennis Jackson warned that one macOS utility may continue to trust the revoked certificates because it does not check revocation data. The greatest risk, according to the publication, concerns VPNs, as well as Internet of Things devices and servers without proper maintenance.
