The web security sector is witnessing a state of high alert following the discovery of two serious security vulnerabilities threatening the stability of millions of websites and communication systems around the world, amid warnings from cybersecurity experts of potential large-scale attacks requiring massive cleanup and maintenance efforts.
Details of the Serious PHP Vulnerability
The first issue relates to a critical software vulnerability in the PHP programming language that directly affects popular content management systems such as WordPress and Drupal. The PHP Foundation announced the release of security patches to address two vulnerabilities classified with a high severity level of 9.2 out of 10 points, calling on users to prepare immediately for updates.
These precautionary updates came after the circulation of a video documenting a tool called PHP2Shell executing code on web servers including the latest versions of WordPress, MediaWiki, Symfony, and Drupal. The cybersecurity firm watchTowr confirmed the existence of the vulnerability affecting all PHP versions starting from version 5 released in 2004, allowing attackers to execute their own code and potentially take control of vulnerable servers.
Weakness in TLS Digital Encryption Certificates
In a related context, the internet infrastructure is facing another crisis involving Transport Layer Security (TLS) digital encryption certificates. The Indian company eMudhra announced the compromise of eight of its intermediate certificate authority certificates tied to trusted roots adopted by major browsers such as Mozilla, Microsoft, Apple, and Chrome.
The primary danger lies in the fact that the private encryption keys for the compromised certificates were extremely weak, with sizes ranging between 3 and 8 bits only instead of the standard 384 bits. These weak keys allow attackers to recover their data by testing a very limited number of possibilities, enabling them to forge domain credentials, impersonate servers, and intercept traffic.
What Changes Practically for Users and Website Administrators?
- Emergency Procedures: Website and content management system administrators rushed to apply immediate software updates, which may cause temporary downtime for some PHP-based websites during maintenance operations.
- Browser Actions: Mozilla, Google, and Apple companies blocked the compromised certificates in their browsers; however, security experts warned that some macOS tools still trust those certificates due to their failure to immediately verify revocation information.
- Scale of Expected Risks: Encryption engineers described this crisis as potentially requiring extensive cleanup operations surpassing in scale the famous Heartbleed vulnerability that appeared in 2014, with the greatest risks currently concentrated on targeted VPN networks and Internet of Things (IoT) devices.