An interview with Ondřej Surý, a volunteer who maintains PHP and automates its patches, about his role in fixing two critical PHP security vulnerabilities (Charlie Warzel/The Atlantic)

This week has seen two significant security emergencies, both targeting the fundamental infrastructure of the web. The first emergency involves a certificate authority that issued private keys with weak security, making them easily guessable. The second emergency centers around two critical PHP vulnerabilities that were leaked before patches could be issued.

The certificate authority eMudhra accidentally generated private keys with very low entropy, ranging from just 3 to 8 bits. In fact, one of the keys was simply the number 4. These weak keys could be calculated from their associated certificates, which were trusted by major browsers and operating systems. An attacker could use these compromised keys to create valid certificates for any domain, enabling them to intercept or manipulate web traffic.

Browsers detected the issue and quickly blocked the keys through remote revocation lists, requiring no updates or restarts. However, the bigger concern lies in the vast number of servers, containers, command-line tools, and IoT devices that rely on static lists of trusted roots and do not check for revocation. Many software distributions, including major Linux distributions, have already released fixes. Yet, some, like Java and FreeBSD, are still working on their solutions.

The second major emergency stems from PHP, which powers nearly 70% of all websites, including major platforms like WordPress, Drupal, and MediaWiki. Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been discovered, collectively known as PHP2Shell. These flaws enable an attacker to execute arbitrary code or read sensitive data from server memory due to PHP leaving memory in a corrupted state after abnormal request termination.

PHP developers have released emergency patches for these vulnerabilities, but the potential impact is enormous, given PHP's widespread use. Server administrators are strongly advised to upgrade to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 as soon as possible. The FBI, NSA, and the UK's National Cyber Security Centre have all recommended immediate patching or taking PHP systems offline to mitigate the risks.