Two severe internet security issues have emerged, putting site admins on edge. The first involves TLS certificates with extremely weak encryption that could affect VPNs and IoT devices. The other is a severe PHP programming language vulnerability impacting CMS systems like WordPress and Drupal. Both problems could result in large-scale attacks and require massive cleanup jobs, security experts warn.
The PHP Foundation released security patches for two critical vulnerabilities rated 9.2 out of 10 on the severity scale. A report shows video of a tool called PHP2Shell running code on web servers, including the latest versions of WordPress, MediaWiki, Symphony, Drupal, and other PHP-based sites. The security firm Towr claims the vulnerability affects every version from PHP 5 (2004) onward, potentially allowing attackers to run their own code on a server.
An India-based firm called e Mudhra reported that eight of its intermediate CA certificates have been compromised. The private keys are weak, ranging from three to eight bits instead of the usual 384 bits, potentially allowing attackers to forge credentials for websites and apps. Mozilla, Google, and Apple have blocked the compromised certificates, but a macOS utility may keep trusting them. e Mudhra has revoked the certificates and blamed a script used to generate them.
The biggest risk is currently to VPNs, particularly where governments try to intercept traffic, and IoT devices. Filippo Valsorda warned this will be a massive cleanup job bigger than Heartbleed. Web admins are scrambling to patch the issues, with some PHP-based websites potentially going down briefly.
Source: Engadget · Summarized by HeadlinesBriefing