PHP Foundation Issues Patches for Critical Vulnerabilities Affecting CMS Platforms

The PHP Foundation released security updates at 14:00 UTC to address two critical vulnerabilities rated 9.2 out of 10 on the severity scale. The organization urged users to prepare for the update, stating it would issue an earlier release if details became public or if evidence of active exploitation emerged.

According to Engadget, which reported on security releases seen by Ars Technica, these issues could result in large-scale attacks requiring massive cleanup efforts. One flaw allows remote code execution, while the other involves TLS certificates with extremely weak encryption that could affect everything from VPNs to IoT devices.

Technical Details and Timeline

Security firm watchTowr confirmed the PHP vulnerability affects every version from PHP 5, released in 2004, through the latest iterations. The firm’s FAQ notes that an unverified report indicates the flaw lets attackers run their own code on servers, potentially taking full control. A tool called PHP2Shell was shown in a report running code on web servers using WordPress, MediaWiki, Symphony, and Drupal.

Company Sansec expects mass attacks to begin within 15 minutes of the patch release. Consequently, web administrators are likely scrambling to apply the updates, which may cause brief downtime for some PHP-based websites as they undergo maintenance during this critical window.

Certificate Authority Compromise

The second major issue involves eMudhra, an India-based certificate authority, which disclosed that eight of its intermediate CA certificates have been compromised. These certificates chain to roots trusted by major platforms including Mozilla, Microsoft, Apple, and Chrome, as well as many downstream trust stores. The compromise stems from private keys that are significantly weaker than industry standards.

The compromised private key sizes ranged from three to eight bits, rather than the standard 384 bits. Specific key sizes identified were 4, 56, 66, 115, 155, 156, 230, and 237 bits. According to Hacker News and other reports, these small sizes allow anyone to recover the keys by testing just 256 possible numbers, enabling credential forgery for various websites and applications.

What should you do?

Administrators should immediately check if their servers run PHP versions from 2004 onward and apply the latest patches provided by the PHP Foundation. Organizations should also verify the integrity of their TLS certificates, particularly those issued by eMudhra, to ensure they have not been forged using the compromised weak keys.

What to do and how to stay safe: PHP Foundation

• Update all PHP-based servers and applications to the latest patched versions immediately after the official release.
• Audit TLS certificates issued by eMudhra to ensure they are not using the compromised intermediate certificates.
• Monitor server logs for unusual activity or signs of remote code execution attempts during the patching window.
• Verify that your trust stores are updated to reflect any revocations related to the compromised eMudhra certificates.

Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which PHP versions are affected by the new vulnerability?

The vulnerability affects every version of PHP from 5, released in 2004, through the latest current versions.

How severe are the PHP vulnerabilities?

The PHP Foundation rated both vulnerabilities as critical, with a severity score of 9.2 out of 10.

Why are eMudhra's certificates considered compromised?

The private keys used for eight intermediate certificates were extremely weak, ranging from 3 to 8 bits, allowing easy recovery and forgery.