i'll be honest, for a while i though the php vulnerability and the "a certificate authority screwed up by setting their private key to 4" thing were one and the same