Know some stressed infosec/devops people right now? here’s why:
🔹 SSL certificates 🔐 keep the web secure, and keys to 8 of them have been compromised, meaning attackers can impersonate websites & services. Keys are passwords hundreds of characters long, but one of the compromised keys was just the digit “4”.
Firefox, Chrome, & Apple Safari browsers have all applied workarounds; but loads of other stuff relies on these certificates of authenticity and they will need to be manually updated.
🔹 PHP is a language used to make ~70% of websites. A backdoor has been found allowing an attacker access to any PHP server.
This is so severe that current advice is to take down PHP sites until the fix is released.
When it is released, it only fixes current supported PHP versions. Around half of PHP-based sites still use older versions than this, and they will remain vulnerable until they’re upgraded. (Which may be hard for particularly old software)