GoKawiilPHP Foundation and eMudhra disclose critical security flaws affecting WordPress, Drupal, TLS certs
The PHP Foundation is rolling out patches for two vulnerabilities rated 9.2 out of 10 in severity, following reports of a tool called PHP2Shell that can run malicious code on servers using WordPress, Drupal, MediaWiki and other PHP-based platforms, reportedly affecting every PHP version since 2004. Separately, India-based certificate authority eMudhra disclosed that eight of its intermediate CA certificates—trusted by Mozilla, Microsoft, Apple and Chrome—have weak private keys that could let attackers forge credentials.
GoKawiil's interpretation of the reporting above, not reported fact.
Security firms Sansec and watchTowr warn that mass exploitation of the PHP flaw could begin within minutes of the patch release, since publishing a fix often reveals the underlying bug to attackers. The eMudhra certificate issue could let bad actors impersonate trusted websites or services, undermining the chain of trust that secures much of the web, though the full scope of affected systems remains unclear. Together these disclosures suggest site administrators face a narrow window to patch before attackers can exploit either weakness at scale.
- PHP Foundation is patching two vulnerabilities scored 9.2/10, affecting PHP versions back to 2004.
- A tool called PHP2Shell reportedly allows remote code execution on major CMS platforms like WordPress and Drupal.
- eMudhra disclosed eight compromised intermediate CA certificates with weak keys trusted by major browser root programs.
YubiKey 5 NFC Security Key — With TLS and PHP vulnerabilities putting admin accounts and CMS logins at risk, adding hardware-based two-factor authentication is a smart safeguard. A YubiKey 5 NFC lets site admins lock down WordPress, Drupal, and server access so stolen passwords alone can't lead to a breach. It's a simple, durable way to add real security resilience while patches roll out.
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: engadget.com — Steve Dent, 2026-10-21
Published there as: “Two dangerous internet security issues are putting site admins on edge”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.