Two Internet Security Warnings This Week, and What They Mean for You

Two serious internet security problems have come to light together, according to security releases seen by Ars Technica. One affects the digital certificates that keep connections to websites private. The other is a serious flaw in PHP, the programming language behind many websites, including sites built with WordPress and Drupal (Engadget).

Digital certificates work a bit like ID cards issued by a trusted office. Your browser checks them before it trusts a website. India-based eMudhra said eight of its intermediate certificates were compromised. Those certificates are linked to the trusted authorities that browsers and operating systems already rely on. The secret keys behind them were only three to eight bits long, while a typical key is 384 bits. A short key has very few possible values, so someone could guess it by trying only a handful of options. eMudhra revoked the eight certificates and blamed a script used to create them (Engadget).

Browsers responded in stages. Google Chrome blocked the certificates on October 17, 2026, and Apple followed on October 19, 2026 (LWN.net). Mozilla also blocked them and published a security post on October 20, 2026 (Mozilla Security Blog). Mozilla warned that someone who could intercept a user's connection could use these certificates to pose as a real website and possibly read or change the traffic. Its public bug record for the incident, bug 2083449, logs the eight certificates as revoked (Mozilla Bugzilla). Apple's documentation says blocked certificates are believed to be compromised and will never be trusted (Apple Support).

Mozilla security expert Dennis Jackson warned that a macOS utility may still trust the compromised certificates, because it does not check whether they have been revoked (Engadget).

In my view, that matters most for people whose software relies on the computer's own trust decisions rather than a browser's. Checking whether a certificate has been cancelled is a known weak point, and a tool that skips it will keep accepting a certificate that browsers have already rejected.

The PHP problem is on a tighter clock. The PHP Foundation said it was releasing patches for two critical flaws, each rated 9.2 out of 10 in severity, at 14:00 UTC on October 21, 2026 (Engadget). Security firm watchTowr confirmed the flaw affects every PHP version from PHP 5 (2004) onward. A demonstration tool called PHP2Shell ran code on web servers, including the latest versions of WordPress, MediaWiki, Symfony and Drupal. Sansec expects attacks to begin within 15 minutes of the patch release (Engadget).

eMudhra says on its homepage that it serves more than 1,000 large enterprise customers, has issued more than 100 million digital certificates, and has active customers in more than 50 countries. Those numbers show how far one bad certificate authority can reach.

If you run a website, the picture is simpler. Patches exist and are scheduled. The sooner they are installed, the less time attackers have. Sites that update automatically are in a much better position than those waiting for a convenient moment.

In my view, there is also something reassuring here. Within days, three major browser makers had blocked the compromised certificates, and the problem was documented in public records. That kind of fast teamwork lets one small mistake be contained without breaking the wider web.