Why websites are offline & nerds are laughing at the number 4

There are definitely going to be some stressed information security people, devops engineers and software developers right now, as two completely unrelated major security vulnerabilities became known yesterday.

Here's a simplified summary of what's going on, with an explanation of the jargon involved.

PHP and why so many websites are offline

PHP is a programming language used in about 70% of all websites.

A vulnerability has been found which allows an attacker to gain full access to any publicly accessible PHP server on the internet. From this server (computer) the attacker could, for example: install anything on it, use it for nefarious purposes without revealing their location, or attempt to access other parts of a company's infrastructure.

This is so severe that the EU-wide Computer Emergency Response Team advised organisations to take PHP sites offline until they can apply the fix that was released this afternoon.

CERT-EU advises organisations to prepare for immediate patching of affected assets. Where immediate patching is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix is available.

The next complication is that only around half of PHP-based sites use up-to-date versions of PHP. Only the currently-supported versions of PHP are getting the fix for this issue, so organisations using older versions will remain vulnerable until they are able to upgrade to a more modern version. For some sites, this is relatively straightforward to do, but for others it may involve taking (or leaving) the site completely offline while the work takes place.

Critical Vulnerabilities in PHP

Critical Vulnerabilities in PHP

Critical Vulnerabilities in PHP

PHP: News Archive - 2026

PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.

2026

eMudhra Certificates and the number 4

SSL certificates keep the web secure, and are what the 🔐 padlock symbol in the top corner of your web browser represents. They're effectively certificates of authenticity trusted by computers to say that a website is being operated by who it says it is.

These certificates are protected by private keys. These are basically very complex passwords – hundreds of characters long – to make them hard to guess or reverse-engineer.

Private Keys to 8 of these certificates from eMudhra, an Indian certificate authority, have been compromised because they weren't very secure. It turns out that the keys were only a couple of characters long, and in one case it was just the digit “4”. Thanks to this weak security, attackers can use these keys to fraudulently make a forged certificate, and pass off an impersonated website as the real one (amongst other things).

To work round this, everything needs to be updated to not trust these 8 eMudhra certificates. Firefox, Chrome, & Apple Safari browsers all made this change within hours of it being revealed; but there will be lots of devices and systems that need to be updated manually by their maintainers.

This vulnerability was announced at https://emudhra.we-have-a-problem.com/

The Internet goes on high alert after discovery of 8 compromised TLS certs

Intermediate certs allow anyone to mint web credentials for any Internet server.

Ars TechnicaDan Goodin

8 eMudhra certificates are compromised. Here’s what you need to know

Following the discovery that eight eMudhra intermediate certificates use weak keys, Cloudflare is deploying mitigations and releasing client updates. We explain the impact, our response, and what customers and developers should do next.

Cloudflare BlogChristopher Patton

Last night I also crudely edited the 30-40 olives meme to relate to this situation, and it appears to have spread like wildfire. I posted it on my Mastodon, BlueSky, Tumblr, and Threads profiles

Who am I anyway?

I'm Natalie Gray, a broadcast engineer and a digital creator who makes STEM education and entertainment videos.

You can follow @NatGrayYes pretty much everywhere: YouTube, Instagram, Mastodon, Patreon, TikTok, Twitch, Tumblr, Threads, and BlueSky.

Here are some videos you may enjoy: