Weak CA keys cracked in 1 second and AI-found PHP flaw force global emergency patching
赛博禅心 · wechat · 2026-10-21
A cluster of critical vulnerabilities hit the internet at once: Indian CA eMudhra issued 8 intermediate certificates whose ECDSA private keys were tiny integers (crackable in under a second, letting anyone forge certificates for any domain), and two CVSS 9.2 PHP bugs (PHP2Shell) allow unauthenticated remote code execution—exploits appeared before the patch, pushing Dutch and Finnish government sites and Pixiv offline, with Japan's PM urging admins to patch.
Notably, the PHP bugs were found by OpenAI's Patch the Plane program using GPT-5.6 Sol, which OpenAI calls a 'defender's window.' Node.js also shipped fixes for 10 vulns the same day. Browser trust stores are updated, but non-browser contexts (curl, CI, IoT) remain exposed until the certs expire in 2039.
More from AGI Musings
- Survey: 54% of Workers Avoid Company AI Tools, Waste 8 Hours a Week Fixing AI Mistakes — marigo · 2026-10-22
- ML pioneer Dietterich: OpenAI's agents ran for months with essentially no supervision — tdietterich · 2026-10-22
- Altman hints OpenAI's internal models do math public models can't, flags RSI speed limits — VraserX · 2026-10-22
- New symmetric Venn diagrams with 17, 19 and 23 curves found via AI-assisted search, breaking 2014 record — pickover · 2026-10-22
- Ex-OpenAI researcher's hot take: NYC trails SF by 4-7 months in AI, London 12+ — jefrankle · 2026-10-22
- Debate on AI proof formalization: mass-formalize textbooks first, then let AI build on the repos — jacobaustin132 · 2026-10-22