Indian CA used private keys as weak as "4"; AI-found critical PHP flaw exposed early
歸藏的AI工具箱 · wechat · 2026-10-21
Two major security incidents hit the same day. First, an Indian certificate authority issued certificates with extremely weak private keys—one was literally the single digit "4", others were 2-3 digit numbers like 56 and 66, and multiple audits missed them. Chrome and Firefox blocked these keys within hours, and all 8 keys have been revoked. Browsers are now safe, but non-browser projects should check for similar certificates.\n\nSecond, a critical PHP vulnerability allows unauthenticated remote server takeover; the only safe fix is immediate upgrade, but many old sites haven't updated in years. A researcher published details before an official patch, making it exploitable by anyone. The flaw was discovered by GPT-5.6 via OpenAI-funded Patch the Plane. Sites including the Dutch parliament, Finland's central government, and Japan's Pixiv temporarily shut down. The author notes AI has made offense-defense cycles drastically faster, and OpenAI says it has found more vulnerabilities of this scale.
More from Safety
- Palo Alto CEO: 'Trophy Hunters' Are Now Hunting the Next PHP-Style Vulnerability — johncoogan · 2026-10-22
- ML pioneer Dietterich: OpenAI's agents ran for months with essentially no supervision — tdietterich · 2026-10-22
- NCSC advisory details the two PHP flaws enabling unauthenticated remote code execution — LuizaJarovsky · 2026-10-22
- AI-discovered critical PHP vulnerabilities leaked, UK NCSC urges immediate patching — LuizaJarovsky · 2026-10-22
- eMudhra mess exposes all the software that ships without auto-updates — kuza55 · 2026-10-22
- Dev jokes that their SSL root cert's private key is just '5' — kuza55 · 2026-10-22