Internet security issues cause concern among website administrators worldwide

Two significant internet security issues have emerged, causing concern among website administrators worldwide. The problems could lead to massive attacks and necessitate extensive cleanup efforts, according to experts in the field of cybersecurity.

The first vulnerability involves TLS certificates with extremely weak encryption that may affect various devices such as VPNs and IoT equipment. This weakness raises concerns about the security of online transactions and data exchange between websites and their users. The scope of potential impact is broad, encompassing multiple types of connected devices.

A severe PHP programming language vulnerability has also been discovered, affecting content management systems (CMS) including WordPress and Drupal. This issue could allow attackers to run malicious code on web servers, potentially giving them control over the affected sites.

The severity of this problem was underscored by a report showing video footage of a tool called PHP2Shell executing code on web servers, including recent versions of popular CMS systems. The security firm watchTowr claims it has confirmed the vulnerability and notes that it affects all versions of PHP from 2004 onwards.

According to an unverified report cited by watchTowr, this exploit could enable attackers to run their own code on a server running PHP, effectively granting them control over the affected system. The security firm emphasized that users should prepare for updates ahead of an expected release today at 14:00 UTC (10AM ET), with the possibility of an earlier patch if details become public or active exploit evidence is detected.

As websites scramble to patch a critical security vulnerability, another issue is causing concern among administrators. Sansec has warned that mass attacks could start within 15 minutes of a fix being released, putting pressure on web admins to act quickly.

In a separate development, India-based eMudhra has disclosed that eight of its intermediate CA certificates have been compromised. These certificates chain to roots trusted by major browser and operating system vendors, including Mozilla, Microsoft, Apple, and Chrome root programs. The compromised private keys are weak, allowing attackers to forge credentials for various websites and apps.

The private key sizes used by eMudhra were found to be alarmingly small, ranging from three to eight bits. Typically, such keys would have a size of 384 bits. Specifically, the affected keys measured 4, 56, 66, 115, 155, 156, 230, and 237 bits in length.

The compromised eMudhra certificates were widely trusted by hosts like Cloudflare, as well as browsers, operating systems, IoT devices, and other internet-connected hardware. Once attackers forge domain certificates using these compromised keys, they can impersonate servers and intercept traffic flowing through the affected domains.

Mozilla, Google, and Apple have taken steps to mitigate the issue by blocking the compromised certificates for their browsers.

However, this may not be enough to prevent further problems, as a macOS utility could potentially continue to trust the compromised certificates due to its lack of revocation information checks, a vulnerability that affects many other clients beyond just macOS. eMudhra has taken responsibility for the issue and revoked the eight compromised certificates, attributing the problem to a script used in their generation process.

The affected parties include VPNs, which are particularly vulnerable to interception by governments seeking to monitor traffic, as well as IoT devices, unmaintained servers, and other parts of the network that may be impacted. The scale of the required cleanup effort is expected to be substantial, with one expert likening it to the aftermath of a major TLS bug discovered in 2014.