Certificates compromised, PHP vulnerability

Today was not a great day for web security on multiple fundamental levels. There was an issue within core layers of TLS and you can read more about it on cloudflare blog

On the non-technical side, this issue could have been much better handled by both the eMudhra company and indian regulator, but they instead decided to gaslight and claim social media fear mongering. Standard reaction and expected, but disappointing none the less. Interestingly enough, they used very low entropy root keys for their intermediate certificates, but any key is as random as any other key so this looks embarrassing for them to have used test keys in production for more than a year without realizing this process gap. Since then, they have announced that they are moving out of SSL/TLS business but perception damage is done.

There were couple other issues popping about related to PHP and node so all in all the October cyber security month is living up to its name. For PHP, the oft heard advice was to take your website offline, which is extreme but effective. I read that even the patch wasn’t really patching it very well. Considering 70% of websites are PHP based, cloudflare WAF controls are the best defence for most of them out there.

Needless to say, time was spent on updating stuff. I was glad to see that many maintainers rolled out urgent patches.