The SSL and PHP Situation is Insane (and hilarious)

Summary

The video covers two cybersecurity incidents: a certificate-authority failure involving eMudhra and a serious PHP vulnerability.

eMudhra certificate incident

Certificate authorities issue certificates that browsers and operating systems use to verify websites and software signatures. A root certificate can sign intermediate certificates, which in turn sign customer certificates.

According to the video, the private keys for eight eMudhra intermediate certificates were generated as tiny numbers rather than secure, long random values. One was reportedly just 4. This made the keys easy to guess and could allow attackers to forge certificates.

Six affected certificates were used for website security (SSL/TLS), potentially enabling convincing fake certificates in certain man-in-the-middle scenarios. Two were used for code signing, which could make malicious software appear more trustworthy to security tools.

Certificate revocation lists can tell devices to stop trusting compromised certificates, but protection depends on devices and software retrieving those lists. Offline or poorly updated systems may remain at risk.

The video says Google and Mozilla revoked trust in eMudhra’s root certificate, while major browser and operating-system trust lists were also updated. It notes that Android devices could receive the change through Google Play Services and suggests restarting an Android device to prompt an update.

Check: The presenter points viewers to a test site for checking whether a device still trusts the affected certificates. A check mark on that site means the certificates are no longer trusted.

PHP vulnerability

The video describes a severe PHP vulnerability called “PHP to Shell,” which could let attackers compromise servers running vulnerable PHP pages. It says the issue affected supported PHP versions and some older versions as well.

A proof of concept was reportedly released before patches were available, giving attackers a window to exploit the vulnerability before systems could be fixed. The video says attacks were observed during that period.

Patches were released for supported PHP versions. The presenter also mentions backported patches for some older versions, but says these were not official automatic updates and might require manual installation.

A separate vulnerability involving upload progress bars is also mentioned. The presenter says it was distinct and had not yet been patched at the time.

Guidance: Website owners should check which PHP version their site and control panel use, install the relevant updates, and enable automatic updates where possible. The same concern can apply to local applications that bundle a PHP web server, particularly if their web interface is exposed to the internet. Exposing administrative interfaces—such as a router’s management page—to the internet can increase risk.

Guides and practical advice

The video briefly explains public-key and private-key signing, certificate chains, and certificate revocation. It also provides a practical certificate-trust check and recommends reviewing PHP versions, updates, and any internet-exposed web interfaces.

Main speaker and sources mentioned

• Main speaker: ThioJoe, providing the incident explanations and recommendations.
• Organizations and sources referenced: eMudhra, the PHP team, Google, Mozilla, Microsoft, Apple, and the NSA.
• The video also refers to an online certificate-checking site without naming it in the subtitles.