Two dangerous internet security issues are putting site admins on edge

Two serious security issues threaten a wide range of internet services and devices, raising the prospect of attacks and extensive remedial work. One affects PHP, which is used by content management systems including WordPress and Drupal; the other involves compromised TLS certificates that could let attackers impersonate websites and intercept traffic.

The PHP Foundation said it would release patches for two critical flaws rated 9.2 out of 10, and urged users to prepare to update. Security firm watchTowr said the reported vulnerability may affect PHP versions dating back to 2004, while Sansec expected mass attacks soon after details were released. Separately, eMudhra revoked eight compromised certificates whose private keys were far weaker than normal; Mozilla, Google and Apple blocked them, though some software may still trust them.