Post

Happy Global Encryption Day to those who celebrate. This year's events are brought to you by the number 4 and its friends 56, 66, 115, 155, 156, 230, and 237. I'm glad we got everything patched yesterday and can sit back and relax today.

Russ Cox

@swtch.com

Yesterday's event: literally one of the secret keys underpinning internet security was the number 4. Apply your security updates! bsky.app/profile/swtc...

Russ Cox@swtch.com

The details are now public, as of two hours ago. bugzilla.mozilla.org/show_bug.cgi... The secret P-384 keys for these intermediate CAs are all zeros except the last 8 bits. All not-updated software can be MITM'ed now. IOT boxes that can't or don't update are now trivially MITM'able forever.

bugzilla.mozilla.org2083449 - Private key compromise of eMudhra Intermediate CertificatesNEW (nobody) in CA Program - CA Certificate Compliance. Last updated 2026-10-20.

Russ Cox

@swtch.com

Today's event: apparently anyone can break into any PHP server on the internet. Apply your security updates! www.php.net/archive/2026...

Russ Cox

@swtch.com

bsky.app/profile/swtc...

Russ Cox@swtch.com

Two major PHP remote code execution vulnerabilities fixed today: www.php.net/archive/2026... If you run PHP, take your site down until you can update. And be ready to do this again in a few days. ("If you see two ants in your kitchen, you don't have a two-ant problem.")