E-Paper
Weak web IDs and a decade-old PHP flaw. The week the internet's plumbing showed its cracks
A Bengaluru firm's guessable keys and critical flaws in the code behind much of the web have shown how much rests on parts few people check.
Prefer HTon Google
Within hours of each other, serious cracks were exposed in two pieces of the internet's hidden plumbing. A researcher found that eMudhra, a Bengaluru-based certificate authority, had made the keys behind eight of its security certificates so weak that one of them was simply the number 4. Then came the revelation from developers of PHP, the programming language behind a large share of the world's websites, who disclosed two critical flaws. Finland and a number of government agencies across the world public-facing internet services offline as a precaution.
Most people never think about either. Few know which company vouches for the websites they visit, or what language those sites run on, and that invisibility makes both problems harder to fix.
eMudhra and the identity cards
Every website whose address begins with "https" carries a certificate, a digital identity card that lets a browser confirm the site is genuine before it shows a padlock. Several dozen certificate authorities issue these cards, and any one of them can vouch for any website in the world.
The keys eMudhra used to sign its cards should each have been a random number about 116 digits long. They were 4, 56, 66, 115, 155, 156, 230 and 237, small enough for a computer to find by counting. Anyone who worked them out could have forged an identity card for any website, and Mozilla, which makes the Firefox browser, said "the impact of this incident could not be higher".
Browsers were protected because they accept a certificate only if it appears in public logs, where a forgery would have been spotted. Google, Mozilla, Apple and Microsoft also blocked the certificates within days. Apps, routers and other devices that skip those checks will keep trusting the keys until someone updates them.
PHP, the software under much of the web
PHP runs on web servers, the computers that host websites, and assembles each page at the moment a visitor asks for it. Wiz, the Alphabet-owned security company that found the flaws, estimates the problems affect around 70% of the internet.
"PHP is everywhere," the security company Huntress wrote. "It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn't even advertise that it runs PHP under the hood."
Both flaws scored 9.2 on CVSS, the industry's 10-point scale for how dangerous a software bug is. The EU's cybersecurity response team, CERT-EU, said that score pointed to a risk of remote code execution without any login. In plain terms, an attacker anywhere on the internet might be able to make a vulnerable server run commands of their choosing. The web host GoDaddy said that could mean stolen data, defaced websites or a complete takeover of the server. CERT-EU and Australia's cybersecurity agency said every version of PHP from version 5 onward could be affected, though PHP had not said which versions were vulnerable.
Also read: The two kinds of AI attacker CERT-In flagged, and the weaknesses they exploited
Why governments pulled the plug
CERT-EU told organisations that could not patch immediately to consider taking affected sites offline, and Britain's National Cyber Security Centre gave similar advice. Some governments did not wait. Finland took all its public-facing internet services offline, and Dutch national and local government sites went down. According to Dutch news agency ANP, more than 100 Dutch municipalities, provinces and water boards were affected because they use a service from one software supplier, Notubiz. The universities of Vienna and Freiburg pulled their sites too.
Going offline is the bluntest protection available.
The race after the patch
PHP's developers released four patches on Wednesday and told users to update immediately. A published patch can also help attackers work out what was broken, and security experts warned they would move quickly against servers that had not yet been fixed.
That race may already be under way. Dane Knecht, chief technology officer of the web security company Cloudflare, wrote on X that Cloudflare was "seeing early attacks emerging" and had added protections for customers, which he called a "STOPGAP only". Australia's cybersecurity agency said it was "currently not aware of active exploitation".
Fixing PHP takes deliberate effort. Wordfence, which makes a popular WordPress security plugin, warned that WordPress's automatic updates would not apply the fix, because PHP is installed on the server underneath. Site owners need to find out who updates PHP for them, whether that is a hosting company, a developer or themselves.
A decade-old flaw, found by AI
Wiz said it found the flaws with several AI tools, working with OpenAI and the security firm Calif, and estimated that they had gone undetected for more than a decade. "With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work," it said.
The PHP Foundation, which oversees the language, said a researcher had spotted the first signs of one flaw in 2024, but the issue was "theorized, but no concrete vectors were found". It called the delay "a structural failure".
Also read: Cyberattack targets refrigerators at French supermarkets: Why nothing is un-hackable
What the two flaws have in common
Both affect parts of the internet that users never see and never chose. eMudhra's keys could have been used to impersonate websites that had never been its customers. PHP is buried in so much software that, as Huntress put it, "the number of places you have to go looking to identify vulnerable PHP versions gets very big, very fast".
Both flaws stayed hidden for a long time: 18 months in eMudhra's case, and more than a decade in PHP's by Wiz's estimate. Both also had early warning signs that did not lead to a fix. In May 2025, revocation lists eMudhra published for six of the certificates failed signature checks, and the company told Mozilla it had resolved the problem by re-signing them "with flawed keys". PHP's 2024 lead was judged theoretical and set aside for more pressing issues.
AI figures in both stories. eMudhra says the researcher may have used AI-assisted techniques, and a Mozilla engineer wrote that AI agents he tested recovered the keys "on their first attempt with a simplistic prompt". Wiz credits AI with finding PHP's flaws in a week. Tools that help researchers find old bugs fast are available to attackers too.
And both fixes depend on people acting. Browsers update themselves, but many devices and apps will keep trusting eMudhra's keys until someone updates them, and every PHP server has to be patched by whoever runs it.
Where they differ
eMudhra's flaw was in the internet's trust system, which tells a browser who a website is. PHP's flaws are in the software that runs the website itself. eMudhra's weak keys came from one company's mistakes at a single key-making session in April 2025, while PHP's flaws were bugs in widely shared code.
The attacks differ too. Using eMudhra's website keys required an attacker to intercept a victim's connection, on a café's Wi-Fi or at an internet provider, and browsers had a safety net that would have exposed forgeries. PHP's flaws can be attacked directly over the internet, and most sites have no comparable protection other than patching, which helps explain why some governments chose to take their sites offline.
What to do
Ordinary users should update their browsers, phones and computers, and never click past a warning that a website's certificate is not valid. Website owners should find out who maintains PHP on their sites and make sure the fix is applied. If they cannot patch, CERT-EU advises considering taking the site offline until they can.
