Let’s not forget about this certificate clusterfuck while everyone is busy with the PHP RCE news. Almost at the same time, another serious security incident became public. Eight intermediate CA certificates from eMudhra were found to use ridiculously weak private keys. We’re talking about P-384 keys where one private key was literally the number 4. FOUR! Six of these were TLS CAs, allowing anyone to recover their private keys and potentially issue trusted certificates for arbitrary domains. Major browsers have already blocked the affected CAs. But what about API clients, backend services, embedded devices, containers, and systems with outdated trust stores? Many don’t enforce Certificate Transparency or check revocation. Some could remain vulnerable for years. These weak keys have existed since April 2025. No confirmed malicious exploitation so far, but the implications are serious. Don’t overlook this one while focusing on PHP. Technical details and test endpoints: emudhra.we-have-a-problem.co…

So, these threat actors successfully phished an author of multiple open source NPM packages with a total of 2 billion weekly downloads – including debug, chalk, and ansi-styles. Since most companies run at least one React or Angular app, they had the opportunity to execute code on millions of systems across thousands of orgs. And they used it to drop an amateurishly obfuscated crypto stealer, got caught by basic detection rules, and the issue was remediated after 2 hours. I hope everyone understands how close this was – and can imagine what would’ve happened if someone with real skills had done it. #NPM #Compromise #SupplyChain