Critical PHP & SSL/TLS Cybersecurity Crisis
Two critical unauthenticated remote code execution vulnerabilities in PHP were discovered — partly by AI models — triggering NSA advisories, DeFi warnings, and major organizations taking systems offline. A Certificate Authority (eMudhra) compromise simultaneously broke SSL/TLS chain of trust.
What we know
The cybersecurity community is on high alert after a convergence of three major incidents in 72 hours. The most critical: two unauthenticated PHP remote code execution vulnerabilities, discovered in part by AI models (GPT-5.6 Sol + Gemini 4 Argon working alongside human experts), as Noah Smith notes. The NSA issued an advisory urging all PHP users to patch immediately, quoted by Aaron Levie, who says this shows AI will make cyber offense/defense tireless. Compounding matters, eMudhra — a trusted Certificate Authority — compromised its intermediate CA certs, meaning any site can be impersonated without the user knowing, per an account on X, who warned DeFi users to stop interacting with any protocol website until resolved. The Institute for the Study of War took its website offline as a precaution. Bank of America reportedly spent 'hundreds of millions' extra in Q3 partially on Anthropic Mythos model vulnerability remediation, bringing in 1,000 extra contractors, per Noah Smith. IT sysadmin account another account on X went viral recounting being called at 6AM to patch PHP servers — inventory said 12, reality was far more. Toly RTs PHP defender memes as the situation becomes a cultural moment.
How the story developed
Two critical unauthenticated remote code execution vulnerabilities in PHP were discovered — partly by AI models — triggering NSA advisories, DeFi warnings, and major organizations taking systems offline. A Certificate Authority (eMudhra) compromise simultaneously broke SSL/TLS chain of trust.
A DEFCON-1 level PHP vulnerability affecting ~70% of websites is being disclosed today, enabling arbitrary code execution. Separately, LiteLLM v1.107.0 was confirmed compromised.
A rogue Certificate Authority used cryptographic private keys as weak as the number '4', effectively breaking SSL for the near term. Separately, two CVSSv4 9.2 PHP vulnerabilities are dropping Wednesday Oct 21 at 14:00 UTC.
By the Global Eye 24 desk, with AI assistance. Updated as the story develops. Spot an error? Write to corrections@globaleye24.com.