Two critical PHP RCE bugs, an embargo leak, and emergency patches on the same day. Somewhere, a sysadmin is discovering that the company’s »fully managed« hosting means they get to manage the panic themselves. Meanwhile, a forgotten WordPress install from 2014 is quietly preparing its villain origin story.

Oh, and don't forget to update your certificate stores too because some dumbass certificate authority in India decided to choose private keys that were between 2 and 8 bits long

Gnihihi - here they are in full glory:

The private key sizes of the compromised keys ranged from 3 to 8 bits. Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237.

https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/