Top stories.
- Critical PHP vulnerabilities put millions of sites at risk.
- Indian certificate authority exposes private keys.
- FBI suspects a second ransomware negotiator in ShinyHunters investigation.
- Business news: Proofpoint to acquire Varonis for $6.3 billion.
Critical PHP vulnerabilities put millions of sites at risk.
PHP received patches for two critical vulnerabilities this morning, and all PHP users are urged to update immediately. The flaws, which researchers are tracking as “PHP2SHELL,” can enable unauthenticated remote code execution.
One of the vulnerabilities (CVE-2026-109618) can lead to RCE via out-of-memory corruption, while the other (CVE-2026-109619) can enable RCE via a stale global state. The flaws affect “all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.” PHP’s maintainers state, “We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.”
Some information about the flaws leaked early, and Cloudflare’s CTO Dane Knecht said the company is already observing attacks. Cloudflare has deployed an initial set of WAF rules to block known exploit vectors. Likewise, Jake Knott, head of threat intelligence for watchTowr, stated, “watchTowr Intel is already observing in-the-wild exploitation of the latest PHP vulnerabilities, with a variety of vibecoded PoCs already hitting our sensors featuring a variety of ‘php2shell’ User-Agents. Whilst nobody has been successful to date, we don’t expect that will last long.”
Indian certificate authority exposes private keys.
Tech giants and the broader security industry are also scrambling to respond to the discovery of extremely weak private keys belonging to eight intermediate certificates operated by India-based certificate authority eMudhra, Ars Technica reports. Weak private keys can allow attackers to craft forged certificates for any domain and use them to impersonate servers and intercept traffic. One of eMudhra’s CA private keys is the number 4.
Google, Mozilla, Apple, Cloudflare, and many open-source ecosystems have already issued patches and revocation lists to block the affected certificates, but many systems remain vulnerable. Cryptography engineer Filippo Valsorda told Ars Technica, “This will be a massive cleanup job, bigger than Heartbleed. There will be a very, very long tail–IoT devices, Docker containers, forgotten Linux machines, unmaintained CLI tools that shipped their own copy of the roots (which is common in some ecosystems, like Python).”
FBI suspects a second ransomware negotiator in ShinyHunters investigation.
KrebsOnSecurity reports that the US FBI suspects executives at two different ransomware negotiation firms of working with the ShinyHunters extortion group. Canadian cybersecurity executive Edward Dubrovsky was reportedly arrested earlier this month as part of the investigation.
Krebs says authorities have identified a second suspect who serves as an executive at a US-based consulting firm. Krebs hasn’t named the individual because they haven’t yet been charged with a crime, but says they work for “a prestigious firm with more than 1,000 associates.” The individual allegedly helped operate one of ShinyHunters’s victim extortion websites.
Business news: Proofpoint to acquire Varonis for $6.3 billion.
Sunnyvale, California-based email security firm Proofpoint has agreed to acquire Israel-founded, Miami-headquartered data and AI security company Varonis for $6.3 billion. Proofpoint stated, “The combined company will serve more than 16,000 enterprises and millions of organizations globally, creating one of the world’s leading pure-play cybersecurity companies and establishing the industry’s largest data and AI cybersecurity organization…Following closing, Proofpoint intends to move quickly to integrate the companies’ capabilities, align go-to-market efforts, and accelerate delivery of the combined platform to customers.”
Read more in the Business Briefing at 4pm ET.
