Two unrelated security incidents have exposed weaknesses in widely used internet infrastructure. Eight intermediate certificate authority keys belonging to eMudhra have proved trivially recoverable, while critical vulnerabilities in the PHP runtime could allow attackers to execute code on web servers without authentication. The discoveries, disclosed between 17 and 21 October 2026, have prompted emergency action by browser developers, software maintainers and security researchers. While major browsers have already blocked the compromised certificates, other software and embedded devices may remain exposed until their trust stores are updated. eMudhra certificate compromise exposes cryptographic weakness India-based certificate authority eMudhra generated eight intermediate certificates using elliptic-curve private keys with almost no randomness. Although the certificates employed the NIST P-384 algorithm, their private keys were integers smaller than 256, rather than cryptographically random values drawn from the algorithm’s much larger key space. Six affected intermediates were intended for Transport Layer Security (TLS) certificates, while two were used for code signing. Anyone who recovered the keys could potentially issue fraudulent certificates for websites or software, enabling impersonation or man-in-the-middle attacks against clients that continued to trust them. A researcher identified as Wayne reported the problem on 17 October. According to Mozilla’s incident investigation , the compromised keys originated from a certificate-generation operation conducted on 30 April 2025. Mozilla independently recovered the private keys shortly after receiving the report. eMudhra attributed the problem to an error involving a script used during key generation. The company said the affected intermediates had seen little or no production use, and no malicious exploitation has been confirmed. eMudhra certificate compromise creates an update problem Google Chrome and Mozilla Firefox blocked the affected certificates on 17 October using remotely distributed certificate-revocation mechanisms. Apple and Microsoft subsequently implemented protections. However, operating systems, command-line utilities, containers and embedded devices frequently use certificate stores that are updated less regularly. Some also fail to check whether an intermediate certificate has been revoked, potentially leaving them vulnerable despite the browsers’ response. Google has additionally announced plans to remove the emSign ECC Root CA – G3 certificate from its root store, with deployment to affected devices expected from 27 October. This will also affect legitimate certificates relying on that root, requiring some website operators to replace their certificates. PHP2Shell vulnerabilities threaten web servers The second incident concerns PHP2Shell, a collection of memory-safety vulnerabilities in the PHP interpreter. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, have a maximum reported CVSS severity score of 9.2. Researchers at Wiz and Calif, working alongside OpenAI and the PHP security team, identified weaknesses in how PHP handles memory when requests terminate abnormally. The resulting corruption can allow attackers to access sensitive process memory or execute arbitrary code remotely. In its technical analysis , Wiz demonstrated unauthenticated remote-code-execution attacks against WordPress, Drupal and Joomla installations. The vulnerabilities reside in PHP itself rather than the applications, meaning that other PHP-based services may also be affected. The researchers report that AI tools substantially reduced the effort required to construct and adapt complex exploit chains, making previously difficult memory-corruption vulnerabilities more practical to exploit. Emergency PHP security updates released The PHP development team published emergency security releases on 21 October after information about the vulnerabilities circulated ahead of t