THIS IS NOT A DRILL! – If you manage a website running PHP, today would be a very good day to pay attention.
The PHP development team has taken the unusual step of announcing 2 emergency security patches before they’re even available. Both vulnerabilities carry a severity rating of 9.2 out of 10. Security researchers warn that attackers may begin exploiting them almost immediately after the fixes arrive.
The patches are scheduled for Wednesday, October 21, at 9:00 AM Central. However, PHP maintainers could release them earlier if additional technical details leak or they detect active exploitation. [Read more…]
On Wednesday, researchers uncovered three improperly issued TLS certificates for Cloudflare’s 1.1.1.1 DNS service, encrypted DNS lookup used by millions. The concern was clear: anyone with those credentials could impersonate Cloudflare’s resolver, decrypt user traffic, or redirect queries to malicious sites.