An Indian CA's Private Key Was Just the Number 4

A certificate authority with guessable keys, a PHP patch that took half the web offline, the AfD's mailboxes spilled, and an AI assistant that found a miner it wasn't looking for.

Welcome to Saturday. If you spent part of this week refreshing a PHP changelog or explaining to someone why their favourite site was suddenly "down for maintenance", you're in good company. This was a week about foundations: the certificates that make HTTPS mean anything, the language that still runs a huge share of the web, and the shared hosting box nobody thought much about until it became the way in.

What ties it together is age and assumptions. A certificate authority assumed its keys were random. Websites assumed their old PHP version was fine. A political party assumed one forgotten website didn't matter. The attacks themselves weren't magic. The neglect underneath them was the story. So get comfortable, and let's go through it.

1. A certificate authority's private key was the number 4

Mozilla says the private keys of 8 certificates from Indian certificate authority eMudhra were compromised, and Firefox blocked them within 3 hours. A proper key here should be a 116-digit number. One of eMudhra's was just 4, and all 8 were numbers below 256, cracked in milliseconds. In plain terms, anyone could have guessed them and forged HTTPS certificates for any website.

Two days later, eMudhra said it is quitting the TLS business, blaming social media for scrutiny "out of proportion" to a unit worth about 1% of its revenue. That framing deserves a raised eyebrow. A certificate authority isn't judged by its share of revenue but by the trust every browser places in it.

2. The AfD leak: 421,179 emails, and a lot of questions

A leak site published 421,179 internal emails from Germany's far-right AfD, including the mailbox of former leader Alexander Gauland. When we dug in, we found the site shows AI-written summaries rather than the emails themselves, the newest dated 12 September, and its own index file names a server "afd_exfil". The hacker told us they got in through a single unpatched party website: all AfD sites ran on one shared hosting cluster, so one outdated site let them escalate privileges, reach the rest and mount a mail backup. They also told us someone offered them €100,000 to take the site offline, and they refused.

By Wednesday, DDoSecrets had published the 281GB leak for anyone to download, saying the files reveal allegations of embezzlement and financial misconduct. The AfD says hackers copied only parts of a few mailboxes, most unused for years.

3. PHP's leaked flaws, and the day sites went dark on purpose

Two critical remote code execution flaws in PHP, both rated CVSS 9.2, leaked early via a Hacker News post whose author offered no evidence beyond "source: trust me, bro". watchTowr confirmed they were real, Cloudflare saw early attacks before the patch, and a public exploit appeared hours ahead of the fix. Rather than wait it out, the Dutch parliament, the Dutch NCSC, the Dutch Data Protection Authority, Finland's central government, the University of Vienna and NotuBiz, which runs council information for 100+ Dutch local governments, all pulled sites offline. 4chan went read-only and Something Awful shut its forums.

PHP shipped the fix on Wednesday at 14:00 UTC with a blunt message: "There are no complete mitigations, updating is the only safe choice." Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and know that Apache with mod_php is most at risk. The sting is in the tail: PHP 8.1 and older get no official update, and one analysis of the top 7.2 million PHP websites found 46.1% of those that reveal a version run an end-of-life branch. PHP is used in a lot of products, many of them still need to release a patch to fix the vulnerability.

4. Claude Code went looking for temperatures and found a cryptominer

A Mac user says Claude Code was helping them build a temperature monitor app when the readings looked too high. So it checked the CPU and found XMRig running at about 1175%, eating 12 cores, with the chip at 112°C.

It's a lovely little accident, and a useful one. The assistant wasn't doing security work. It just noticed numbers that didn't make sense and kept pulling the thread. That's also how a lot of good incident response starts: not with an alert, but with someone asking why the machine feels hot. If your laptop fan has been unusually enthusiastic lately, maybe have a look at what's actually running.

5. DHS appointees asked CISA to secretly hack a voting machine

DHS political appointees asked CISA to secretly obtain a voting machine and hack it. The findings were to be shared only with the White House, and the vendor was not to be told about any flaws. CISA employees feared they were being asked to take part in political interference.

Also worth your attention

Revolut's app and cards stopped working across Europe as Google Cloud's London region suffered network failures, though Revolut says money and data are safe.

The FBI arrested an 18-year-old it says swatted a girl's home for years; he used a VPN, but his Discord account was registered to his own phone number.

Linus Torvalds called rules against AI coding tools "UTTERLY STUPID" on the Linux kernel mailing list.

A South African coffee chain's CEO vibe-coded a dashboard for 132 stores that stored all its sensitive data in the login screen's source code.

Unauthenticated attackers are hijacking Plex Media Servers, with exploit code published on GitHub as exploitation began.