Autor Cointelegraph By Felix Ng

The PHP Foundation has acknowledged that indecision and a shortage of resources delayed a fix for a critical security flaw first identified in 2024, calling the stalled response a “structural failure.” Government agencies and other organizations worldwide took websites offline Wednesday as a precaution while PHP released emergency patches for two related critical vulnerabilities. The flaws could allow unauthenticated attackers to execute code on affected servers without logging in. PHP is a programming language widely used to power websites and web applications, including content management systems. In a blog post following the release of the patch, the foundation described how its developers first found signs of the vulnerability in 2024, but struggled to come up with a solution without disrupting the large ecosystem of software built using PHP.“Combined with the lack of a known path to remote code execution and the small team of core developers with the necessary deep knowledge of the engine occupied with many responsibilities, this decision process caused work on a fix to stall and restart repeatedly over months,” said the foundation.“We won’t pretend otherwise: the delay was a structural failure, caused by both the security team’s decision process and its lack of resources.”The foundation was pointed to the vulnerability again on August 11, after security firm Calif and OpenAI independently reported the same underlying issue, with Calif demonstrating unconditional remote code execution, which made it a top security priority. Websites go dark amid PHP security scareThe disruption stretched across the world as developers disconnected websites while preparing to install the emergency fixes.The Netherlands shut its digital identity service, and the country’s National Cyber Security Center also took its website offline. Finland’s state IT provider Valtori disconnected government public web services, while France’s Interior Ministry temporarily took prefecture websites offline. Germany’s federal IT provider ITZBund also disabled several websites, according to Reuters. In Australia, the Australian Signals Directorate acknowledged that its cybersecurity website, cyber.gov.au, was among government sites affected by the PHP issue.Japanese Prime Minister Sanae Takaichi took to X to urge website operators to prepare to apply the patch as quickly as possible. In a post, she said temporarily suspending website functions could reduce the risk if the patch couldn’t be applied immediately. The Wikimedia Foundation, which operates Wikipedia, said it took some supporting services offline as a precaution, including Toolforge and Cloud VPS, which host tools and projects used by volunteer developers, leading to parts of Wikipedia going offline on Wednesday. Blockchain security firm SlowMist said its MistEye service surveyed PHP use across the crypto industry, urging exchanges, DeFi platforms and wallet providers to review their exposure and upgrade. It identified 793 domains with direct PHP fingerprints among 1,488 domains assessed.Intersect, a membership organization supporting the Cardano blockchain’s development and governance, said it had temporarily taken its Members Area offline while it assessed potential exposure. The page is still offline at the time of writing. Related: Tech giants rush to block 8 eMudhra certs that could enable fake sites Coinbase chief security officer Jeff Lunglhofer said the company found no evidence of any exposed PHP instances. “Whenever we hear about vulnerabilities like this, we automatically conduct a full sweep to make sure everything is as safe as we can make it. We’re also working with our third party suppliers for extra assurance.”Digital asset infrastructure company BitGo also said its platform was unaffected by the PHP vulnerability. Meanwhile, Binance co-founder Changpeng Zhao warned internet users on Wednesday to be “extra careful” visiting any website in the next few days, as some web administrators may not be up-to-date with security patches. OpenAI has released a Codex skill to help website operators check for potentially vulnerable PHP versions and identify applicable updates, which can be accessed via GitHub. The PHP security team said it has not identified any functional exploits at the time of its public disclosure. Magazine: 5 alternatives to Ledger to store your Bitcoin

Tech giants have deployed emergency blocks against eight vulnerable digital certificates that could allow attackers to impersonate legitimate websites.By Tuesday, browser developers and other major technology companies had deployed protections against eight intermediate certificates issued by India-based certificate authority eMudhra Limited after discovering that their private keys were insufficiently secure. Mozilla cryptography engineer Dennis Jackson wrote in an incident report that Mozilla independently recovered the private keys when it first received notice of the flaw on Saturday, confirming that the key-generation process was “flawed” and “trivial to exploit.” An attacker who intercepts a user’s connection could use fraudulent certificates to impersonate a legitimate website and potentially read or alter the information exchanged, according to Mozilla.While many companies quickly blocked the affected certificates, the threat remains for applications and systems that don’t receive those blocks automatically.In a blog post on Tuesday, Mozilla Firefox’s security team said it received the report on Saturday and responded by blocking the affected certificates in Firefox using OneCRL, which it completed the same day. It then released an update for its browser on Desktop and Android, protecting users with custom settings that prevented them from receiving the OneCRL update. Cloudflare said it became aware of the report on Monday and released updates for its Cloudflare One and WARP Clients and Cloudflare Tunnel on Tuesday, alongside mitigations across its services. Jackson said that the certificates have also been blocked in Chrome since Saturday, on Apple devices since Monday and on Microsoft platforms since Tuesday.“The issue was responsibly disclosed to downstream trust stores on the 19th of October. Many have already released updates or are in the process of releasing updates,” he said. Related: Hugging Face hack exposes the open-weight AI cybersecurity paradoxJackson said there is no evidence that Firefox, Chrome, Edge and Safari have been attacked this way, as there were no entries in the certificate transparency logs for the intermediate certificates since April 2025. “However, many clients outside of the browser ecosystem do not enforce Certificate Transparency. We do not know if attackers exploited the flawed key generation to target these clients,” he said. The incident recalls a breach of DigiNotar in 2011, a major cyberattack where hackers compromised the Dutch certificate authority, issuing 531 fraudulent SSL certificates. The rogue certificates allowed threat actors to pose as Google and spy on approximately 300,000 Iranian Gmail accounts.Magazine: Agents can trade 24/7 — but Yat Siu warns you could lose access at any time

Layer-1 blockchain Qubic has restarted its network and launched a recovery process after a wallet seed vulnerability allowed an attacker to drain roughly $1.4 million in QU tokens from 1,404 accounts, according to the project’s latest update.Qubic’s blockchain explorer shows the network resumed processing ticks 8:00 pm on Oct. 19, advancing beyond tick 85,371,949, where it was halted on Sunday.Qubic said its network validators, known as Computors, had approved a recovery plan and that the project had launched a claims platform for affected wallet holders.Affected users can check their address and submit a claim through Qubic’s reclaim platform. Affected users have until May 1, 2027, to submit claims, according to Qubic.The network was halted Sunday to prevent further movement of stolen funds after attackers exploited predictable wallet seeds generated by vulnerable wallet software.The vulnerability affected wallet seeds generated using Qubic’s web wallet on certain Apple devices and browsers, where an insecure random-number generator could produce predictable seeds. Qubic on Sunday said it had fixed the seed-generation flaw in the latest version of its web wallet. “If you created your wallet with the Qubic web wallet before version 4.26.4 (released 19 October), treat it as insecure, even if your funds were never touched,” said Qubic on Tuesday.“Update to web wallet 4.26.4 or later, then create a new wallet,” said the team. “Move your funds to the new wallet as soon as you can, and never use the old one again.”Related: Qubic freezes chain after attacker drains 1.4K wallets with weak seeds

Crypto exchange Bitget has announced plans to acquire Thailand’s GMO-Z.com Cryptonomics, seeking to expand its Southeast Asia footprint weeks after a major hack impacting its hot and warm wallets. The proposed transaction involves BTGT Management (Thailand), a company in which Bitget says it holds an interest, according to an announcement shared with Cointelegraph.  The acquisition will allow Bitget to introduce its trading platform to Thai users.“Thailand is an important part of Southeast Asia’s digital asset landscape, and this acquisition gives us a great opportunity to establish local operations in a thriving country,” said Bitget CEO Gracy Chen.GMO Internet disclosed the proposed sale to BTGT Management in a Sept. 24 filing, targeting completion for Oct. 31. Bitget’s announcement identifies its involvement in the transaction. The company declined to comment on how much interest in BTGT Management the company holds and the financial and ownership terms of the proposed acquisition. GMO-Z.com Cryptonomics operates Z.com EX, which launched in February 2021. Thailand’s Securities and Exchange Commission lists the company among its licensed digital asset exchange operators.Related: Thailand crypto ETFs may see slow start despite new rules: CoinSharesCompletion remains subject to regulatory approval and other conditions. Thai expansion comes weeks after hackThe proposed deal follows a Sept. 24 attack on Bitget’s hot and warm wallet infrastructure. In its account of the breach, Bitget said approximately $388 million was affected after attackers exploited a vulnerability in a third-party security product and issued fraudulent withdrawal commands.Bitget said customer account balances were unaffected and that it completed the phased restoration of withdrawals on Oct. 2. On Oct. 17, Bitget also announced plans to discontinue services for certain users, describing the move as a “one-off exercise.”Bitget’s terms of use, updated Oct. 16, list Russia, Belarus and Kazakhstan among its prohibited jurisdictions. Thailand is also listed as a prohibited jurisdiction, although the proposed acquisition could provide Bitget with a route to serving the market through a locally licensed operator. Magazine: Scammer loses $4.8M stored on tampered Ledgers: Asia ExpressCointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.