Two simultaneous security shocks dominated the day: PHP shipped a pre-announced security release window after two critical remote-code-execution flaws (CVSS 9.2) were embargoed but effectively leaked when CVE hints and exploit chatter spread via LLMs and social posts - one exploit later retracted. The PHP security team preserved an orderly disclosure, but the real risk lies in who receives updates: only PHP 8.2-8.5 are supported, while PHP 8.1 and older are EOL. WordPress usage data shows 35.1% of WordPress sites run unsupported PHP and 16.46% still on 7.4, leaving a huge installed base exposed. Hosts and governments took sites offline; Cloudflare deployed WAF stopgaps; Node.js explicitly declared EOL versions affected by security releases, forcing an operational choice about whether to patch unsupported branches as Microsoft once did for XP.
A separate crisis exposed a deeper trust failure: eight intermediate emudhra (emSign) CA private keys were trivially small (values under 256), including one equal to 4, and had been trusted since a key ceremony on 30 April 2025. Browsers blocked those intermediates within hours of disclosure, Mozilla removed the root, and Go released updates hard-blocking the keys; about 30,000 certificates require migration. eMudhra blames a key-generation script flaw and misused labels despite HSM claims. There is no local patch for site owners - only distrust and trust-store updates - and many clients (curl on macOS, container images, IoT, old Go binaries) will remain vulnerable until rebuilt or updated.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A PHP vulnerability currently has no working exploit, despite many fake PoCs circulating online. LLMs have falsely been portrayed as able to develop exploits, but practical testing shows no effective attack exists yet. (eliastaylor.com)
The Trump administration denaturalized two individuals who obtained U.S. citizenship by hiding their criminal activities. The move aims to revoke citizenship from those who gained it through fraudulent means. (justice.gov)
Meta's new enterprise terms state that if its AI makes a mistake, the customer is legally responsible. The terms also expand liability to content from partners and give Meta rights to scrape and use user content. (cio.com)
A vulnerability in HTTP/3 implementations allows remote clients to cause servers to allocate excessive memory by exploiting QPACK header compression. Seven of ten tested implementations are vulnerable, with some already patched to prevent resource exhaustion. (foxio.io)
Oracle has issued a security alert for CVE-2026-91403, affecting multiple Java and GraalVM products. Patches are available for supported versions, and Oracle recommends upgrading to ensure security. (oracle.com)
Help desks are increasingly targeted by social engineering attacks to reset MFA accounts. Effective verification methods for remote staff and contractors are being explored to prevent breaches. (news.ycombinator.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.