AS Web

An alleged compromise of an intermediate certificate authority belonging to eMudhra, an Indian certificate authority, has been published on a dedicated disclosure site. If confirmed, attackers could issue fraudulent HTTPS certificates trusted by browsers, putting affected sites and users at risk. The claim is drawing heavy attention from security researchers debating its validity and potential impact.

PHP maintainers have issued a security advisory urging all users to update immediately after critical remote code execution vulnerabilities were disclosed. The flaws allow attackers to run arbitrary code on affected servers, making unpatched web infrastructure a serious risk. Developers and system administrators are being told to upgrade their PHP installations as a priority.

More than 30 UK government online services have gone offline, with four more partially unavailable, as governments worldwide scramble to respond to two critical security flaws in PHP, the widely used web programming language. Administrators are rushing to patch systems and restore public access to affected services.

UK government websites have been taken offline while potential PHP issues are addressed, according to the breaking report. The outage affects official government web pages, and the technical problem is being treated as serious enough to warrant removing the sites from public access while fixes are carried out. No details have yet been given on which departments are affected, how long the outage will last, or whether any security breach was involved.

Businesses in Singapore are being urged to act immediately on critical vulnerabilities in PHP, the widely used web scripting language. The warning says unpatched systems could expose company and customer data to attackers. Organisations are advised to update their PHP installations and review systems as a priority.

A developer has released VoidAccess, an open-source OSINT tool that turns dark web queries into a visual graph, making it easier to map connections across onion sites and forums. The project, shared on GitHub, is drawing attention from security researchers and hobbyists interested in threat intelligence and link analysis of hidden services.

Commentary circulating in India explains that the padlock symbol next to a website address no longer guarantees a site is trustworthy. The explanation notes the padlock only confirms the connection to the site is encrypted, not that the site itself is legitimate, meaning fraudsters can obtain the same certificate for fake pages. Readers are urged to verify web addresses carefully rather than rely on the padlock, especially when entering banking details.

A warning posted to Hacker News says two critical remote code execution vulnerabilities in PHP are about to be disclosed, each rated CVSS 10.0, the maximum severity score. The post gives no further technical detail or patch timeline, but the maximum rating and lack of details have prompted discussion among developers about responsible disclosure and upcoming security fixes.

A new analysis examined 217 million web responses to measure how prompt injection attacks can be carried out through HTTP headers, the metadata browsers and AI agents exchange with websites. The findings suggest that hidden instructions in headers could manipulate AI systems that browse the web on users' behalf, raising concerns about the security of AI agents and automated tools as they become more widely used.

Developers are discussing the possibility of a third critical security vulnerability in PHP, the widely used server-side scripting language. Two critical PHP flaws have already drawn attention this year, and word of another potential CVE is prompting concern because PHP powers a large share of the web. Details of the alleged bug, its severity and any fix have not yet been confirmed.

Cloud security firm Wiz has published research titled PHP2Shell, in which AI-assisted analysis uncovered critical remote code execution vulnerabilities in PHP, the language powering a large share of websites. The findings suggest that flaws chained together could let attackers run code on a majority of internet-facing servers, prompting calls for administrators to patch PHP deployments urgently.

A new web tool called Llmspeed lets people experience how fast a local large language model runs on different hardware before committing to a purchase. Users can try out realistic inference speeds for various setups, helping them decide which GPU or machine to buy for running models locally. Commenters are comparing notes on hardware choices and the difficulty of judging performance from spec sheets alone.

A developer has published an essay asking whether Ruby on Rails remains a sensible choice for web development, and the piece is drawing attention on Hacker News. The discussion comes as many teams weigh established frameworks against newer options. Readers are debating the framework's productivity benefits, maturity and hiring pool versus concerns about relevance in a market dominated by JavaScript and Python ecosystems.

Banks, businesses and government ministries across Japan took websites offline for scheduled maintenance on Thursday after the disclosure of critical security flaws in a widely used programming language that powers roughly 70% of websites worldwide. Organisations rushed to patch servers, disrupting online banking and public services while engineers worked to close the vulnerabilities before they could be exploited.

Security researchers at Wiz report that AI tools helped uncover PHP2Shell, a critical remote code execution vulnerability in PHP. The finding shows large language models being used to discover previously unknown, exploitable bugs in widely deployed software, drawing significant attention from developers and security practitioners who are debating both the flaw's severity and what it signals about AI-driven vulnerability research.

Websites and online services are rushing to fix a serious software flaw that security experts warn could put a large portion of the internet at risk. Administrators are being urged to update affected software quickly, as attackers could potentially exploit the vulnerability to compromise servers or steal data before patches are fully deployed.

The EU's cybersecurity agency CERT-EU has issued a RED alert for a critical vulnerability in PHP, the widely used server-side scripting language. RED is the agency's highest urgency level, typically reserved for actively exploited or severe flaws affecting critical infrastructure. Organisations running PHP-based websites and services are being urged to review the advisory and patch immediately.

Cloudflare has announced new protections against the php2shell vulnerability, deployed through its web application firewall. The company says the rules are designed to block exploitation attempts targeting PHP-based applications before they can reach customer servers. The move is drawing attention among security professionals tracking the vulnerability, as administrators assess whether their systems are exposed and weigh additional mitigations.

Apple has blocked security certificates issued by the Indian certificate authority eMudhra after they were found to have weak, easily recoverable private keys. The system-level block, rolled out across Apple devices, prevents attackers from using the compromised certificates to impersonate trusted websites. The move is being discussed as a routine but important step to protect users from phishing and man-in-the-middle attacks.

A new piece of experimental writing titled 'Taut dreams manifesting their own weight (were allegiances dependent)' has been published on Subspace Wagon, a small independent web platform. The fragmentary title suggests work exploring allegiance, weight and the materiality of dreams, and it is being shared alongside a cluster of related personal sites such as letters.directory and saturation.earth.

Clarivate announced that it is seeing global demand for its AI-native Web of Science research intelligence tools. The company, which tracks scholarly citations and research analytics, is positioning artificial intelligence as central to the future of research discovery and evaluation. The announcement is being circulated via PR Newswire and is drawing attention within the science and research policy community.