Light

Episode #1102 Quiz

A Strategic Plug Pull
Date: 2026-10-27 | Length: 2.5 hrs | Episode page at twit.tv

About this episode

PHP bugs introduced in 2012 enabled unauthenticated remote code execution across default configurations, exposing millions of hosts and many end-of-life branches. AI-assisted researchers found and privately reported the flaws, enabling coordinated fixes, WAF mitigations, and temporary service shutdowns. The episode stresses rapid patching, attack-surface reduction, and offline containment for emergencies.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what practical consequence did the PHP Foundation cite for moving the coordinated release forward by one day after the embargo leak?

Question 1

According to the episode, what practical consequence did the PHP Foundation cite for moving the coordinated release forward by one day after the embargo leak?

It allowed the project to avoid publishing any pre-announcement before the final patch window. It prevented attackers from studying the patched binaries until all vendors had fully rolled out updates. It ensured that no distributor needed to repackaging the patched branches for older releases. It kept distributors time to package the fix so users would still have a simple update path.

Question 2: What did VulnCheck report about the exploitability of the PHP flaws on ASLR-enabled systems?

Question 2

What did VulnCheck report about the exploitability of the PHP flaws on ASLR-enabled systems?

Their initial access team had a working RCE exploit for CVE-2026-109618 on x86-64 with ASLR enabled. Their exploit worked only against end-of-life PHP branches with no official patched release. Their exploit only worked after ASLR was disabled and only on 32-bit PHP builds. Their exploit required authenticated access and failed against pre-authenticated targets.

Question 3: What chain of events did the episode describe as contributing to accelerated PoC development after the leak?

Question 3

What chain of events did the episode describe as contributing to accelerated PoC development after the leak?

A mistaken video publication by Calif showing its proof of concept working against multiple targets. A Chainguard blog post that disclosed technical internals before the coordinated release. A PHP Foundation bulletin that formally published the two CVE identifiers early for all vendors. A CISA advisory that included full exploit code and complete target details.

Question 4: Which response did the episode describe as a European-style 'strategic plug pull' during the PHP incident?

Question 4

Which response did the episode describe as a European-style 'strategic plug pull' during the PHP incident?

Disabling all TLS certificate validation until the incident was publicly resolved. Taking PHP-based Internet services offline until the affected systems could be patched. Redirecting all PHP traffic through Cloudflare without applying any local updates. Blocking all outbound Internet access from end-user browsers until new browser builds shipped.

Question 5: What did the episode say about the weakest eMudhra private keys that were discovered?

Question 5

What did the episode say about the weakest eMudhra private keys that were discovered?

They were all 256-bit keys that had been duplicated across several intermediate certificates. They were uniformly 16-bit keys that mainly affected browser certificate transparency logs. They were full-length P-384 keys whose entropy was reduced only by weak RNG timing. They ranged from 3 to 8 bits, including values such as 4, 56, 66, and 115.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.