Special | A Patch It Properly Week | 39

In this special hosts-only episode, Ciaran and James take stock of a very busy week in cybersecurity. In the wake of the PHP flaw revelations, the boys unpick the difference between attempted attacks and successful exploits, as well as issue an important reminder that not all serious vulnerabilities are AI-led as demonstrated by the eMudhra key leak.

Ciaran and James ask the critical question: are the alarm bells justified, or is there more nuance to the headlines? Sense checking the hype, they offer up practical advice for cyber leaders and remind us why patching it properly matters more than ever.

Highlights:

Cybersecurity leading the global news

A busy week of serious cybersecurity vulnerabilities and what they mean for cyber leaders.

PHP vulnerability flaws

• PHP devs publish critical bug fix as site owners warned: Pull 'em offline if you're unpatched | The Register
• PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | Wiz Blog | A tale of two PHP remote vulnerabilities | Calif
• PHP: News Archive - 2026 | Today's PHP Security Release, and How We're Strengthening PHP Security — The PHP Foundation
• Emergency Livestream: PHP Vulnerabilities| Moses Frost and Rich Greene

BIND flaws: ISC Patches Four High-Severity BIND 9 Flaws, Including GSS-TSIG Memory Corruption

Python flaws: Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image

js flaws: PHP was just the beginning: Node.js unveils dangerous flaws threatening millions of sites

eMudhra certificate authority key leak

• Indian certification authority eMudhra’s private keys compromised – one of them was the number ‘4’
• eMudhra Intermediate CA Compromise
• eMudhra Statement on distrust of select Global TLS Intermediate and one Root CA | Certification authority eMudhra defends its laughably weak private keys
• Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds

Log4j / Log4Shell, a historical comparison

• What the Log4j vulnerability is, who is affected
• What Happened to Log4j — A Complete Timeline of the World’s Most Expensive CVE
• Log4Shell: The vulnerability that shook the world of software development

Additional Resources

• Cybersecurity Awareness Month
• What is "p(doom)"?

Subscribe & Follow:

• Subscribe to the podcast on Apple Podcasts, Spotify, or your favorite podcast platform.
• Follow us on X, Facebook, and LinkedIn for updates.

Contact:

• Have questions or comments? Email us at cyberleadersnetwork@sans.org