Critical PHP vulnerabilities put millions of sites at risk.

Critical PHP vulnerabilities dubbed “PHP2SHELL” were disclosed that can enable unauthenticated remote code execution across all PHP web deployments and are already being observed in the wild, prompting immediate patching and WAF mitigations; Indian CA eMudhra exposed extremely weak intermediate private keys that could allow forged certificates and a long, widespread remediation effort; and the FBI is investigating suspected involvement of ransomware negotiators with the ShinyHunters extortion group. Business news notes Proofpoint's planned $6.3B acquisition of Varonis.