I posted this to my statewide librarian mailing list yesterday and I figured I’d share it out here now that my website is back up. Thank you, ibiblio, you are a great web host.
I usually don’t give any unsolicited tech advice but I wanted to share some information about the two issues that, separately, each pose some security risks and are worth attending to.
1. “The PHP thing”
This is a good explanation in the vulnerability which was discovered in PHP yesterday. PHP is a programming language which runs a lot of content management systems (WordPress and Drupal for example). It’s worth checking to see if you have it running on any server you may control. Here’s a very technical explanation.
2. “The number four thing”
This is a vulnerability in some of the certificates which allow browsers and apps to be trusted. I heard it explained this way (Bluesky link for logged in folks) “imagine there was a password that if you guess it, you can impersonate any website on the internet, now imagine the password is literally the number 4″
All browsers have sent out an update for it (except, as of this writing, Edge on Win10), but if you have your browsers set up to require manual updating, you might want to do that ASAP. This is also true if you have any non-standard routers or other internet of things devices. Make sure things get their patches. This description of the situation isn’t great but it’s okay.
There’s a table in the middle of this page which will test to see if your browser is still accepting potentially compromising certificates (you want to see “did not connect” here, optimally)
Discover more from DrWeb's Domain
Subscribe to get the latest posts sent to your email.
