O death, where is thy sting? O grave, where is thy victory? Has anyone really been far even as decided to use even go want to do look more like? It has always been my wish to live honorably, and after my death, to leave to those who come after me my memory in good works. It all keeps tumbling down. The press is the enemy. The press is the enemy. The press is the enemy. The graveyards are full of indispensable men.

A Statement on Recent Security Events

Dear valued visitor,

At joshuagarner.xyz, we take your security very seriously. We are writing to inform you of a number of recent security incidents, all of which did not affect this website and did not involve your personal information.

What happened

On October 21st, 2026, the PHP project shipped emergency patches for two critical flaws, CVE-2026-109618 and CVE-2026-109619, which have come to be known collectively as PHP2Shell. Between them, they let anyone on the internet run their own code on a PHP server without logging in. Given that roughly 70% of websites run on PHP, it has been a long week for a lot of people, including the Finnish, French, British, Dutch, Canadian, Danish, German, and Belgian governments, the Internet Archive, Wikipedia, 4chan, Umamusume: Pretty Derby, and countless others.

Upon learning of the disclosure, the joshuagarner.xyz Security Operations Center (me) immediately (t=~100 hours) launched a comprehensive audit of the site's PHP footprint. The audit found no .php files, no PHP handler, and no PHP in general. Until this notice, the string php appeared exactly twice on the entire site, both times in links to somebody else's server: one to Wikipedia (to make it use the vastly superior Monobook style), and one to the U.S. Energy Information Administration. Those are their webmasters' problem, and I wish them a speedy patch. (This notice has raised the php count of this website considerably. None of the new ones are considered executable.) This site's own exposure has been independently rated 0.0 out of 10 by its owner.

However, PHP2Shell was not the month's only security event. October has gone badly enough that some developers have started calling it Black October, so in the interest of full transparency, the Security Operations Center has also reviewed this site's exposure to the rest of it:

The finding in every case was the same: this site does not have the thing, and by design, believe it or not. There is one exception.

On October 17th, a researcher told the browser makers that eight intermediate certificates belonging to eMudhra, an Indian certificate authority, had been made with private keys that anyone could work out. A P-384 private key is supposed to be a random 384-bit number. A 384-bit number is what mathematicians call very large and should be fundamentally unbreakable to decipher. Rather than choose a real 384-bit number like 21,624,557,249,395,640,533,163,575,211,821,301,697,565,081,823,934,031,794,964,333,816,094,212,566,042,133,759,825,504,411,186,776,287,511,282,898,639,200, eMudhra instead decided to go with 4. As in 1, 2, 3, 4.

That matters because your web browser trusts companies like eMudhra even with this website, despite the fact that it has never had anything to do with eMudhra. Someone who had guessed 4 could have signed a perfectly valid certificate for joshuagarner.xyz, and if they could also get between you and this site (on the same café Wi-Fi, say, or at your ISP), they could have posed as it: watched which pages you read, or handed you pages of their own. The keys were made in April 2025, so that window was open for up to a year and a half. There is fundamentally no action on my part that could have been taken to avoid this, even with full knowledge of the flaw. Even so, digital forensics has uncovered exactly zero documented instances of this happening to this (or any other) website.

So, to be precise: this site was exposed to exactly one of this month's security events, through a company it has never done business with, by way of a number a child could guess.

What information was involved

None. This website is a folder of hand-written HTML files, a stylesheet, and some pictures. It sets no cookies and runs no JavaScript; its Content Security Policy says script-src 'none', so it couldn't run any if it tried. It has no forms (form-action 'none'), no accounts, no comments, no search box, no database, and no login page.

An attacker who somehow managed to achieve remote code execution on this website would gain marginally more direct access to my opinions about flags, an alchemical reference table, and a cheesy poem. The one exception is eMudhra, where the most anyone could have learned is which of these pages you read. I hope it was the flags.

What we are doing

Out of an abundance of caution, I have continued not to install PHP, WordPress, npm, GitLab, Plex, or a VPN. I intend to keep not installing them for the foreseeable future, and I will continue to monitor the situation as it develops, mostly by reading about it on other people's websites. I have also continued not to buy a certificate from eMudhra, which will be easier now that they're getting out of the business.

I would also like to take this opportunity to thank this site's longstanding security partners: the <p> tag, the <a> tag, and the Tab key.

What you can do

As a reader of this site, nothing. You do not need to change your password here, because you do not have one. Keep your browser up to date, although on eMudhra it was ahead of you: the major browsers blocked the bad certificates almost immediately, and Firefox didn't even need an update to do it.

If you do have the misfortune of running a website on PHP, though, update today; someone was already trying the exploit four days before it was made public. If you can't patch right away, the UK's NCSC and the NSA have both said to take the site offline until you can. If you run anything else on the list above, go read its vendor's advisory. Alternatively, you could do what I did and have a website made of nothing.

If you would rather not extend that kind of trust to Indian certificate authorities again, here is how to stop, on the platforms that let you. Note that this breaks every website with a certificate from one of them, a list that includes the website of India's own Controller of Certifying Authorities, which also makes it a handy way to check that it worked.

Windows

$sst = "$env:TEMP\wu-roots.sst"
certutil -generateSSTFromWU $sst | Out-Null
$all = [Security.Cryptography.X509Certificates.X509Certificate2Collection]::new()
$all.Import($sst)
$store = [Security.Cryptography.X509Certificates.X509Store]::new('Disallowed', 'LocalMachine')
$store.Open('ReadWrite')
$all | Where-Object { $_.Subject -match '(^|,\s*)C=IN(\s*,|$)' } |
  ForEach-Object { $store.Add($_); $_.GetNameInfo('SimpleName', $false) }
$store.Close()

macOS

d=$(mktemp -d)
security find-certificate -a -p /System/Library/Keychains/SystemRootCertificates.keychain |
  awk -v d="$d" '/BEGIN CERT/{n++} {print > (d "/root" n ".pem")}'
for f in "$d"/*.pem; do
  openssl x509 -in "$f" -noout -subject -nameopt RFC2253 |
    grep -Eq '(^subject= ?|[^\\],)C=IN(,|$)' &&
    sudo security add-trusted-cert -d -r deny -k /Library/Keychains/System.keychain "$f"
done

Arch Linux

mkdir -p ~/ca-in
trust extract --format=pem-directory --filter=ca-anchors --overwrite ~/ca-in
for f in ~/ca-in/*.pem; do
  openssl x509 -in "$f" -noout -subject -nameopt RFC2253 |
    grep -Eq '(^subject= ?|[^\\],)C=IN(,|$)' &&
    sudo cp -v "$f" /etc/ca-certificates/trust-source/blocklist/
done
sudo update-ca-trust

Debian and Ubuntu

for f in /usr/share/ca-certificates/mozilla/*.crt; do
  openssl x509 -in "$f" -noout -subject -nameopt RFC2253 |
    grep -Eq '(^subject= ?|[^\\],)C=IN(,|$)' &&
    sudo sed -i 's|^mozilla/'"$(basename "$f")"'$|!&|' /etc/ca-certificates.conf
done
sudo update-ca-certificates --fresh

For more information

Researchers who find a real vulnerability in this website are invited to report it via security.txt. I would be very interested to hear how you did it.

Sincerely,
Joshua Garner
Chief Information Security Officer, joshuagarner.xyz


⟵ Back to the opuscula