Leaderboard

Yes, server is patched... Ted.

The number 4, 🤣 The Private Key for a Globally Trusted Certificate Authority Was the Number 4 eMudhra Intermediate CA Compromise: The Trust Stores You Patched, and the Ones You Didn't Know You Had eMudhra Intermediate CA Compromise PowerShell script downloads a cryptographically verified list of compromised or impacted intermediate certificates from a remote manifest and automatically moves them into the Windows Disallowed (Untrusted Certificates) certificate store to block them system-wide. Step-by-step: Administrative & Version Safeguards (#Requires) Enforces PowerShell version 5.1 or newer and requires the script to be run with Administrator privileges (-RunAsAdministrator). If not run as admin, it halts immediately. $ErrorActionPreference = 'Stop' ensures that any minor error or failed command stops the script entirely rather than continuing silently. Temporary File Setup (GetTempFileName) Creates a secure, randomized temporary file on disk ($file) to safely store the downloaded JSON manifest and process the certificate binaries. Secure Download and Hash Verification (Invoke-WebRequest & Get-FileHash) Downloads the remote JSON manifest from [https://emudhra.we-have-a-problem.com/impacted-intermediates.json](https://emudhra.we-have-a-problem.com/impacted-intermediates.json). Calculates the SHA-256 hash of the downloaded file and compares it against a hardcoded security hash (F67B3ABE9B4...). If the file has been tampered with or modified in transit, it throws an error and aborts immediately, preventing untrusted payloads from running. Decoding and Importing into the Disallowed Store (Import-Certificate) Parses the JSON content to read the individual certificate entries. For each certificate, it strips out the PEM boundary headers and whitespace, converts the raw Base-64 text back into binary bytes, and writes them back into the temporary file. Imports each certificate into Cert:\LocalMachine\Disallowed. Moving a certificate to the Disallowed store forces Windows to explicitly untrust and block any connection or file signed by it. Cleanup (finally Block) The finally block guarantees that whether the script succeeds or throws an error, the temporary file created on disk is securely deleted (Remove-Item), leaving no residual files behind. #Requires -Version 5.1 #Requires -RunAsAdministrator $ErrorActionPreference = 'Stop' Import-Module PKI $file = [IO.Path]::GetTempFileName() try { Invoke-WebRequest -UseBasicParsing -Uri 'https://emudhra.we-have-a-problem.com/impacted-intermediates.json' -OutFile $file if ((Get-FileHash -LiteralPath $file -Algorithm SHA256).Hash -ne 'F67B3ABE9B4879F4E91874ED041BECCD71257F1DB41C588C724CCF12AA90C59E') { throw 'Manifest SHA-256 mismatch. No certificates were imported. Review the advisory before updating the pinned hash.' } $certificates = Get-Content -LiteralPath $file -Raw -Encoding UTF8 | ConvertFrom-Json foreach ($certificate in $certificates) { $base64 = $certificate.pem -replace '-----BEGIN CERTIFICATE-----|-----END CERTIFICATE-----|\s', '' [IO.File]::WriteAllBytes($file, [Convert]::FromBase64String($base64)) Import-Certificate -FilePath $file -CertStoreLocation Cert:\LocalMachine\Disallowed } } finally { Remove-Item -LiteralPath $file }

Invision Community is running on PHP it seems. @Teddy Rogers are we safe and patched?

AI tools discovered the PHP vulnerability that could take down 70% of the internet. Critical vulnerabilities in the PHP web scripting language could allow hackers to take control of any website running the widely used software, PHP’s developers said on Wednesday, as they released emergency updates that sent website owners scrambling to fix the flaws.

Update. This took a while, but I was able to generate a signing cert (.pfx file) for PE files. Won't do kernel drivers, of course, but worth the effort IMO.

Best meme even if not accurate.