Three security incidents landed in the last 48 hours. Here is what actually happened, and what needs to be done. 1) The certificate incident An Indian certificate authority, eMudhra, generated weak private keys for 8 of its intermediate certificates during a key ceremony in April 2025. Anyone could recover those keys from the public certificates. Chrome, Firefox, Apple and Microsoft have now blocked them. 2) The iPhone Bluetooth flaw Apple has patched a Bluetooth flaw that could let a nearby attacker run code on iPhone 11 and later. The patch is already out, in iOS 27 and 26.7. Apple has not confirmed anyone exploited it. 3) The PHP bug Two flaws in PHP itself allow remote code execution with no login. Every PHP version back to 5.4 is affected. Patches landed yesterday. Attack attempts started before the patch did. Chrome also shipped version 156 this week, with 353 security fixes. What needs to be done: → Update your browser first → Update your phone and computer OS → iPhone 11 or later: update iOS now. Keep Bluetooth off only until you do → Update desktop apps like Slack, Cursor and Discord → Avoid untrusted Wi-Fi until your devices are updated → Ignore any email offering a "certificate fix". That is the phishing wave this incident creates → Developers: update pip, uv and npm, and update PHP. Updating is the only complete fix