Hey everyone,
I just wanted to write an open letter to anyone who sees this. If you or someone you know currently uses a website for their business, please make sure you are doing your due diligence to ensure the security and privacy of all the data going in and out of your systems. If you are unsure where to start, please reach out to the company who originally helped you deploy your website.
I use Render.com, an independent Platform-as-a-Service (PaaS), as the cloud hosting solution for my website. I just received a letter from them regarding current best practices for ensuring security, so I'd like to share what they've said with you.
"This week, major security issues were disclosed in software and infrastructure widely used across the internet. These issues may require you to update your applications. Review the guidance below and update any affected applications as soon as possible.
Render's platform remains secure, and we are not aware of any breaches or compromises. If you have already updated your applications and dependencies, you do not need to take additional action.
What's potentially affected:
1. Any application that sends HTTPS requests to destinations over the internet
2. Any application running Node.js, regardless of framework
3. Any application running PHP, regardless of framework
What happened:
eMudhra certificate compromise: On October 19, a public disclosure confirmed the compromise of private keys for eight intermediate certificates issued by eMudhra, a widely trusted certificate authority. Attackers can use these keys to impersonate websites and services to applications that still trust the affected certificates, circumventing the protection normally provided by HTTPS.
Node.js security release: On October 21, Node.js released patches for multiple vulnerabilities, including flaws that can bypass TLS certificate hostname checks and a flaw in Brotli decompression that can allow remote code execution. These releases also address the eMudhra certificate compromise.
PHP2Shell: On October 21, PHP released patches for two critical vulnerabilities discovered in the PHP runtime. These vulnerabilities can allow unauthenticated attackers to execute code on affected services or read sensitive information from memory, including passwords, tokens, and API keys. PHP applications can be affected regardless of which framework they use."
Thanks for reading. Happy patching!