@davidrevoy Is this that PHP thing everyone's been talking about, or has there been *another* one? 
@ToonLink @davidrevoy 4 and the PHP RCE thing are separate. 4 was part of a weak private key in an intermediate certificate of the Indian CA eMudhra.
https://en.wikipedia.org/wiki/EMudhra#2026_intermediate_certificate_compromise