Just think about all the folks downloading the PHP patches through a connection that is part of MITM attack, because their curl or whatever is still using the emSign Root CA. #php2shell
@mechko and on VMs the attacker broke out of using the recent Linux-KVM hole so the attacker now controls the hypervisor anyway
