A CA used it as a private key.

The php vulns were actually completely unrelated

Not related to the PHP thing. It's e-mudhra incident. They were (yes, they voluntarily shutdown their business) a Certificate Authority (Who sell SSL certificates like Cloudflare or Let's Encrypt). They generated 8 security keys that were something like 4, 8, ... Which can be guessed easily. In effect when you go to your bank's website, how do you know the website is actually your bank and not some scammer pretending to be? Based on the SSL certificate. Usually to prove this, websites use a 384-digit number that cannot be guessed easily by anybody else. '4' is easy to guess and can be used by other people to pretend to be your bank.