Vulnpocalypse Continues Until Defense Improves – PSW #950

Paul Asadoorian

1. Defenders need more time to patch with the influx of patching hitting operations

   Summary: Cisco’s Jason Maynard argues that the growing volume of vulnerabilities is outpacing organizations’ ability to patch: he cites 1,411 flaws addressed in Microsoft’s October Patch Tuesday and says patching can take organizations up to 43 days. Cisco’s proposed stopgaps are network-layer virtual patching with Talos Snort rules and Live Protect, a temporary eBPF-based runtime shield for Cisco infrastructure. Both are meant to reduce exposure while teams prepare and deploy the permanent update.

   Paul's take: The operational problem is real, and the post is clear that shielding does not replace patching. But this is also a product pitch: Snort virtual patches only cover traffic that crosses an inspection point, and Live Protect is aimed at Cisco gear. The “1,411 patches” figure is more accurately described as vulnerabilities addressed, and the blog gives little context for its “up to 43 days” claim. Treat these controls as temporary, product-specific options, not a way around a sound patching and asset-prioritization process.

2. When AI Guardrails Expose Vulnerabilities

   Summary: CrowdStrike’s Guardrail-based Vulnerability Discovery treats an AI model’s safety behavior as a signal: if it refuses or stops reasoning when asked to explain a particular function or inspect a directory, that location may contain a dangerous pattern. By repeatedly querying and bisecting the target, the researchers say they localized flaws without asking the model to identify vulnerabilities directly. Across five vulnerability classes, the approach was correct in 73 of 86 test scenarios; examples include a subtle out-of-bounds write in a C web server and a SUID-root misconfiguration.

   Paul's take: The neat part is turning a refusal into a rough location signal: the guardrail may reveal what the model has learned to recognize as dangerous, even when it won’t explain why. But this is a side channel, not proof of a vulnerability. The reported results come from controlled tests, and false positives, false negatives, model changes, and prompt variation all matter. The same signal could help defenders find bugs, or help attackers narrow down where to investigate.

3. Broccoli2Shell (CVE-2026-111497): Where Brotli Hides

   Summary: CVE-2026-111497 is an out-of-bounds write in Google’s Brotli decoder. Semgrep traces the vulnerable decoder across runtimes, language bindings, and bundled dependencies, making this a broader inventory problem than a Node.js update alone; CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog.

   Paul’s take: The key question is whether your application actually decompresses attacker-controlled Brotli data. A vulnerable library in the dependency tree doesn’t automatically mean a remotely exploitable service, but the decoder has been copied and bundled in enough places that checking only direct dependencies will miss things. Patch the runtime or package that contains it, and check vendor advisories for bundled copies.

4. WordPress libheif RCE – FORTBRIDGE

   Summary: Fortbridge chains two libheif flaws through WordPress’s authenticated media upload and image-derivative workflow to execute id as the PHP-FPM user. Crafted HEIC images leak runtime addresses through returned JPEG pixels, then trigger a heap overflow that hijacks a C++ virtual call. The proof of concept worked against two exact Ubuntu and Debian stacks, with success in 6 of 8 and 22 of 24 fresh PHP-FPM parent-process trials, respectively.

   Paul's take: The interesting contribution is the exploit engineering: turning a native image-decoding bug into a remotely calibrated, reproducible chain, with explicit proof of command execution rather than treating a crash as success. Fortbridge did not discover the underlying flaws; the article credits Alex Thomas and Wordfence, and the exploit’s demonstrated scope is limited to two carefully matched software stacks. That makes this a strong technical case study, while a real deployment’s exposure depends on its upload permissions, image-processing path, and exact library versions.

5. Patching Before the CVE: What Fortinet’s AI-Found Flaw Release Teaches Network Teams

   Summary: Fortinet released security updates for FortiOS, FortiManager, FortiAnalyzer, FortiMail, and FortiAuthenticator after finding critical and high-severity flaws with AI-assisted testing. It scheduled the CVE IDs, severity scores, and technical advisories for November 10, leaving customers to patch based on affected product versions and release information. The post recommends inventorying devices, prioritizing internet-facing systems, backing up configurations, and checking upgrade paths and potential upgrade issues.

   Paul's take: I'm torn on this one. On one hand, I think its great that Fortinet customers gain the advantage and can apply fixed before the world knows the details. Don’t wait for a CVE score when the vendor has already identified a serious flaw and shipped a fix they said. On the other hand, asking customers to upgrade without knowing the vulnerability class or affected versions makes risk assessment and change planning harder, especially for complex networks. And once fixed firmware is available, the patch itself can offer attackers clues, so the disclosure delay may buy time, but it doesn’t make the updates invisible. Also, while Fortinet customers have the firmware updates, that doesn't make them a secret as anyone with a Fortinet account with the right permissions can access the update and there is a chance it could leak. Or, threat actors just compromise Fortinet customers or customer accounts to get the updates. Encrypt the firmware too, well, attackers have figured out how to decrypt it. It just feels like we're playing a game rather than actually trying to be more resilient.

6. InfraTrust Pulse October 2026: What to Patch First

   Summary: Eclypsium’s October InfraTrust Pulse covers September 18–October 14, tracking 133 advisories across 18 vendors and 2,813 vulnerabilities. It flags 16 advisories involving flaws in CISA’s Known Exploited Vulnerabilities catalog and spotlights active exploitation of edge and management products from Citrix, Ivanti, Check Point, Cisco, Arista, Fortinet, F5, and Palo Alto Networks. It also warns that PHP2Shell affects PHP embedded in appliance management interfaces, where customers may have to wait for vendor firmware before they can patch.

   Paul's take: The report’s most useful framing is that infrastructure management planes are high-value targets, and patch status alone doesn’t tell you whether a device was already compromised. Prioritize exposed NetScaler and Ivanti gateways, then the other affected management systems; hunt for signs of intrusion as you patch. The embedded PHP issue is the broader operational headache: even when PHP has a fix, appliance owners often can’t apply it themselves.

7. Chained PHP2Shell Exploit Roots 25 Servers

   Summary: Dream Research says it found evidence of a campaign that chained PHP2Shell with the Linux Fragnesia privilege-escalation flaw to root 24 internet-facing firewalls, then compromise an internal firewall management server, bringing the claimed total to 25. The report describes a reverse SSH tunnel into a US government-affiliated network, stolen configuration data and credentials, and Active Directory enumeration and password-spraying attempts. Dream says it found no evidence confirming whether those identity attacks succeeded. It also found Claude Code and other AI tools on the attacker’s infrastructure, but says it cannot prove AI wrote the exploits or scripts.

   Paul's take: The reported attack path is the story: an exposed firewall management interface became a route into the organization’s internal management plane and identity infrastructure. But keep the attribution and AI angle carefully qualified. The vendor, affected versions, and victim are unnamed; key post-compromise outcomes remain unknown; and the AI-use claim is circumstantial. However, I fed this to my AI and lab environment and can say with a high degree of certainty that its Palo Alto PAN-OS. PAN-OS is reported to be actively exploited with php2shell, so we know its vulnerable and being exploited. Also, if you look at all the artifacts in the article they match up to recent versions of PAN-OS. AI is very helpful and reviewed the open-source disclosures for PAN-OS and matched it to artifacts in the report. You can't hide the truth like this, who does that help anyhow? Hunt for PHP shells on PAN-OS...

8. Ghost in the PHP2Shell: Why coordinated disclosure and patching will start moving faster

   Summary: Aikido recounts the PHP2Shell disclosure: an out-of-memory issue had appeared in a 2024 audit, then Calif and Wiz independently demonstrated exploitability in 2026. After the CVE IDs leaked, PHP moved its coordinated patch release up a day; Amazon reported exploitation attempts had begun before the pre-announcement. Aikido says its own AI code analysis rediscovered the flaw within hours and argues that shorter embargoes may reduce leak risk but leave less time for vendors, distributors, and customers to prepare.

   Paul's take: The disclosure timeline shows the tradeoff clearly: advance warning helps defenders prepare, but it can also give attackers a head start, and even a short gap matters when patches and exploit work can move quickly. Keep the evidence in proportion, though: the “rediscovered in a few hours” claim comes from Aikido’s own test, and the article is also promoting its security tools and patched images. The durable advice is to inventory runtimes hidden in containers and appliances, follow reliable incident updates, and be ready to test and deploy urgent fixes.

9. Discovering and exploiting vulnerabilities in critical, real-world software with Claude

   Summary: Anthropic says an unreleased internal model helped find and exploit vulnerabilities across Chrome, Safari, Android, Windows, and Linux. The examples range from one-click Chrome code execution and Safari same-origin-policy bypass to an Android lock-screen bypass, a remotely triggered Windows crash, and a Linux kernel exploit that could execute commands as root. Anthropic says vendors have patched the reported flaws; it also reports 62 Chrome CVEs, including 13 sandbox escapes.

   Paul's take: These are concrete exploit demonstrations, but they don’t all have the same impact: a remotely exploitable crash is different from code execution, and a Linux exploit requiring a multipath TCP listener has a narrower target set. “Little to no user interaction” describes what the victim needs to do; Anthropic gives limited detail on how much human work the research and exploit development required. The post makes a strong case for model-assisted vulnerability research, but it doesn’t show that an AI can independently find and exploit these bugs at scale.

10. Linux hacking part 12: LD_PRELOAD function interposition. Simple C examples

    Summary: This post demonstrates Linux LD_PRELOAD function interposition with a wrapper around readdir(). The examples first log directory entries, then hide filenames with a chosen prefix from the application, while the files remain on disk and visible to other processes. Comparing the application’s output with strace shows where the altered view is introduced: the kernel returns the directory entries, but the preloaded library filters one before the program sees it.

    Paul's take: It’s a clear, hands-on explanation of a longstanding user-space rootkit technique, rather than a new attack. The useful distinction is that this changes what a dynamically linked process sees; it doesn’t hide the file from the kernel, and static binaries and secure-execution restrictions limit where LD_PRELOAD works.``` However, on devices where the user doesn't have kernel access, E.g. appliances, this technique is very effective and often missed unless you (or your threat rules) are looking.

11. Code-execution flaw in UEFI firmware affects most servers on planet Earth

    Summary: CVE-2026-97631 is a buffer overflow in EDK II’s PXE network-boot driver. A network attacker can trigger it with crafted ICMP error messages while an affected machine is PXE-booting, potentially reaching code execution before the operating system and its protections load.

    Paul’s take: “Most servers on the planet” oversells the exposure. A system has to use the affected EDK II code, have PXE boot enabled, and be in that brief network-boot window; this isn’t a general remote entry point into servers. Still, firmware varies across OEMs, so identifying affected models and deploying updates could take time. The upstream advisory says a patch release is not yet available.

12. A $50,000 Sony Bounty For An AI-Found PS5 Exploit Has Turned One Hacker Into The Homebrew Scene’s Most Hated Name

    Summary: A researcher known as Jordy says he used AI to find a PS5 hypervisor flaw, reported it to Sony, and received a $50,000 bounty. The report angered parts of the homebrew community because another researcher hoped to keep the flaw private until after GTA 6’s launch, preserving a chance to run Linux on updated consoles.

    Paul’s take: Drama alert! This is the collision between responsible disclosure and a community’s plans for an undisclosed exploit. Jordy says other researchers were finding the same bug, so the window to report it may have been closing; Sony’s bounty is designed to reward that choice. The article’s “most hated” framing is clickbait, and the AI angle doesn’t change the basic disclosure dilemma: the same bug can be a security risk to Sony and a valuable capability to homebrew users.

Larry Pesce

1. Mayhem Mobile: Run PortaPack Mayhem Apps on a Browser or Android with an RTL-SDR or HackRF

Lee Neely

1. Apple Patches for October 2026 – SANS Internet Storm Center

   Summary: Apple today released patches for 304 vulnerabilties. This number is still in line with prior Apple updates, and comes just about a month after the last apple update.

   Noteworthy Issue:

   CVE-2026-86950: This is an already exploited vulnerability in CoreGraphics, and was patched originally a month ago. This month's update delivers the corresponding patches for iOS 18.

   No new vulnerability is marked as already exploited.

   Lee's Take: Fortunately none of these are marked already exploited. Take note of the back-ports to macOS 15 & iOS 18; if you have devices running these old OS's, you really need to get those up to a more recent OS. Apple has updated “everything” - so make sure that you’re checking for updates on all your Apple hardware, remembering that the Safari update is separate from the OS update for anything older than macOS 27. This is the second update to macOS/iOS version 27, so it’s time to make this your minimum version.

2. Cybersecurity Issue Forces a Major New Mexico Hospital to Divert Patients and Close Clinics

   Summary: A major hospital network in New Mexico raced to fix a cybersecurity issue on Monday that forced it to send ambulances to other hospitals and left the state without an emergency department capable of treating the most serious injuries. The University of New Mexico Health System told people not to show up at its main hospital in Albuquerque and canceled appointments at its more than 30 clinics.

   Lee's Take: The good news is that UNM Hospitals are open and will resume regularly scheduled appointments and procedures October 27th., and classes are not affected at this time. The UNM news site shows a nice progression of impacts and incident response. It also includes links to social and email contacts relevant to the incident. The downside is the incident shut down the states only level 1 drama center, in addition to the UNM hospitals and about 30 clinics. Yet another reminder of the criticality of securing essential systems, particularly healthcare, it doesn’t seem like much time goes between an ever increasing litany of healthcare related breaches. While I understand how we got to this point, that doesn’t diminish the need to actively address improvements across the sector. In the meantime, we all need to double down on protecting our information. Make sure that your family members are all protected, you may have to have direct conversations with both the younger and older generations for this to sink in. Prevention is easier than cleanup/recovery.

3. State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web

   Summary: State Bank of India has identified 3,897 customer records containing personal information in a set of about 375,000 records available on the dark web, and it does not yet know where the data came from. The state-owned bank, India's largest, said in a stock-exchange filing dated October 21 that it "has experienced an incident involving the loss of certain data." The count is preliminary.

   Lee's Take: For context, SBI has about 530 million customers, making 375,000 records less than one percent. SBI is still validating the extent and legitimacy of the breach and claims of the data exfiltrated, so expect some change in the numbers, but their current processes have contained the incident. You may recall India enacted disclosure laws with very short timeframes, which SBI is following, so it’ll be interesting to see how the story changes as the investigation progresses as well is weather the involvement of CERT-In security auditors helps or hinders the process.

4. CISA publishes strategy with eye on the next four years

   Summary: CISA has published an agency strategy document titled, "CISA 2030: Defend, Harden, Prevail." The guidance is structured around these three pillars, and is motivated by a need to "transform [CISA's] operational model to advance collective cyber defense, harden infrastructure most essential to [US] national and economic security, and mobilize [CISA] partnerships to strengthen collective resilience."

   Lee's Take: The strategy is a 12 page PDF, the bulk of which is on pages 6-10 and worth a read, meeting this strategy will increase the value of CISA to all of us. My concern is weather their current budget and staffing levels will enable them to achieve the level of success needed, particularly for transitions of roles and responsibilities with typically have a peak during the process before settling into the long-term norm. NIST Strategy PDF: https://www.cisa.gov/sites/default/files/2026-10/CISA-Strategy-2026-508c.pdf

5. Cybercrime crackdown in Africa nets 1,462 arrests, recovers over USD 105 million

   Summary: INTERPOL has published an announcement describing the accomplishments of its recent cybercrime crackdown effort throughout Africa known as "Operation Serengeti III," which involved law enforcement from 21 countries and took place between June 29 and August 31, 2026. The operation targeted "cyber-enabled fraud, ransomware, business email compromise (BEC), online scams and digital extortion," and resulted in the disruption of 10,909 malicious networks, the arrest of 1,462 suspects, and the recovery of US$105 million in illicit funds. Investigators from Angola, Benin, Cameroon, Congo, Côte d'Ivoire, Democratic Republic of Congo, Eswatini, Gabon, Gambia, Ghana, Kenya, Mozambique, Nigeria, Rwanda, Senegal, South Africa, Tanzania, Uganda, Zambia, Zimbabwe, and the US first accumulated intelligence on suspicious domains, IP addresses, and command-and-control infrastructure, and were supported with analysis, operational expertise, and additional intelligence provided by private sector partners.

   Lee's Take: This is a big deal. The operation was supported by private-sector partners which included Group-IB, Kaspersky, Fortinet, TrendAI, Team Cymru, Uppsala Security, Cybercrime Atlas, Meta, the Global Anti-Scam Alliance and the Postal and Telecommunications Regulatory Authority of Zimbabwe as well as funded by the Global Action on Cybercrime Enhanced (GLACY-e) project, which is a joint initiative of the EU and Council of Europe. The message here is not only does it require international cooperation to shutdown cross border cybercrime, INTERPOL has the partnerships and funding to disrupt them, recover assets, arrest adversaries and protect communities.

6. Notice and Apology Regarding Customer Information Affected Through Unauthorized Access

   Summary: Japanese video game company Capcom has published a notice disclosing a recent breach of its CAPCOM ID membership service. On October 19, the company detected and blocked unauthorized access, implemented emergency measures, and launched an investigation into the cause, scope, and method of attack involved.

   Lee's Take: Not to diminish the impact to affected users, but 43 out of nearly 12 million exposed records containing sensitive information, let alone only 196 affected accounts, are some pretty good numbers. Capcom has setup dedicated customer support channels based on region - Japan; North, Central and South America; Europe, Middle East and Africa (EMEA); Asia (excluding Japan) and Oceania and is starting to notify affected users. They have identified the attack vector but are sill working on preventing recurrence. Given the rapid response and details already known, Capcom had very good visibility into their environment, highlighting the value of good logging and analysis capabilities. This is a good story to leverage for strengthening your argument for cyber resilience.

7. Lab testing giant Quest Diagnostics confirms patients’ personal and health data was compromised during breach

   Summary: Medical lab testing giant Quest Diagnostics has confirmed a cyberattack and data breach affecting an as-yet unspecified amount of sensitive patient information stored in its systems, according to a legally required disclosure with U.S. regulators.

   Lee's Take: There are not a lot of details from Quest, but I gotta give them credit for remediating and getting services back online quickly. Now if they can wrap up the investigation and alert affected parties as quickly, that would be precident setting. Quest Diagnostics is big, as in about 1 in 3 adult Americans use their services one way or another, similar in scope tot he Change Healthcare incident from 2024. For most of us, all we can do is make sure we have ID/Credit monitoring dialed in, and be on the lookout for increased social engineering (phishing/vishing) attempts. If you’re in the healthcare business, make sure that you’re doing everything you can for residency for when it’s your turn in the barrel.

   Quest Diagnostics post: https://www.questdiagnostics.com/links/quanum-notice

8. Warning: Multiple Critical Vulnerabilities in HPE Networking AOS, Patch Immediately!

   Summary: HPE has published a security advisory addressing 72 vulnerabilities — eight of which carry CVSS score 10.0 — that affect HPE Networking Wireless Operating Systems for Mobility Conductors, Controllers, Gateways, and Access Points, specifically ArubaOS (AOS) 8 and 10. HPE notes that "any hardware, Mobility solutions (such as conductors, controllers, and gateways), access points, or virtual machines (VMs) compatible with the affected versions are vulnerable." Of the maximum-severity vulnerabilities, three are authentication bypasses, remote code execution, unauthenticated command injection.

   Lee's Take: We’re back to apply the updates and make sure the management interfaces are locked down to authorized devices. (And make sure that you’ve got monitoring/logging dialed in.) I know it’s a pain to have to use remote access to manage infrastructure, let alone isolate it from the main networks for the business, but there is too much shenanigans and discovery is too easy to take a risk your devices won’t be identified. While you’re examining your Aruba infrastructure, make sure that you’re on supported AOS versions - You really need to be on 10.8.1+ - HPE is not reporting any active exploitation, you should be reviewing your logs for any suspicious activity, we’ve seen how that plays out before.

9. Broccoli2Shell: the Brotli decoder bug (CVE-2026-111497)

   Summary: CVE-2026-111497 Broccoli2Shell A bug in the Brotli decoder lets crafted compressed data write past the end of a buffer. Node.js, Python and anything else built on Google's C decoder needs a patch. 9.2 Critical CVE-2026-111497 Recall notice Brotli decoder 1.0.3 through 1.2.0. An out-of-bounds write that can lead to a crash, a memory leak or remote code execution.

   Lee's Take: A lesson here is that if you’re maintaining packages, think carefully about fixes and categorizing them as security updates to help prioritize the adoption of the updated package as well as increasing the visibility to the fix and it’s needed adoption. The fix is to update both your standalone packages, like Node.js and python (Brotli and brotlicffi) packages as well as packages with otherwise embed it. After updating packages be sure to restart their related processes. Both the Aikido and Broccoli2Shell[dot]com blogs are tracking updated packages/OS distributions.

   Node.js blog: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high

   aikido blog: https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497

10. Proposals for new legislation to strengthen the security and resilience of critical undersea infrastructure (CUI)

    Summary: The UK Government's Department for Digital, Culture, Media and Sport is calling for an overhaul of the legislation protecting critical undersea infrastructure (CUI), proposing modernizations for existing laws that "[have] not been updated to reflect technological advances, the growing importance of undersea infrastructure, or the evolving threat environment." The proposal's section on criminal penalties notes that "the Submarine Telegraph Act 1885 (‘STA’) remains the UK’s principal piece of legislation designed specifically to protect subsea cables from harm," and that that law's scope and penalties are no longer applicable.

    Lee's Take: Updating legislation based on updated use cases and evolving threats is important for it to remain relevant and an effective deterrent. The issues with undersea cables over the last year or two highlight the need for updated legislation, protections and consequences for this critical infrastructure. While the choice of CUI as an acronym is unfortunate for those of us working with sensitive US Government data, creating an easy label like that has advantages which may outweigh the use of an existing acronym. The proposed modernization legislation is available in both HTML and PDF form from the UK.gov site. If you are an owner or operator of underseas infrastructure, or highly dependent on it, complete their consultation questionnaire as well as the online cost impact survey.

Sam Bowne

1. Claude reveals ECDSA curve origins

   NIST P-256 curve seed is 49D3608 86E70493 6A6678E1 139D26B7 819F7E90 with no information on where it came from. People have speculated for years that there's a hidden backdoor in it. But in under half an hour, Claude discovered the origins of the NIST P-192, P-224, P-256, P-384, and P-521 seeds. None of them were the results of any hash algorithm at all, but rather the output of the C library’s lrand48 random-number generator, seeded with a Unix timestamp!

2. AI Agents as Insider Threats: Inside Microsoft’s Bet on a Unified Security Stack

   Microsoft's Project Perception adds Guardian Agents to monitor and contain anomalous AI agents, but experts warn that policing unpredictable agents with other agents may compound — not contain — the risk. It's analogous to powerful police with Flock cameras: efficient at stopping crime, but it increases the threat of dirty cops.

3. DHS bans DeepSeek products across US federal civilian agencies

   The order also covers products from the Chinese AI company's affiliates and third-party products and services built using DeepSeek technology. DHS has concerns about the Chinese government accessing DeepSeek infrastructure, collecting personal information and tracking users, and potentially transferring sensitive government data to China. The DeepSeek iOS app had unencrypted data transmissions, weak encryption algorithms, insecure local storage, user fingerprinting risks, and data sharing with ByteDance.

4. Chinese AI Model Writes More Hackable Code When Told It’s for US Contractor

   Removing its CCP alignment from the weights with behavioral unlearning made the difference vanish. In the original model, a security instruction couldn’t override a behavior that lives in the weights. After the weights were fixed, the same instruction closed the gap.

5. US Army reportedly developing program that would deploy AI agents to autonomously seek and destroy targets in enemy digital infrastructures — experts warn ECHOTRIBBLE program could have disastrous consequences

   Autonomous AI agents would function like computer worms, stealthily navigating adversary networks, moving between devices, and self-replicating across different operating systems. The agents would operate lightly in contested cloud environments and air-gapped systems alike, keeping reports minimal and concealing any required transmissions. Once an agent identifies and neutralizes a target, it would self-destruct, ideally without alerting the target or leaving any traces of its existence.

6. LLMs are making formal software verification feasible at a much larger scale

   LLMs can now produce formal proofs at large scale, enabling new software development workflows that include proven security guarantees. The formal proof guarantees that every step in software maintains compliance with security policy. The code would be perfectly bug-free. Of course, there could still be logic flaws coming from unexpected interactions with other code, and conditions thatr were not included in the security policy, but this should essentially eliminate the sort of bugs we see fixed with patches and CVE numbers.

7. Disgraced eMudhra drops out of TLS business after using cert private key of 4

   eMudhra, a certificate authority, issued eight intermediate TLS credentials so weak that anyone could mint certificates for any website or mail server--one had a private encryption key of just 4. Withdrawing from global SSL/TLS is the right decision for eMudhra and its shareholders.

8. How I got over 300 Tor exit nodes removed

   10% of Tor exit nodes were infected, intercepting SSH connections and gathering unencrypted email. The attack went on for 4 days.

9. BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations

   It undermines Microsoft Windows startup defenses, along with third-party security solutions, while maintaining long-term, covert access to compromised devices. However, successful exploitation hinges on an attacker having administrator privileges or physical access to a target host.

10. Signal Vulnerability Lets Malicious Callers Block Hang-Ups

    Affecting the open source calling library RingRTC, the bug prevented calls from ending properly. So the microphone, and perhaps even the camera, remain on when the user thinks the call has ended. The security defect was resolved in RingRTC version 2.72.0, which was released on September 4.

11. Google Chrome Adds ClickFix Warnings to Stop Users From Running Malicious Commands

    If a user copies a potential ClickFix script, the clipboard payload is scrubbed of any personal information it may contain and sent to Safe Browsing for further analysis. If the security system determines the command is dangerous, Chrome displays a warning.

12. Has OpenAI started the ‘mathpocalypse’? Experts say AI’s solving of iconic math problems may cause huge issues in the long run

    OpenAI has solved or partially solved 372 outstanding mathematical challenges. Some of the solutions, while clear, cannot be understood by some humans. Methematicians are protesting, saying this “indicated total disregard for the norms of scientific research — norms that guarantee that mathematics remains trustworthy, ethically researched, and in the public interest.”