// security
$ tail -f ./security
Headlines from early disclosure channels, research labs and curated news, each with a short summary.
# Yesterday
-
eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable
eMudhra will exit its global SSL/TLS certificate business after a researcher found eight intermediate CA private keys were easily guessable.
-
I had plans for that second
The post discusses leap second abolition and critical vulnerabilities in PHP.
-
ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More
A security roundup describes AI secrets leaks, PingCAP source theft, a Signal hang-up flaw, a Laravel authentication bypass, and other software vulnerabilities.
-
Exclusive: Bipartisan bill would develop federal guidance for distillation attacks, convene industry on defensive cyber
A bipartisan U.S. bill would direct federal agencies to develop guidance on AI distillation attacks and convene industry on defensive cybersecurity.
-
Max-severity GitLab bug allows remote code execution over 12 years of releases
GitLab disclosed a critical bug enabling remote code execution affecting releases over 12 years.
-
Arista patches new VeloCloud Orchestrator zero-day exploited in attacks
Arista Networks issued security updates for an actively exploited zero-day vulnerability in VeloCloud Orchestrator on-premises deployments.
-
EMudhra Intermediate CA Certificates Compromised
Eight eMudhra intermediate CA private keys were compromised, creating risk of unauthorized TLS certificate issuance and man-in-the-middle interception.
-
Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes
Two CVSS 9.0 remote code execution flaws in Linux's KSMBD kernel SMB server were publicly disclosed before mainline kernel fixes were available.
-
The Current Landscape of OAuth Attacks
A report outlines current OAuth attack techniques and mitigation measures for organizations using authentication protocols.
-
Disgraced Indian cert issuer leaves the cert issuing business
Indian certificate authority eMudhra said it will stop issuing SSL/TLS certificates after a private key was reportedly the number 4.
-
CVE-2026-115416 - Incorrect authorization checks in Amazon Athena engine version 3 query processing
CVE-2026-115416 affects Amazon Athena engine version 3, where incorrect authorization checks could allow authenticated users to read account identifiers and SQL metadata.
-
Microsoft blames ConnectWise attacks on Chinese state hacker using ARTEX AI agents
A Chinese state-aligned hacking group used automated AI tools in a supply chain attack against IT management software provider ConnectWise and is attempting similar compromises globally, Microsoft said.
-
Meta Ordered to Pay $25 Billion After Court Finds 43 Million Privacy Violations
A New Mexico court ordered Meta to pay $25 billion after finding 43 million privacy violations in a lawsuit linked to Cambridge Analytica.
-
PHP2Shell puts dozens of UK government services out of service
A PHP-related issue disrupted dozens of UK government services, with ministers reporting 32 unavailable and four partly disrupted but no confirmed compromise.
-
Microsoft shares how to fix broken Exchange Online EWS apps
Microsoft has outlined a temporary option to re-enable retired Exchange Web Services in Exchange Online so affected applications can continue working.
-
Hackers got a four-day head start on epic PHP2Shell vulnerability
Attackers began probing a PHP vulnerability before defenders were notified, giving them a four-day head start.
-
When the attacker becomes the user: Rethinking account takeover
A sponsored feature discusses how AI makes phishing easier, prompting a reevaluation of account takeover threats.
-
Unboxing Phishing Kits: Huntress Examines 3 Real Kits
A report examined three phishing kits that provide tools for less experienced attackers to steal authentication tokens and run credential-harvesting campaigns.
-
eMudhra kills its certificate business after researchers cracked its private keys in under a second
eMudhra shut down its certificate business after researchers said its private keys were weak enough to be cracked in under a second.
-
[tl;dr sec] #351 - PHP2Shell, Autopatching Skills, AWS Pathrunner
The post covers PHP2Shell, Trail of Bits open-source skills, and AWS Pathrunner, a tool for automating AWS IAM privilege escalation path checks.
-
Machine speed attacks require machine speed detection and response
A security report says stolen GitHub tokens, malicious AI installers, and MFA phishing can enable rapid data theft before defenders respond.
-
INTERPOL Arrests 1,462 Suspects, Disrupts 10,909 Cybercrime Networks in Global Crackdown
INTERPOL announced arrests of 1,462 suspects and disruption of 10,909 cybercrime networks during Operation Serengeti III, recovering over $105 million.
-
New Serious PHP Vulnerabilities Released and Patched
PHP maintainers released fixes for two critical vulnerabilities enabling unauthenticated remote code execution in several supported versions.
-
Amazon says PHP2Shell exploitation began 4 days before patches
Amazon reports that attackers began exploiting PHP2Shell vulnerabilities four days before security patches were released.
-
ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors
A threat actor linked to Storm-0940 is using the ARTEX AI agent to target software vendors and attack Okta, Entra, and Cognito identity services.
-
Localizing compliance at scale: achieving South Korea’s ISMS certification
A South Korean ISMS certification was achieved after an audit of 80 controls, including localized consent flows and edge sign-up adaptations.
-
How do you verify AI coding agent output from any tool, not just one?
A guide describes verifying AI coding agent output using deterministic analysis, CI quality gates, and SonarQube MCP Server.
-
SonarQube container scanning is now in open beta
SonarQube has introduced an open beta feature for scanning container images to detect vulnerabilities and malicious packages as part of its Advanced Security offering.
-
M365 Token Spray and Replay Campaign Compromises Business Email Accounts
A 10-week Microsoft 365 campaign used token replay, AiTM relays, rogue Entra devices, MFA tampering, and hidden inbox rules to compromise business email accounts.
-
Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure
AWS says attacks on PHP2Shell began before disclosure, and Cloudflare reported millions of exploit attempts against the vulnerability.