Eight secret keys at eMudhra, an Indian company that vouches for websites, were so weak that anyone could work them out, and browsers stopped trusting them within hours

The rest of the day

24 more stories on this beat.

Each with its own sources. None of these is a link to the story above.

1. 02

   PHP fixes due after details leak

   PHP, the programming language behind a large share of websites, said it would release fixes for two serious flaws on Wednesday at 14:00 UTC. [8] The fixes went up on GitHub, the site where PHP's code is kept, at 13:34 UTC that Wednesday, a little ahead of time. [9] It rates each flaw 9.2 out of 10. [8] The security firm watchTowr says details leaked before a disclosure that had been planned for Thursday. [8] watchTowr says the flaws let an attacker run code on a server, in PHP versions back to PHP 5, released in 2004. [8][9] Sansec, another firm, expects mass attacks within 15 minutes of the release. [9]

   Why it matters — Owners of sites built on WordPress, Drupal, Magento and other PHP software have little time between the fix and the first attacks. [9] watchTowr said it had seen no attacks when the warning went out. [8]

2. 03

   Stolen keys open WordPress sites

   TeamUpdraft, which makes UpdraftPlus, a backup add-on for WordPress websites, says someone broke into its own website over the weekend of 17-18 October. [13] It believes the intruder reached its customer database and keys for UpdraftCentral, a tool that sends commands to many sites at once. [13] Patchstack, a WordPress security firm, says attackers began using stolen keys on 18 October and planted at least 99 harmful add-ons that create administrator accounts. [13] An estimated 400,000 sites hold such a key. [13]

   Why it matters — Nethemba, a security firm, says its own fully updated sites were hit because the commands carried valid keys. [13] BleepingComputer advises updating UpdraftPlus to 1.26.13 or 2.26.13 and deleting UpdraftCentral keys on each site. [13]

3. 04

   Russian military hackers inside NATO defence firms

   Symantec, a security company owned by Broadcom, says hackers linked to the GRU, Russia's military intelligence agency, broke into three targets in NATO countries. [10][11] They were a naval shipbuilder, a maker of military aircraft engines and a police agency. [10] The group is known as APT28 or Fancy Bear. [10] At the shipbuilder, in late July, a person returned to one computer over a week, stole login material and opened a lasting tunnel into the network. [11] They left a program Symantec could not unlock, because it needs a key typed in when it runs. [10]

   Why it matters — Symantec's Dick O'Brien says the campaign gathers intelligence on European governments and defence, possibly on countries helping Ukraine. [10] He says the motive is not certain. [10]

4. 05

   FBI warns about the SafePay gang

   The FBI and cyber agencies in Germany and the UK say the SafePay ransomware gang has broken into at least 600 organisations in the US and Europe since August 2024. [12] It locks victims' files and demands a share of company revenue in cryptocurrency to unlock them. [12] It gets in by guessing passwords, using known flaws and sending phishing emails. [12] A member then phones the victim to press them to pay. [12]

   Why it matters — SafePay hit Conduent, a US firm that runs Medicaid payments and road tolls, which settled a lawsuit for $80m last week. [12] The advisory lists the flaws SafePay uses, so IT staff can check their own systems for them. [12]

5. 06

   Gangs use a firewall flaw to skip login codes

   Unit 42, the research team at Palo Alto Networks, said on Monday that ransomware gangs including Qilin and Inc are still using a flaw in its PAN-OS firewall software. [18] The company fixed it on 13 May. [18] The flaw is in GlobalProtect, the gateway workers use to reach company networks from outside. [18] Attackers use it to open a connection that skips the second login check. [18] In one case they then reached the machines that run a company's servers. [18]

   Why it matters — Palo Alto first rated the flaw medium, and Rapid7, another security firm, later found attacks going back to 17 May. [18] Palo Alto did not tell The Register how many organisations were hit. [18]

6. 07

   Meta pauses Muse share links

   Claroc, a security firm, says it found 6,800 links that people made to share conversations with Muse, Meta's AI assistant. [16][17] Each link put the conversation's title in the web address. [16] Services that record looked-up web addresses let anyone search them, so the links could be found by people never given them. [16] In a few hundred, Claroc found a loan application, a company's revenue review and a staff calendar. [16][17] Meta has paused sharing while it reviews the report. [17]

   Why it matters — People who shared a chat with one friend may have shared it with anyone who searched. [17] Claroc's co-founder says he reported it to Meta on 8 October and got no reply. [16]

7. 08

   Zeabur closes after a second break-in

   Zeabur, a service that hosts and runs developers' websites and apps, will shut down by 31 December after its second break-in in two months. [15] On 14-15 October an attacker used leaked internal logins, stored unscrambled, to read its main database. [15] That exposed 321,810 accounts and about 3.2 million stored settings, which hold keys and other secrets. [15] Zeabur says its administrator logins never expired and had not been changed since January 2024. [15]

   Why it matters — Its customers must change every secret they stored there and move their services before December. [15] Zeabur says the logins were probably taken in the August break-in, but has not confirmed it. [15]

8. 09

   Poisoned OVHcloud tool on GitHub

   OVHcloud, a large French cloud company, says attackers took over a developer's account on GitHub, where programmers store code, and swapped five releases of its command-line tool, used to manage cloud services. [14] The fake versions, 0.11.0 to 0.15.0, appeared at 14:47 on 19 October and were blocked at 16:21 after a customer reported them. [14] The malware searched the computer for stored secrets. [14] A GitHub setting that stops old releases being changed had been off, and OVHcloud has now switched it on. [14]

   Why it matters — Chief executive Octave Klaba says anyone who ran a fake version should change every secret on that machine. [14] Researchers link the attack to GlassWorm, a group that has poisoned developer tools since late 2025. [14]

9. 10

   970,000 Medi-Cal members' details exposed

   Paradigm Healthcare Services, which handles billing for Medi-Cal, California's health programme for people on low incomes, told US health regulators a break-in affected more than 970,000 people. [22] Intruders were in its network from 8 to 15 October 2025. [22] In August 2026 it worked out that names, dates of birth and Medi-Cal ID numbers were reached. [22] Letters went out in September, about 11 months after the break-in was found. [22]

   Why it matters — Paradigm says it has seen no fraud, but it has not said how the attackers got in or whether data left. [22] The regulators' public list of health-data breaches also shows two other recent ones, at a law firm and a pharmacy. [22]

10. 11

    Attack code out for a Fortinet flaw

    Horizon3.ai, a security firm, has published working attack code for a critical flaw in FortiSIEM, a Fortinet product that gathers a company's security alerts. [19] Fortinet released the fix last week and the flaw is rated 9.4 out of 10. [19] It lets someone with no login write files on the system and then run their own commands. [19] Owners of FortiSIEM 7.5.0 are told to move to 7.5.1 or later, and 7.6 is not affected. [19]

    Why it matters — Anyone who has not installed last week's fix now faces a flaw whose attack steps are public. [19]

11. 12

    Gift cards stolen through Staples' help desk

    A Chinese crime ring got into Nexus, an internal customer-service system, and issued itself more than 15,000 gift cards worth over $5m, the tech site Tom's Hardware reports, citing the news site 404 Media. [38] 404 Media identified the victim as Staples, the US office-supply chain, though the court papers do not name it. [38] The break-in was in 2023 and came out when a search warrant was unsealed last week. [38] Staples thought Nexus could not be reached from outside its network, but the gang took over staff members' logged-in sessions. [38]

    Why it matters — Shops where the cards were spent carried losses, including $226,000 at Lowe's and over $140,000 at Target. [38] Tom's Hardware says the same group stole more than $100m in gift cards in all. [38]

12. 13

    'Password1' left in place for 12 years

    The ICO, the UK's data protection regulator, reprimanded Data Cymru, which helps Welsh public bodies use data, and Ogi Networks, its IT supplier. [21] In November 2024 an attacker got in through a test account called Test2, set up in 2012 with the password 'Password1'. [21] The attacker copied 42 GB of data and locked 182.7 GB with ransomware. [21] Personal data on 3,300 people, mostly children, was taken. [21]

    Why it matters — The administrator accounts on three systems shared one password, so one break-in opened all of them. [21] The ICO said neither body had a routine for removing old accounts, and it issued reprimands rather than fines. [21]

13. 14

    EU law will not force a fridge fix

    ENISA, the EU's cybersecurity agency, says the bloc's new Cyber Resilience Act makes makers report attacks on products they no longer support, but not fix them. [24] It answered after this month's attack on internet-connected fridge controllers in French supermarkets. [24] Copeland and Danfoss, two of the makers, say the controllers hit are old models they no longer support. [24] Paris prosecutors estimate about 700 victims, and nobody has claimed the attack. [24]

    Why it matters — Shops still running the old controllers must cut them off the internet themselves, as France's cyber agency ANSSI has urged. [24] The duty to fix covers only products sold from December 2027, during their support period. [24]

14. 15

    23andMe's old company pays California $6m

    Chrome Holding Company, the company that used to be 23andMe, the DNA-testing firm, agreed to pay California $6m over a 2023 breach. [23] That breach exposed data on nearly 7 million people. [23] California's attorney general, Rob Bonta, said the company failed to keep genetic data safe and cannot escape the law by going bankrupt. [23] The deal still needs a US bankruptcy court's approval. [23]

    Why it matters — Customers keep the right to have their data deleted and their saliva samples destroyed. [23] 23andMe had already settled with 42 other US states for $18m in July. [23]

15. 16

    Eight years for a tax-office hacker

    A US judge sentenced Chukwuemeka Amachukwu, a 40-year-old Nigerian, to eight years in prison. [25][27] His group sent trick emails to staff at US tax-preparation firms from 2019, planted malware and stole data on at least 800 customers. [26][27] They used it to claim $8.4m in false tax refunds and got $2.5m. [26] He was arrested in France in 2023 and sent to the US in 2025. [27]

    Why it matters — He must repay about $3.6m and give up nearly $11m. [25] His partner Kingsley Utulu was sentenced to five years in June. [26]

16. 17

    Guilty plea over soldiers' stolen details

    Robert Boling Jr., a 45-year-old American who lived in the Philippines, pleaded guilty to a five-year scheme that stole from thousands of US soldiers and veterans. [28] Prosecutors say a partner who managed US Army medical records in South Korea passed him their personal details. [28] The group used them to get into bank accounts and take money and veterans' benefits. [28] The Philippines deported him to the US in May. [28]

    Why it matters — He faces up to 40 years in prison. [28] Two other people charged in the case are still at large. [28]

17. 18

    China answers the US DeepSeek ban

    China's foreign ministry said on Tuesday that the US was stretching the idea of national security. [34][35] It spoke a day after a US order banning DeepSeek's AI products from civilian government agencies was made public. [34] DeepSeek is one of China's best-known AI companies, and its models are mostly free to use. [34] The order, issued in July, also covers other firms' products built on DeepSeek, and the US says Chinese authorities could reach data on its servers in China. [34][35]

    Why it matters — China's commerce ministry asked the US to withdraw the ban. [35] The two countries' leaders are due to meet in mid-November, with AI expected on the agenda. [34]

18. 19

    Steps for AI helpers that go wrong

    NIST, the NSA and CISA, three US government agencies, published ten practices for handling AI agents, programs that act on their own, when they behave in ways nobody intended. [30] The practices fall into five stages: prepare, detect, respond, recover and report. [30] They include telling the public what happened, as early as possible. [30] On the same day Microsoft announced controls that give a company's agents almost no access at first, then grant it one task at a time. [31]

    Why it matters — Hayete Gallot, who runs Microsoft's security business, says companies trust their own agents by default even though the agents often have too much access. [31]

19. 20

    UK finance regulator wants AI near-misses reported

    The FCA, which regulates UK banks and investment firms, wants firms to report serious AI failures and near-misses, not only major incidents. [32] Jessica Rusu, a senior FCA official, said badly run AI can harm customers and open cyber weaknesses faster and at greater scale. [32] Last week the UK's AI minister, Kanishka Narayan, said the UK government is looking at near-miss reporting across essential services. [32]

    Why it matters — Steven Adler, of the nonprofit Guidelight AI Standards, told MPs last week that AI could learn from aviation, where reporting near-misses is required in most countries. [32]

20. 21

    curl moves small flaw reports into the open

    curl, a free, open-source tool for moving data over the internet, will take reports of low and medium flaws in public from 26 October. [20] Only high and critical flaws will stay private until fixed. [20] Its lead maintainer, Daniel Stenberg, says a flood of reports, many made with AI, has overloaded the small team. [20] He says more than 90% of reports in recent years turned out to be less than high. [20]

    Why it matters — Stenberg says working in public lets more people check reports and write fixes. [20] He accepts it also gives attackers more time with the less serious flaws before fixes arrive. [20]

21. 22

    $10m for small US utilities' defences

    Accenture, the consulting firm, Dragos, which protects industrial systems, and the SANS Institute, a security training body, launched the Community Cyber Resilience Foundation on Tuesday. [29] It puts about $10m of money and services into free security tools, equipment and training. [29] The first phase covers up to 500 US water, power and gas utilities with yearly revenue under $100m. [29] The firms say over 97% of US utilities fall under that line. [29]

    Why it matters — Dragos chief Robert M. Lee says attackers are aiming at utilities while many small ones cannot defend themselves. [29] Accenture agreed four months ago to buy a majority stake in Dragos, whose software each utility will get. [29]

22. 23

    Chrome adds a 'suspicious site' warning

    Google is adding a second, milder warning to Chrome for websites that look like known phishing, malware or scam sites. [33] It appears as a pop-up over a darkened page and lets the user mark the site as safe. [33] Chrome's red full-screen warning stays for sites Google is more sure are dangerous. [33] The new warning works only when Chrome's Enhanced Protection setting is on. [33]

    Why it matters — Google calls the suspicious label less certain, so some safe sites will be flagged by mistake. [33]

23. 24

    Start-up blames a rival for hacking attempts

    IQ.Lvbs, a small start-up making self-driving software, says someone tried to steal its new driving model and users' files from 7 to 14 October. [36] It says the first attempts came from an internet address belonging to Comma.ai, a bigger company whose camera hardware the model needs. [36] Its team was also banned from Comma.ai's Discord chat on 8 October. [36] Comma.ai did not answer The Register's questions. [36]

    Why it matters — A message said to be from Comma.ai's technology chief suggested IQ.Lvbs's model was built on Comma.ai's own, which IQ.Lvbs denies. [36] IQ.Lvbs says it is weighing legal action. [36]

24. 25

    UK keeps building parts of digital ID

    The UK government dropped its plan for a national digital ID card, but officials told MPs on Monday that work on GOV.UK One Login and a digital wallet goes on. [37] One Login already lets people prove who they are to government services online. [37] More than 80 kinds of documents are planned for the wallet, including driving test certificates and criminal-record checks. [37]

    Why it matters — Officials say One Login is not the same as a national ID scheme. [37] Sarah Green, a Liberal Democrat MP, asked whether the parts of a digital ID were still being built. [37]