Cyber, in brief

eMudhra, an Indian company that vouches for websites' identities, had eight secret signing keys so weak that anyone could work them out. [1][4]

Such a company is called a certificate authority. Whoever held one of these keys could sign a certificate for any website, and a browser would accept it as real. [4][3]

Mozilla says each key was a number smaller than 256, so anyone could find it by trying 256 numbers. [1] One key was the number 4. A proper key of this kind is a random number about 116 digits long. [3][2]

eMudhra told Mozilla that a script error in April 2025 made a second set of weak keys. [1] Those were picked by mistake because their labels looked like the right ones. [1]

A researcher known only as Wayne found the weakness on 17 October while scanning public certificate data. [1] He proved it by signing the line 'We have a problem here - Wayne' with each of the eight keys. [4][5]

Scott Helme, another security researcher, wrote that he worked out all of the keys from their public certificates on his laptop in under a second. [3]

Chrome blocked the six keys used for websites 100 minutes after the report reached it, and Firefox did so within about three hours, with no update needed. [4] Apple followed on 19 October and Microsoft on 20 October. [4]

eMudhra revoked the eight certificates and says most were never used, with no sign of misuse found. [1] Chrome's team says no website certificate made with the keys was listed in the public logs that Chrome requires, so Chrome would not have trusted one. [4][5]

Those logs are a public list of every certificate a browser trusts. They help only if someone watches them, and they show a bad certificate only after it has been made, Ars Technica notes. [2]

Programs that do not read the browsers' block lists keep trusting the keys until they are updated, including Python's certificate list, Linux systems and many home devices. [4][2] Go, a programming language, released a fix on 20 October, but every program built with it must be rebuilt. [6][5]

Filippo Valsorda, who maintains Go's encryption code, told Ars the cleanup will be bigger than Heartbleed, a 2014 flaw that took years to repair. [2] Using a fake certificate needs an attacker between a user and a website, such as someone controlling a cafe's Wi-Fi. [2]

Mozilla removed eMudhra's emSign ECC Root CA - G3, the master certificate above the eight, from its trusted list. [4] Chrome will remove it too and is reviewing eMudhra's other master certificate. [4]

Why it matters. Watch how fast the slower software follows the browsers: Node.js, a tool for running web programs, and the Debian and FreeBSD systems had no fix on 20 October. [1] Chrome has still to decide on eMudhra's other master certificate. [4]

PHP, the programming language behind a large share of websites, said it would release fixes for two serious flaws on Wednesday at 14:00 UTC. [8] The fixes went up on GitHub, the site where PHP's code is kept, at 13:34 UTC that Wednesday, a little ahead of time. [9] It rates each flaw 9.2 out of 10. [8] The security firm watchTowr says details leaked before a disclosure that had been planned for Thursday. [8] watchTowr says the flaws let an attacker run code on a server, in PHP versions back to PHP 5, released in 2004. [8][9] Sansec, another firm, expects mass attacks within 15 minutes of the release. [9]

Why it matters. Owners of sites built on WordPress, Drupal, Magento and other PHP software have little time between the fix and the first attacks. [9] watchTowr said it had seen no attacks when the warning went out. [8]

TeamUpdraft, which makes UpdraftPlus, a backup add-on for WordPress websites, says someone broke into its own website over the weekend of 17-18 October. [13] It believes the intruder reached its customer database and keys for UpdraftCentral, a tool that sends commands to many sites at once. [13] Patchstack, a WordPress security firm, says attackers began using stolen keys on 18 October and planted at least 99 harmful add-ons that create administrator accounts. [13] An estimated 400,000 sites hold such a key. [13]

Why it matters. Nethemba, a security firm, says its own fully updated sites were hit because the commands carried valid keys. [13] BleepingComputer advises updating UpdraftPlus to 1.26.13 or 2.26.13 and deleting UpdraftCentral keys on each site. [13]

Symantec, a security company owned by Broadcom, says hackers linked to the GRU, Russia's military intelligence agency, broke into three targets in NATO countries. [10][11] They were a naval shipbuilder, a maker of military aircraft engines and a police agency. [10] The group is known as APT28 or Fancy Bear. [10] At the shipbuilder, in late July, a person returned to one computer over a week, stole login material and opened a lasting tunnel into the network. [11] They left a program Symantec could not unlock, because it needs a key typed in when it runs. [10]

Why it matters. Symantec's Dick O'Brien says the campaign gathers intelligence on European governments and defence, possibly on countries helping Ukraine. [10] He says the motive is not certain. [10]

The FBI and cyber agencies in Germany and the UK say the SafePay ransomware gang has broken into at least 600 organisations in the US and Europe since August 2024. [12] It locks victims' files and demands a share of company revenue in cryptocurrency to unlock them. [12] It gets in by guessing passwords, using known flaws and sending phishing emails. [12] A member then phones the victim to press them to pay. [12]

Why it matters. SafePay hit Conduent, a US firm that runs Medicaid payments and road tolls, which settled a lawsuit for $80m last week. [12] The advisory lists the flaws SafePay uses, so IT staff can check their own systems for them. [12]

Unit 42, the research team at Palo Alto Networks, said on Monday that ransomware gangs including Qilin and Inc are still using a flaw in its PAN-OS firewall software. [18] The company fixed it on 13 May. [18] The flaw is in GlobalProtect, the gateway workers use to reach company networks from outside. [18] Attackers use it to open a connection that skips the second login check. [18] In one case they then reached the machines that run a company's servers. [18]

Why it matters. Palo Alto first rated the flaw medium, and Rapid7, another security firm, later found attacks going back to 17 May. [18] Palo Alto did not tell The Register how many organisations were hit. [18]

Claroc, a security firm, says it found 6,800 links that people made to share conversations with Muse, Meta's AI assistant. [16][17] Each link put the conversation's title in the web address. [16] Services that record looked-up web addresses let anyone search them, so the links could be found by people never given them. [16] In a few hundred, Claroc found a loan application, a company's revenue review and a staff calendar. [16][17] Meta has paused sharing while it reviews the report. [17]

Why it matters. People who shared a chat with one friend may have shared it with anyone who searched. [17] Claroc's co-founder says he reported it to Meta on 8 October and got no reply. [16]

Zeabur, a service that hosts and runs developers' websites and apps, will shut down by 31 December after its second break-in in two months. [15] On 14-15 October an attacker used leaked internal logins, stored unscrambled, to read its main database. [15] That exposed 321,810 accounts and about 3.2 million stored settings, which hold keys and other secrets. [15] Zeabur says its administrator logins never expired and had not been changed since January 2024. [15]

Why it matters. Its customers must change every secret they stored there and move their services before December. [15] Zeabur says the logins were probably taken in the August break-in, but has not confirmed it. [15]

OVHcloud, a large French cloud company, says attackers took over a developer's account on GitHub, where programmers store code, and swapped five releases of its command-line tool, used to manage cloud services. [14] The fake versions, 0.11.0 to 0.15.0, appeared at 14:47 on 19 October and were blocked at 16:21 after a customer reported them. [14] The malware searched the computer for stored secrets. [14] A GitHub setting that stops old releases being changed had been off, and OVHcloud has now switched it on. [14]

Why it matters. Chief executive Octave Klaba says anyone who ran a fake version should change every secret on that machine. [14] Researchers link the attack to GlassWorm, a group that has poisoned developer tools since late 2025. [14]

Paradigm Healthcare Services, which handles billing for Medi-Cal, California's health programme for people on low incomes, told US health regulators a break-in affected more than 970,000 people. [22] Intruders were in its network from 8 to 15 October 2025. [22] In August 2026 it worked out that names, dates of birth and Medi-Cal ID numbers were reached. [22] Letters went out in September, about 11 months after the break-in was found. [22]

Why it matters. Paradigm says it has seen no fraud, but it has not said how the attackers got in or whether data left. [22] The regulators' public list of health-data breaches also shows two other recent ones, at a law firm and a pharmacy. [22]

Horizon3.ai, a security firm, has published working attack code for a critical flaw in FortiSIEM, a Fortinet product that gathers a company's security alerts. [19] Fortinet released the fix last week and the flaw is rated 9.4 out of 10. [19] It lets someone with no login write files on the system and then run their own commands. [19] Owners of FortiSIEM 7.5.0 are told to move to 7.5.1 or later, and 7.6 is not affected. [19]

Why it matters. Anyone who has not installed last week's fix now faces a flaw whose attack steps are public. [19]

A Chinese crime ring got into Nexus, an internal customer-service system, and issued itself more than 15,000 gift cards worth over $5m, the tech site Tom's Hardware reports, citing the news site 404 Media. [38] 404 Media identified the victim as Staples, the US office-supply chain, though the court papers do not name it. [38] The break-in was in 2023 and came out when a search warrant was unsealed last week. [38] Staples thought Nexus could not be reached from outside its network, but the gang took over staff members' logged-in sessions. [38]

Why it matters. Shops where the cards were spent carried losses, including $226,000 at Lowe's and over $140,000 at Target. [38] Tom's Hardware says the same group stole more than $100m in gift cards in all. [38]

The ICO, the UK's data protection regulator, reprimanded Data Cymru, which helps Welsh public bodies use data, and Ogi Networks, its IT supplier. [21] In November 2024 an attacker got in through a test account called Test2, set up in 2012 with the password 'Password1'. [21] The attacker copied 42 GB of data and locked 182.7 GB with ransomware. [21] Personal data on 3,300 people, mostly children, was taken. [21]

Why it matters. The administrator accounts on three systems shared one password, so one break-in opened all of them. [21] The ICO said neither body had a routine for removing old accounts, and it issued reprimands rather than fines. [21]

ENISA, the EU's cybersecurity agency, says the bloc's new Cyber Resilience Act makes makers report attacks on products they no longer support, but not fix them. [24] It answered after this month's attack on internet-connected fridge controllers in French supermarkets. [24] Copeland and Danfoss, two of the makers, say the controllers hit are old models they no longer support. [24] Paris prosecutors estimate about 700 victims, and nobody has claimed the attack. [24]

Why it matters. Shops still running the old controllers must cut them off the internet themselves, as France's cyber agency ANSSI has urged. [24] The duty to fix covers only products sold from December 2027, during their support period. [24]

Chrome Holding Company, the company that used to be 23andMe, the DNA-testing firm, agreed to pay California $6m over a 2023 breach. [23] That breach exposed data on nearly 7 million people. [23] California's attorney general, Rob Bonta, said the company failed to keep genetic data safe and cannot escape the law by going bankrupt. [23] The deal still needs a US bankruptcy court's approval. [23]

Why it matters. Customers keep the right to have their data deleted and their saliva samples destroyed. [23] 23andMe had already settled with 42 other US states for $18m in July. [23]

A US judge sentenced Chukwuemeka Amachukwu, a 40-year-old Nigerian, to eight years in prison. [25][27] His group sent trick emails to staff at US tax-preparation firms from 2019, planted malware and stole data on at least 800 customers. [26][27] They used it to claim $8.4m in false tax refunds and got $2.5m. [26] He was arrested in France in 2023 and sent to the US in 2025. [27]

Why it matters. He must repay about $3.6m and give up nearly $11m. [25] His partner Kingsley Utulu was sentenced to five years in June. [26]

Robert Boling Jr., a 45-year-old American who lived in the Philippines, pleaded guilty to a five-year scheme that stole from thousands of US soldiers and veterans. [28] Prosecutors say a partner who managed US Army medical records in South Korea passed him their personal details. [28] The group used them to get into bank accounts and take money and veterans' benefits. [28] The Philippines deported him to the US in May. [28]

Why it matters. He faces up to 40 years in prison. [28] Two other people charged in the case are still at large. [28]

China's foreign ministry said on Tuesday that the US was stretching the idea of national security. [34][35] It spoke a day after a US order banning DeepSeek's AI products from civilian government agencies was made public. [34] DeepSeek is one of China's best-known AI companies, and its models are mostly free to use. [34] The order, issued in July, also covers other firms' products built on DeepSeek, and the US says Chinese authorities could reach data on its servers in China. [34][35]

Why it matters. China's commerce ministry asked the US to withdraw the ban. [35] The two countries' leaders are due to meet in mid-November, with AI expected on the agenda. [34]

NIST, the NSA and CISA, three US government agencies, published ten practices for handling AI agents, programs that act on their own, when they behave in ways nobody intended. [30] The practices fall into five stages: prepare, detect, respond, recover and report. [30] They include telling the public what happened, as early as possible. [30] On the same day Microsoft announced controls that give a company's agents almost no access at first, then grant it one task at a time. [31]

Why it matters. Hayete Gallot, who runs Microsoft's security business, says companies trust their own agents by default even though the agents often have too much access. [31]

The FCA, which regulates UK banks and investment firms, wants firms to report serious AI failures and near-misses, not only major incidents. [32] Jessica Rusu, a senior FCA official, said badly run AI can harm customers and open cyber weaknesses faster and at greater scale. [32] Last week the UK's AI minister, Kanishka Narayan, said the UK government is looking at near-miss reporting across essential services. [32]

Why it matters. Steven Adler, of the nonprofit Guidelight AI Standards, told MPs last week that AI could learn from aviation, where reporting near-misses is required in most countries. [32]

curl, a free, open-source tool for moving data over the internet, will take reports of low and medium flaws in public from 26 October. [20] Only high and critical flaws will stay private until fixed. [20] Its lead maintainer, Daniel Stenberg, says a flood of reports, many made with AI, has overloaded the small team. [20] He says more than 90% of reports in recent years turned out to be less than high. [20]

Why it matters. Stenberg says working in public lets more people check reports and write fixes. [20] He accepts it also gives attackers more time with the less serious flaws before fixes arrive. [20]

Accenture, the consulting firm, Dragos, which protects industrial systems, and the SANS Institute, a security training body, launched the Community Cyber Resilience Foundation on Tuesday. [29] It puts about $10m of money and services into free security tools, equipment and training. [29] The first phase covers up to 500 US water, power and gas utilities with yearly revenue under $100m. [29] The firms say over 97% of US utilities fall under that line. [29]

Why it matters. Dragos chief Robert M. Lee says attackers are aiming at utilities while many small ones cannot defend themselves. [29] Accenture agreed four months ago to buy a majority stake in Dragos, whose software each utility will get. [29]

Google is adding a second, milder warning to Chrome for websites that look like known phishing, malware or scam sites. [33] It appears as a pop-up over a darkened page and lets the user mark the site as safe. [33] Chrome's red full-screen warning stays for sites Google is more sure are dangerous. [33] The new warning works only when Chrome's Enhanced Protection setting is on. [33]

Why it matters. Google calls the suspicious label less certain, so some safe sites will be flagged by mistake. [33]

IQ.Lvbs, a small start-up making self-driving software, says someone tried to steal its new driving model and users' files from 7 to 14 October. [36] It says the first attempts came from an internet address belonging to Comma.ai, a bigger company whose camera hardware the model needs. [36] Its team was also banned from Comma.ai's Discord chat on 8 October. [36] Comma.ai did not answer The Register's questions. [36]

Why it matters. A message said to be from Comma.ai's technology chief suggested IQ.Lvbs's model was built on Comma.ai's own, which IQ.Lvbs denies. [36] IQ.Lvbs says it is weighing legal action. [36]

The UK government dropped its plan for a national digital ID card, but officials told MPs on Monday that work on GOV.UK One Login and a digital wallet goes on. [37] One Login already lets people prove who they are to government services online. [37] More than 80 kinds of documents are planned for the wallet, including driving test certificates and criminal-record checks. [37]

Why it matters. Officials say One Login is not the same as a national ID scheme. [37] Sarah Green, a Liberal Democrat MP, asked whether the parts of a digital ID were still being built. [37]