Cloudflare patches systems after eMudhra certificate key compromise
Cloudflare mitigated a security incident involving compromised private keys for eight eMudhra intermediate certificates, urging customers to update clients and review trust stores.
Security & privacy
TLS and certificates, encryption, safe file transfer, breaches and how to avoid them.
Fake Web3 accelerator pushes malware via npm to hijack AI agents
A fraudulent Web3 venture firm distributed malicious npm packages that install stealers on Windows and macOS while redirecting AI agent traffic to attacker-controlled servers.
27.9% of top domains remain vulnerable to email spoofing in late 2026
An October 2026 audit reveals that over a quarter of the web's most-linked domains lack enforced DMARC policies, leaving them open to impersonation.
GhostAction attackers hide credential stealers in fake fonts across GitHub
The GhostAction group now uses phishing and disguised font files to steal credentials from 94 GitHub repositories, bypassing platform security controls.
Correct Hooks library simplifies asymmetric webhook authentication for developers
A new open-source library introduces asymmetric signature support for webhooks, aiming to replace complex symmetric key management with easier key rotation and verification.
Fixing the Vaultwarden HTTPS secure context error with a reverse proxy
Vaultwarden requires HTTPS for browser crypto APIs. Learn how to resolve the secure context error using Caddy as a reverse proxy.
AhsayCBS releases hotfixes for actively exploited authentication bypass flaws
Ahsay Backup issued new hotfixes for AhsayCBS after August patches failed to fully resolve two vulnerabilities used in active attacks.
NGINX patches five flaws including TLS bypass and HTTP/3 injection
NGINX released versions 1.30.6 and 1.31.7 to fix five vulnerabilities, including a TLS session forgery bug and an HTTP/3 request injection flaw.
sslx offers a modern, rust-based alternative to openssl cli for certificate management
A new open-source tool called sslx simplifies TLS certificate inspection, grading, and generation from the terminal, aiming to replace complex openssl commands.
Microsoft patches record 1,413 flaws including actively exploited Windows bug
Microsoft released patches for 1,413 vulnerabilities in October 2026, including a Windows Shell flaw under active exploitation and a .NET bypass.
Ivanti Connect Secure zero-days allow root access via chained exploits
Attackers are chaining three zero-day flaws in Ivanti Connect Secure VPNs to gain root access. Two flaws are patched, but a critical privilege escalation fix is still pending.
Cloudflare Tunnel security limits for self-hosted services
An analysis of Cloudflare Tunnel reveals it hides IP addresses but does not replace application-level authentication or patching.
AI-augmented campaigns target WordPress and critical infrastructure in Ukraine
CyberXero used Claude Code to automate attacks on WordPress sites, stealing over 628,000 records. A separate operation targeted Brazilian financial systems with invoice fraud.
Atlassian zero-day exploited within hours as certificate hijacks hit major brands
Attackers targeted a critical Atlassian flaw just two hours after disclosure, while rogue HTTPS certificates compromised trust for Google and other global services.
New cryptographic standards mandate post-quantum upgrades by 2029
A 2026 update to the Cryptographic Right Answers guide sets a 2029 deadline for post-quantum transitions, recommending ML-KEM and ML-DSA algorithms.
