Dan's Brief
← 2026-10-20

Eight eMudhra CA keys cracked, browsers and Go block them

Published 7:01 AM · 120 articles from 14 sources · about 6 min to read in full

The day in brief

The most consequential story is the compromise of eight eMudhra intermediate CA keys. Researchers say the keys were recoverable in milliseconds, which would let anyone mint certificates for any server. Mozilla, Google, Apple, Cloudflare and the Go project have all shipped blocks. Second is PHP: the project says two critical remote code execution flaws (reported as CVSS 9.2, nicknamed PHP2Shell) will be fixed in an out-of-cycle release today at 14:00 UTC after details leaked. Third, edge devices are under active attack. Qilin and INC are using a patched PAN-OS authentication bypass to reach VPNs, a public exploit is out for a critical FortiSIEM flaw, and CISA says SafePay has hit over 600 critical infrastructure organizations. These stories share a root cause: stolen or weak keys and credentials. The same pattern appears in the TeamUpdraft breach, where stolen UpdraftCentral keys can backdoor WordPress sites. On the AI side, Meta paused Muse chat sharing after thousands of conversations proved publicly discoverable, and Google open-sourced TorchTPU to loosen Nvidia's hold on PyTorch developers. CISA also added Plex2Shell and SiteGuard flaws to its exploited-vulnerabilities catalog.

Top stories

  1. 1
    Eight eMudhra CA keys cracked, browsers and Go block them

    Private keys for eight eMudhra intermediate certificate authorities were found to be trivially recoverable, so anyone can issue trusted certificates for any server. Mozilla, Google and Apple blocked the certificates, and Cloudflare is deploying mitigations. Scott Helme reports the keys fell in milliseconds, which points to a basic key-generation failure rather than a theft. BleepingComputer · 3 min read

  2. 2
    PHP to ship emergency fixes for two critical RCE flaws today

    The PHP security team scheduled an out-of-cycle release for October 21 at 14:00 UTC after details leaked ahead of disclosure. The flaws are rated CVSS 9.2 and tied to the PHP2Shell name; Ars notes the exploit report is unconfirmed. Web admins should be ready to patch as soon as the release lands. BleepingComputer

  3. 3
    Qilin and INC ransomware use PAN-OS auth bypass to reach VPNs

    Both groups are exploiting CVE-2026-0257, an already-patched authentication bypass in PAN-OS and Prisma Access. Unit 42 says multiple ransomware groups have been breaching networks across industries through Palo Alto's firewall OS since June. Unpatched perimeter firewalls are the entry point, so patching is the fix. The Hacker News · 4 min read

  4. 4
    TeamUpdraft breach may expose UpdraftCentral keys for WordPress backdoors

    A threat actor breached TeamUpdraft and may have stolen UpdraftCentral connection keys, which push commands to WordPress sites running UpdraftPlus. With those keys an attacker can plant backdoors without touching the target site's own credentials. Site owners should check whether their keys are affected and rotate them. BleepingComputer · 3 min read

  5. 5
    Meta pauses Muse sharing after AI chats surface publicly

    Claroc researchers found over 6,800 shared Muse conversation links discoverable through DNS records, and Ars reports a single query listed thousands of chats by title. Meta paused the sharing feature. The exposed chats included personal and business material. The Verge · 2 min read

Since yesterday

  • CISA added Plex2Shell (Plex Media Server) and SiteGuard flaws to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch. Coverage differs on the count: The Hacker News says four entries, CISA's alert says six. This also moves the SiteGuard item from the previous brief's open list. The Hacker News ↗
  • Norforge's AI-agent breach claim now has more detail. The actor is described as a Chinese-speaking criminal who targeted over 1,200 sites and reached more than 100 companies, including Deere. The Hacker News ↗
  • The DHS DeepSeek order's scope is clearer. It covers third-party services built on DeepSeek technology, not only DeepSeek's own products, and it bars new IT purchases from the developer and its affiliates. TechCrunch ↗

By topic

Themes today

Read the analysis →
  • Stolen keys, not clever exploits, drove today's compromises
  • Edge appliances remain the ransomware front door
  • AI agents expose authorization gaps in practice and in papers
  • Open-source maintainers are being buried by volume
  • Nvidia's software moat is being attacked from several sides
Written by claude-sonnet-5-5 from feed titles and summaries. The model can misstate details; every claim links to its source.