Eight eMudhra CA keys cracked, browsers and Go block them
Published 7:01 AM · 120 articles from 14 sources · about 6 min to read in full
Themes & analysis
Stolen keys, not clever exploits, drove today's compromises
Eight eMudhra CA keys were recoverable in milliseconds. TeamUpdraft's UpdraftCentral keys may have been stolen, and Zeabur lost data through leaked plaintext credentials. Each case defeats the checks built on top, whether certificate validation, site authentication or access control. The practical reconsideration is how many long-lived secrets your environment trusts and how fast you could rotate them.
Edge appliances remain the ransomware front door
Qilin and INC are using a patched PAN-OS bypass, Unit 42 sees multiple groups on Palo Alto firewalls since June, and FortiSIEM now has a public exploit. SafePay's 600-plus critical infrastructure victims show the scale. Patch lag on perimeter devices is the common factor. Speculation: the PHP RCE fix will draw similar rapid exploitation of unpatched web servers.
AI agents expose authorization gaps in practice and in papers
Meta's Muse made private chats discoverable, and Norforge reports autonomous agents attacking over 1,200 sites. On arXiv, several papers argue per-action authorization does not compose across LLM agents, and others benchmark agents acting outside granted scope. The pattern is that agent permissions and sharing defaults are being designed after deployment, not before.
Open-source maintainers are being buried by volume
curl will publish low-severity reports from October 26 to survive its vulnerability avalanche, the Linux Foundation estimates 25% of new pull requests are low-quality AI output, and Mozilla is delaying publication of security patch tests. Review capacity is the scarce resource. Speculation: more projects will move to public triage of low-risk reports and stricter intake filters.
Nvidia's software moat is being attacked from several sides
Google's TorchTPU follows Amazon's similar tool, and Intel and AMD are collaborating on PyTorch oneDNN optimizations. Meanwhile Anthropic reportedly cannot get enough compute from competing cloud providers. Portability is improving, but compute supply still constrains the leading labs. Speculation: PyTorch becomes the neutral layer where hardware vendors compete.
Watch list
Install the PHP out-of-cycle release and confirm whether it covers CVE-2026-109618 and CVE-2026-109619. Expect exploit attempts quickly after disclosure.
Watch for PHP release, October 21 at 14:00 UTC
Check whether any CA, vendor or operating system still trusts the eMudhra intermediates, and whether eMudhra explains how the keys became recoverable.
Watch for eMudhra statement and remaining trust-store or software updates
curl will start publishing low-severity vulnerability reports, a change other projects may copy.
Watch for curl policy change, October 26
Watch whether TeamUpdraft confirms which UpdraftCentral keys were stolen and whether attackers have already backdoored sites.
Watch for TeamUpdraft incident disclosure
Anthropic's safety bill and its compute troubles both bear on the planned November IPO.
Watch for Anthropic IPO filing, November
Watch for Meta's decision on restoring Muse conversation sharing, and whether Claroc or regulators follow up on the exposed chats.
Watch for Meta announcement on Muse sharing