Security for teams connecting data, documents and agents to AI.
Articles 706
Cyber ·
Cisco Talos reported eight eMudhra intermediate certificates with weak private keys, which allow certificate forgery. Six TLS certificates were blocked by Chrome, Mozilla and Apple, and two code signing certificates by Microsoft. eMudhra revoked the affected certificates.
Cyber ·
The Apache Pulsar PMC published 14 security advisories on October 21, 2026, fixed in versions 4.0.14, 4.2.5 and 5.0.0. The official recommendation is to upgrade.
Cyber ·
According to a report in The Record's feed, Meta faces a US$ 25 billion claim after a privacy ruling in New Mexico, and the decade-old Cambridge Analytica scandal continues to weigh on its finances.
Cyber ·
The PHP Foundation published a security release and explained that the delay in fixing the vulnerabilities came from technical deadlocks, lack of resources and structural flaws in the team's decision process.
Cyber ·
Three technology companies launched a US$ 10 million private-sector initiative to support up to 500 under-resourced utilities in strengthening their cybersecurity. The announcement was made this week, according to The Record's feed, dated October 21, 2026.
Cyber ·
The Pillow image processing library released version 13.0.0 with several security fixes, detailed in the release notes and in GHSA advisories published by the project.
Cyber ·
Democratic lawmakers say Russia seeks to weaken the party before the midterm elections, but the latest update does not show any country technically interfering with election infrastructure or altering votes.
Cyber ·
Ubuntu published notice USN-8951-1 covering four flaws in the c-ares library, used for asynchronous DNS resolution. The issues can cause denial of service and, in one case, arbitrary code execution on specific versions.
Cyber ·
A message on the oss-sec list dated October 21, 2026 questions a Mastodon post about remote code execution in PHP 8.2 to 8.5. According to the report, php.org replied that the case is not a real problem.
Cyber ·
Ubuntu Security notice dated 21 October 2026: the NSS package update removes the root CA certificates emSign ECC Root CA - G3 and Comodo AAA Services root after intermediate certificates from those authorities were compromised.
Cyber ·
According to a report from The Record, the PHP Foundation said one of two critical vulnerabilities dated back to 2024 and that a third-party analysis by AI companies raised attention on both, leading it to publish the information earlier than planned.
Cyber ·
Node.js security updates fix, among other flaws, a remote code execution issue tied to Brotli compression. The musl libc project disclosed an out-of-bounds write that could potentially lead to RCE, though exploitation has not been demonstrated.
Cyber ·
Machine-translated post from the oss-sec feed, dated October 21, 2026, by Solar Designer, discusses auditing private keys of root and intermediate certificates after the eMudhra intermediate compromise.
Cyber ·
A reply on the oss-sec mailing list asks whether compromised eMudhra intermediate certificates are still being cross-signed and notes that they remain in NSS 3.131.1, a release that removes emSign certificates.
Cyber ·
A notice on the oss-sec feed reports that Apache bRPC 1.18.0 fixes 35 vulnerabilities: 16 high and 19 moderate. One case, CVE-2026-48830, allows bypassing authentication in versions up to 1.17.0.
Cyber ·
The oss-sec feed notice dated October 20, 2026 warns that compromised eMudhra certificates may affect software that ships its own root certificate store, such as a CA bundle included in Linux distributions.
Cyber ·
Announcement of the SANS ISC Stormcast podcast episode for Wednesday, October 21, 2026. The feed gives the title, date and a link to the episode, but provides no content summary.
Cyber ·
CPAN Security Group advisory on a flaw in Imager::File::GIF before version 1.006, causing out-of-bounds reads when consolidating GIF images.
Cyber ·
Security advisory published on October 20, 2026 describes a flaw in the Crypt::Age Perl library, in versions before 0.004, that can consume CPU because it accepts an unlimited number of recipient blocks.
Cyber ·
CPAN Security Group advisory: DBI versions before 1.656 can hang when reopening a DBD::DBM table. A failed data open does not release the table lock, so the next open hangs.
Looking for something else?DocumentationContact
