Ars Technica
The Internet goes on high alert after discovery of 8 compromised TLS certs
Eight intermediate TLS certificates issued by India-based certificate authority eMudhra were found to have private keys with as little as 3 to 8 bits of entropy instead of the expected 384, making them trivially crackable and capable of minting trusted certificates for any website. Browsers blocked the certificates quickly, but cryptography experts warn the cleanup covering IoT devices, Docker containers, unmaintained Linux systems, and embedded software will be "bigger than Heartbleed" and take years.
CSO
When defrost becomes sabotage: 3 OT lessons from France’s supermarket attack
Attackers remotely forced refrigeration units into defrost mode at hundreds of Intermarché and Netto stores on the nights of 11 and 12 October, warming units to roughly 50°C for six hours and causing losses in the tens of millions of euros; no ransom demand has surfaced. The breach reached stores through refrigeration contractors' remote-access channels to end-of-life Danfoss AK-SM 800 controllers, some of which had been flagged as internet-exposed since 2022.
The Record
Reports of PHP bug exploitation attempts grow as experts downplay viability of exploits
Two new PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, dubbed "PHP2Shell") are being mass-scanned, with Censys counting over 41 million internet-facing vulnerable PHP services. Amazon, Google, Arctic Wolf, and VulnCheck confirm exploitation attempts, mostly tied to botnets like Potassium and Mirai, but ASLR protections have so far blocked reliable mass exploitation; Sophos retracted an initial claim of successful compromise.
