Security Does Not End at the Gate.
10 articles on TLS certificate trust, operational technology, PHP scanning, continuous authentication, AI governance and cyber insurance.
These 10 articles look at what happens after a system or person is considered trustworthy. Weak TLS certificates, contractor remote access and stolen session tokens show why a first check cannot be the last. Hidden intrusions can blend into normal activity, while cyber insurers increasingly want continuous evidence instead of one-time questionnaires. The same need for ongoing attention reaches boards, AI systems and operational technology. Heavy scanning for PHP flaws does not by itself prove reliable exploitation. AI can shorten the path from an IT compromise to OT targeting, though specialised engineering remains a barrier. Together, the stories call for connected signals, sensible priorities and repeated verification.
This Week's Articles
- 01Ars Technica
The Internet goes on high alert after discovery of 8 compromised TLS certs
Eight intermediate TLS certificates issued by India-based certificate authority eMudhra were found to have private keys with as little as 3 to 8 bits of entropy instead of the expected 384, making them trivially crackable and capable of minting trusted certificates for any website. Browsers blocked the certificates quickly, but cryptography experts warn the cleanup covering IoT devices, Docker containers, unmaintained Linux systems, and embedded software will be "bigger than Heartbleed" and take years.
Why it mattersWeak certificate keys can undermine digital trust well beyond browsers, making the cleanup across older and embedded systems important.
- 02CSO
When defrost becomes sabotage: 3 OT lessons from France’s supermarket attack
Attackers remotely forced refrigeration units into defrost mode at hundreds of Intermarché and Netto stores on the nights of 11 and 12 October, warming units to roughly 50°C for six hours and causing losses in the tens of millions of euros; no ransom demand has surfaced. The breach reached stores through refrigeration contractors' remote-access channels to end-of-life Danfoss AK-SM 800 controllers, some of which had been flagged as internet-exposed since 2022.
Why it mattersContractor access and older connected controllers need attention because a cyber intrusion can disrupt physical operations.
- 03The Record
Reports of PHP bug exploitation attempts grow as experts downplay viability of exploits
Two new PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, dubbed "PHP2Shell") are being mass-scanned, with Censys counting over 41 million internet-facing vulnerable PHP services. Amazon, Google, Arctic Wolf, and VulnCheck confirm exploitation attempts, mostly tied to botnets like Potassium and Mirai, but ASLR protections have so far blocked reliable mass exploitation; Sophos retracted an initial claim of successful compromise.
Why it mattersTeams should track the exposed services and exploitation attempts while distinguishing mass scanning from a reliable working exploit.
- 04Dark Reading
Cyber Insurance's New Reality: Underwriting Isn't Enough
The article reports that US cyber insurance premiums reached nearly $15 billion in 2024 (NAIC data) alongside almost 50,000 claims, the highest on record, up nearly 40% year-over-year. AI-enabled phishing and social engineering are undermining historical loss models, pushing insurers like Coalition, Cowbell, and Resilience to demand continuous telemetry over point-in-time questionnaires and to become active security providers rather than passive risk-transfer vendors.
Why it mattersInsurers are looking for ongoing evidence of security posture rather than relying only on answers given at renewal.
- 05SecurityInfoWatch
Connecting the Clues Behind Hidden Cyberattacks
This deep technical piece explains that modern intrusions rarely use malware; attackers instead ride valid credentials, native Windows tools, and trusted cloud services such as Microsoft 365 and Dropbox to blend into normal traffic. Detection requires correlating identity, endpoint, and network signals over time rather than relying on isolated alerts, since indicators like IP addresses change quickly while behavioral patterns persist.
Why it mattersLinking identity, endpoint and network activity over time can reveal suspicious behaviour that individual alerts miss.
- 06Cybersecurity Dive
Boards confident on cybersecurity, AI oversight, but tech changes outpace readiness
BDO's survey of over 200 US corporate directors found 80% believe their board has a clear AI and cybersecurity governance framework, yet only 36% are "very confident" their board has the right expertise, and 57% cite accelerating AI and cyber change as a top concern for the next six to twelve months. The gap between stated confidence and acknowledged skill shortfalls is the article's central governance warning for CISOs reporting to boards.
Why it mattersA governance framework needs board-level expertise that can keep pace with changing AI and cyber risks.
- 07Computer Weekly
AI accelerates path from IT compromise to OT targeting
The article clarifies that commercial AI has not created novel attacks against operational technology, but it has materially compressed attacker reconnaissance time, allowing faster translation of an initial IT compromise into OT-targeted action. Process-specific engineering knowledge remains a meaningful barrier that AI has not yet eliminated, offering defenders a narrowing but still real time advantage to segment IT/OT networks and harden engineering-specific access before that barrier erodes further.
Why it mattersSegmenting IT and OT systems and controlling engineering access can help defenders use the remaining time advantage.
- 08Security Magazine
Authentication Shouldn’t End After MFA Succeeds
The article explains that attackers have adapted to MFA by stealing authentication tokens or tricking users into approving push-notification requests, rather than attempting direct credential theft. Its core recommendation is that authentication must be treated as continuous rather than a one-time gate: session monitoring, token-binding, device posture checks, and anomaly detection after login are necessary to catch adversary-in-the-middle and token-replay techniques that bypass MFA entirely.
Why it mattersA successful MFA check cannot establish trust for an entire session when tokens and approvals can be abused afterward.
- 09World Economic Forum
Zero trust and clear accountability are the new baseline for AI cybersecurity
The article argues traditional cybersecurity frameworks must evolve to treat AI misuse as an international security problem requiring stronger accountability rather than waiting for policy to catch up. It identifies three distinct AI misuse risks that technology creators are struggling to control and recommends enterprises proactively apply zero-trust principles to AI systems now rather than deferring to future regulation.
Why it mattersOrganisations can set access boundaries and accountability for AI systems now, without waiting for future rules.
- 10Forbes Business Council
AI Cybersecurity Risks: What’s Overhyped and What’s Overlooked
The article pushes back against dramatic "rogue AI" and existential-threat narratives, arguing the most urgent AI-related risks are mundane: AI-accelerated phishing, data leakage through employee use of public AI tools, and expanding machine-identity attack surfaces. Its central message is one of risk prioritisation, security leaders should direct resources toward overlooked, present-day exposures like shadow AI use and prompt-based data leakage rather than speculative, headline-driven scenarios.
Why it mattersSecurity teams should focus on present-day AI exposures such as phishing, public-tool data leakage and machine identities.