IT News Analysis

1

Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software

The private keys of eight eMudhra intermediate certificate authority (CA) certificates are compromised,  Mozilla  and  Google's Chrome Root Program  confirms on October 20. An intermediate CA signs the certificates that websites present, so anyone holding one of these keys could issue a certificate for any website that a browser would accept. A researcher reported the compromise to the root programs on the evening of October 17, and Chrome and Firefox blocked the eight certificates within hours, after Chrome verified the findings. No TLS certificate chaining to the six intermediates used for websites had been logged to  Certificate Transparency  (CT) before Chrome's block, so none could have been trusted by default in Chrome or any other browser that requires CT logging, the Chrome Root Program said. It is not known how the keys left eMudhra, when, or whether anyone besides the researcher holds them. The keys are the ones Go blocked in its Octobe...

Oct 20, 2026

2

SANS Has Taught Defenders Since 1989. AI Security Is the Newest Chapter.

Explore practitioner-built training, six GIAC AI certifications, and free resources to use this week.

3

Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution

Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could result in arbitrary code execution. The vulnerability, tracked as CVE-2026-106173 (CVSS score: 9.4), is a critical path traversal flaw that could allow an unauthenticated attacker to execute unauthorized code or commands via specially crafted packets. Patches for the flaw were released last week by Fortinet in the following versions - FortiSIEM 7.5.0 (Upgrade to 7.5.1 or above) FortiSIEM 7.6 (Not affected) According to Horizon3.ai, the issue involves an unauthenticated attacker connecting to the gRPC service listening on TCP port 27918 and exploiting the flaw to overwrite an existing file outside of the intended directory and turn the arbitrary-file-write primitive into remote code execution. "The FortiSIEM gRPC QueryResultReq handler processes untrusted metadata without proper path validation," Horiz...

Oct 20, 2026

4

Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA

Palo Alto Networks has disclosed that it's continuing to observe exploitation of a now-patched security flaw impacting  PAN-OS and Prisma Access by ransomware actors. The activity relates to CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw that could be exploited by bad actors to set up unauthorized VPN connections. It was patched by Palo Alto Networks in May 2026 and was added by the U.S. Cybersecurity and Infrastructure Security Agency (CSIA) to its Known Exploited Vulnerabilities (KEV) catalog on May 13, 2026. "Ransomware operators exploiting CVE-2026-0257 include Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka INC)," Unit 42 researchers said in an update shared on Monday. The development comes days after ReliaQuest said it detected both Qilin and Settra ransomware groups actively exploiting the flaw in financially-motivated attacks. According to Unit 42, the threat actors are weaponizing the flaw to gain an initial foothold into corpo...

Oct 20, 2026

5

Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites

A Chinese-speaking criminal pointed autonomous AI agents at company websites and let them break in with almost no help, and a security researcher watched it happen because the operators left their control panels open on the internet. The agents tried more than 1,200 sites and reached websites belonging to more than 100 companies, including farm-equipment maker Deere, appliance company SharkNinja and engine maker Cummins,  according to Reuters , which reviewed the attacker's own records to identify them. How much data, if any, was taken is not known. The researcher, Snorre Fagerland of the security firm NorForge , found the operations by scanning the internet for exposed copies of  Cairn , an open-source AI tool popular with hackers. Beginning around October 2, he found about two dozen Cairn instances being used maliciously, which let him read the attackers' work in real time. He set out the findings on Monday, and Reuters, which saw the report before publication, named...

Oct 20, 2026

6

Pegasus Spyware Infection Confirmed on Serbian University Rector's iPhone Days Before Election

The iPhone of Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia's student protest movement, was infected with NSO Group's Pegasus spyware in 2026, the  Citizen Lab said  on October 19. The finding came six days before Serbia's October 25 snap parliamentary election. The infection used a zero-click exploit, meaning Đokić did not have to tap a link or open a file for it to work. The lab found the infection with high confidence, but its note provides no date within 2026, does not identify who was behind the attack, and notes that its investigation is ongoing. The election was  called in September  after nearly two years of protests that began when a railway station canopy collapsed in Novi Sad in November 2024, killing 16 people. The Citizen Lab, a research group at the University of Toronto, analyzed forensic artifacts from the phone at Đokić's request, working with the Serbian digital-rights group SHARE Foundation. SHARE ...

Oct 20, 2026

7

Gartner® Hype Cycle™ for CPS Security, 2026

Prioritize cyber-physical systems security amid rising threats, regulations, vulnerabilities and emerging technologies.

8

WhatsApp Hid Instructions in Help Pages Telling Its AI Chatbot Not to Recommend Privacy Regulators

WhatsApp's help pages carried hidden instructions for its support chatbot that told it not to recommend a data protection authority or regulator to users who could no longer delete their accounts, even though WhatsApp's own privacy policy for Europe tells users they can complain to one. The text sat in the pages' code, never shown on screen, until it was removed by October 18. Whether the chatbot ever followed the instructions is not known:  Redact , the data-deletion software company that found the text, read the instructions, not the chatbot's answers. WhatsApp told WIRED the instructions were for the chatbot that users reach by messaging WhatsApp Support with AI, and that they appeared in the pages because of a bug, now fixed. A second block of hidden text on the page about reporting and blocking told the chatbot that once a user mentioned a lawyer, a lawsuit, or a court, it should not cite privacy laws such as the GDPR, even when the user raised them. A W...

Oct 20, 2026

9

What Security Teams Can Do To Tame Wild Code

A sales manager builds an AI-assisted workflow to route leads. It connects to customer records, summarizes inbound requests, and posts updates to a shared channel. The workflow saves time, reduces manual work, and soon becomes part of the team’s daily routine. Across the same organization, employees are building useful apps, agents, and automations faster than existing processes can support them.  If you work in security, that success introduces a new set of questions. Whose credentials does the workflow use? Which records can it access? Who can see its output? If it starts exposing information it shouldn’t, can you trace what happened and stop further access?  Wild code takes root when useful builds spread faster than the processes for owning, securing, and maintaining them. It isn’t simply another name for unapproved software. Employees are creating new capabilities, not just adopting existing products. A small experiment can become an operational dependency before secu...

Oct 20, 2026

10

Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns

Go 1.27.3 and Go 1.26.10, released on October 20, make Go's certificate verifier reject any certificate chain that passes through one of  eight intermediate certificate authority keys. Programs built on the new release will refuse connections to sites and services whose certificates were issued under those keys. The Go team says the keys belong to one certificate authority it has not named, and that it is blocking them because of "specific security concerns around their operation." It handled the fix on its  URGENT track , the one reserved for its most serious issues, and recommends upgrading immediately. Two days earlier, on October 17, Mozilla added six intermediate certificates issued by eMudhra's emSign Root TLS CA - G3 to  OneCRL , the list Firefox uses to block certificates. The Mozilla bug behind those entries is  closed to the public , and neither Mozilla nor Go has said what prompted its action. Whether Chrome, Apple, or Microsoft have taken simil...

Oct 20, 2026