Eight eMudhra CA Keys Compromised, Emergency Fixes Across Browsers
Eight eMudhra intermediate CA keys were compromised, prompting immediate revocation and blocking by Chrome and Firefox. The certificates affected span TLS, DV/OV/EV, and code signing. Fixes across Go, NSS, certifi, and other bundles were released; Apple, Microsoft, and other trust stores issued blocks. CVE-2026-111943 appears in Go’s patch, with broader root removals and CT/CRLSet updates.
2 reports
DHS Bans DeepSeek Products Across U.S. Federal Agencies
The DHS orders federal civilian agencies to stop using DeepSeek products and remove them from systems, covering affiliates and third-party offerings built on DeepSeek tech. Motivations include concerns about Chinese government access, data collection, and potential data transfers. The action cites a NowSecure 2025 report of iOS app vulnerabilities. Agencies may request 60-day exceptions; CISA rev…
2 reports
Hackers Use Autonomous AI Agents (Cairn) to Breach 1,200+ Sites
A Chinese-speaking criminal used Cairn to drive autonomous AI agents against online shops, breaching 1,200+ sites and affecting Deere, SharkNinja, and Cummins. NorForge found exposed control panels on port 8000, stray upload forms, and weak Zend Framework code. Breaches averaged under 23 hours with ~10% success. Campaign cost around $5 per task, about $5,000 total. Magento patch CVE-2026-75650 ci…
2 reports
AOMEI Backupper Hit by Short-Burst Supply Chain Campaign
AOMEI Backupper was compromised via short, five-to-ten minute tampering windows during an April–July 2026 supply chain campaign. The attacker delivered CrossRoad, a modified Radmin Server and ShinyRoad backdoor, using AOMEI’s promo channel to push malware, with UNC7017 behind the operations and targeting higher education, IT services, and telecoms across multiple countries.
2 reports
Ahold Delhaize Restoring Services After Cyberattack Across Europe and US
Ahold Delhaize reports phased restoration after a cyberattack; many European websites and apps are back online, with Albert Heijn home deliveries expected to resume soon. On Oct 12, systems were taken offline; stores stayed open. The company says no evidence of customer, associate, or partner data theft, notified the Dutch National Cyber Security Centre, and filed a police report.
2 reports
Ex-OpenAI Worker Accused Of Bugging Conference Room
Former OpenAI engineer Abdulrahman Alfozan was charged with secretly installing a recording device in a conference room to gather company information. Prosecutors say he planned to flee to Saudi Arabia, with his wife and son leaving the U.S. after his arrest. The device was hidden in toilet paper and connected to a TV; he faces up to five years if convicted.
2 reports
OVHcloud CLI Backdoored on GitHub to Steal Secrets
Attackers compromised OVHcloud CLI's GitHub account, modifying versions 0.11.0–0.15.0 to deploy info-stealing malware. Older 0.10.0 and latest 0.16.0 remained clean. The incident, detected 16:21 after a 14:47 release, involved a disabled GitHub release immutability setting. Affected platforms: macOS, Linux, Windows. Users should revoke secrets and perform cleanup; no CI/CD pipelines were impacted.
2 reports
Siemens Software Center DLL Sideloading Exposes ClickFix RAT
Siemens Software Center suffers DLL sideloading (CVE-2026-110936) enabling code execution by a authenticated local attacker. Attackers placed a crafted archive[.]dll next to a signed Siemens Software Center, using msiexec[.]exe to launch AllMyBasic[.]msi, which runs SiemensSoftwareCenter[.]exe via Romulus/ClickFix. Patch 4[.]0[.]9[.]8 mitigates. IoCs: 96.62., wizardexpensive[.]com, 2.27.; abuse v…
2 reports