Browsers block 8 compromised eMudhra intermediate CA keys
A researcher proved possession of the private keys for eight eMudhra intermediate CAs. Chrome, Firefox, Apple and Microsoft have blocked them; Go shipped a fix.
Newsroom
All cybersecurity stories from the Hacker Posts desk.
PHP ships emergency release for two critical flaws (CVSS 9.2)
PHP will publish an out-of-cycle security release at 14:00 UTC on Oct 21 for two flaws it rates CVSS 9.2. Only branches 8.2–8.5 get the fix. Prepare to patch.
FBI, CISA detail SafePay ransomware: 600+ victims since 2024
Joint advisory AA26-293A documents SafePay ransomware: 600+ victims since Aug 2024, five exploited CVEs, and a full IOC set. The .SafePay extension and LockBit code overlap.
TeamUpdraft breach exposes UpdraftCentral keys to takeover
TeamUpdraft says its customer database was accessed on Oct 17–18, exposing UpdraftCentral connection keys that can push plugins to linked WordPress sites. Delete keys now.
Ahold Delhaize takes systems offline after cyberattack
Ahold Delhaize pulled systems offline on October 12 after a cyberattack that disrupted websites, apps and deliveries across US and European brands. No actor has claimed it.
Citizen Lab confirms Pegasus on Belgrade rector's iPhone
Citizen Lab and SHARE Foundation confirmed a zero-click Pegasus infection on University of Belgrade rector Vladan Đokić's iPhone, six days before Serbia's October 25 election.
FortiSIEM CVE-2026-106173: unauth RCE, PoC public, patch now
Fortinet patched a 9.4 path-traversal RCE in FortiSIEM 7.5.0 reachable unauthenticated over gRPC port 27918. Horizon3.ai has released a working PoC. Upgrade to 7.5.1.
Go blocks eight CA keys in emergency 1.27.3/1.26.10 update
Go 1.27.3 and 1.26.10 hard-block eight intermediate CA keys over undisclosed 'security concerns.' Chains through them now fail with x509: no valid chains built. Rebuild.
Nikkei breach exposes 1.83M records via a dev system
Nikkei says attackers used stolen credentials to reach a development system on October 7, exposing 1.83M personal records held in the cloud. No card data; no actor named.