Daily security stories worth an engineer's time.https://diffbrief.tatsatpandey.com/en-ushttps://kaba.cx/posts/20261020_Tor/https://kaba.cx/posts/20261020_Tor/Attackers installed an OpenSSH backdoor on 333 Tor exit nodes and redirected SSH connections for interception after gaining access two months earlier. The account offers concrete lessons about relay trust, credential theft and incident response.Wed, 21 Oct 2026 06:38:00 GMTSecuritydeep-divehttps://emudhra.we-have-a-problem.com/https://emudhra.we-have-a-problem.com/The report says eight intermediate CA keys chain to roots trusted by major browser and operating-system programs, and lists certificate blocking actions. Engineers responsible for trust stores and certificate operations should understand the scope and response.Wed, 21 Oct 2026 06:38:00 GMTSecurityvulnerabilityhttps://blog.cloudflare.com/emudhra-certificate-compromise/https://blog.cloudflare.com/emudhra-certificate-compromise/Eight compromised intermediate-certificate keys were weak enough to enable forged certificates for any domain; Cloudflare says it updated clients and deployed mitigations across several products. The incident highlights the reach of compromised certificate trust and the response work it triggers.Wed, 21 Oct 2026 06:38:00 GMTSecurityvulnerabilityhttps://krebsonsecurity.com/2026/10/feds-suspect-ransom-negotiator-ran-shinyhunters-extortion-site/https://krebsonsecurity.com/2026/10/feds-suspect-ransom-negotiator-ran-shinyhunters-extortion-site/Investigators suspect an executive at a ransomware negotiation firm helped ShinyHunters operate a site pressuring victims to pay. The account highlights risks around trust and conflicts of interest in incident response.Wed, 21 Oct 2026 06:38:00 GMTSecuritynewshttps://fulcrumsec.vg/pingcap/https://fulcrumsec.vg/pingcap/The report claims 10.6 TB was exfiltrated, including 115,308 plaintext customer API keys and 20.6 million SQL statements, across TiDB Cloud and related systems. If substantiated, the scope makes this a significant cloud-platform security incident.Wed, 21 Oct 2026 06:38:00 GMTSecuritynewshttps://nmattia.com/posts/2026-10-19-setting-up-ssh-keys-touch-id/https://nmattia.com/posts/2026-10-19-setting-up-ssh-keys-touch-id/The guide shows how to create SSH identities in the Secure Enclave, where private key material cannot be extracted and Touch ID can protect its use. Engineers can weigh this approach against file-based keys for SSH and Git workflows.Wed, 21 Oct 2026 06:38:00 GMTSecurityguidehttps://ipinfo.io/blog/france-fridges-hackhttps://ipinfo.io/blog/france-fridges-hackThe account says attackers pushed refrigeration systems into defrost mode, with some units reaching 50°C, and examines internet scans of the systems before the attack. It illustrates how exposed industrial controls can turn security failures into physical and operational damage.Tue, 20 Oct 2026 06:31:51 GMTSecuritydeep-divehttps://github.com/golang/go/issues/82345https://github.com/golang/go/issues/82345Go’s crypto/x509 verification will filter out chains containing a small set of distrusted intermediate certificates. Services that rely on Go’s verifier should upgrade to avoid trusting those chains.Tue, 20 Oct 2026 06:31:51 GMTSecurityvulnerabilityhttps://shopify.engineering/overexposedhttps://shopify.engineering/overexposedOverexposed inventories GKE Ingresses and Cloud Run services through Cloud Asset Inventory, then probes candidate endpoints for unauthenticated access. The redesign addresses a concrete blind spot: configuration files did not show what was actually running.Tue, 20 Oct 2026 06:31:51 GMTSecuritycase-studyhttps://www.wjcl.com/article/savannah-police-officer-ice-agent-flock-access/74135816https://www.wjcl.com/article/savannah-police-officer-ice-agent-flock-access/74135816Documents say the husband used the officer’s shared Flock credentials to make hundreds of searches tied to ICE investigations. The case illustrates the risks of shared accounts and weak access controls in surveillance systems.Tue, 20 Oct 2026 06:31:51 GMTSecuritynewshttp://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.htmlhttp://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.htmlA honeypot investigation reports in-the-wild exploitation of Plex vulnerabilities to deploy a cryptominer, with a later update noting proxy deployment. The account offers a concrete exploitation signal, though the target is a single product rather than a major platform.Tue, 20 Oct 2026 06:31:51 GMTSecurityvulnerabilityhttps://quentinkaiser.be/security/2026/10/16/one-parser-two-bugs/https://quentinkaiser.be/security/2026/10/16/one-parser-two-bugs/A flaw in Broadcom's 802.11 implementation can be triggered remotely without the network key, enabling information disclosure and arbitrary code execution across numerous router products. The long-lived flaw and incomplete patch illustrate the remediation challenges of shared components in embedded ecosystems.Mon, 19 Oct 2026 06:43:22 GMTSecurityvulnerabilityhttps://oro.gay/posts/flatpak-an-insecurity-nightmare/https://oro.gay/posts/flatpak-an-insecurity-nightmare/The response places Flatpak in the broader evolution of Linux desktop security and contrasts it with server practices. It may help engineers assess the sandboxing debate, though the excerpt stops before its argument.Mon, 19 Oct 2026 06:43:22 GMTSecuritydeep-divehttps://cloud.google.com/blog/products/identity-security/wiz-sensor-for-gke-turnkey-threat-detection-for-kubernetes/https://cloud.google.com/blog/products/identity-security/wiz-sensor-for-gke-turnkey-threat-detection-for-kubernetes/The preview add-on brings eBPF runtime detection to GKE with automated lifecycle management, credential handling, and fleet-wide governance. Platform and security teams can assess whether it reduces the operational burden of deploying runtime defenses across clusters.Mon, 19 Oct 2026 06:43:22 GMTSecurityreleasehttps://github.blog/engineering/platform-security/staying-evergreen-how-we-automated-secure-access-and-repo-hygiene-in-a-shared-org/https://github.blog/engineering/platform-security/staying-evergreen-how-we-automated-secure-access-and-repo-hygiene-in-a-shared-org/GitHub uses native features to review outside collaborator access and archive stale repositories in a shared organization. These controls offer a practical way to reduce access and repository-hygiene risks.Mon, 19 Oct 2026 06:43:22 GMTSecurityguidehttps://pwn.ai/blog/pwnescapehttps://pwn.ai/blog/pwnescapeResearchers describe a Linux networking vulnerability that enabled repeatable host-memory disclosure and a full guest-to-host escape. The findings matter to anyone relying on VM isolation to contain untrusted workloads.Sun, 18 Oct 2026 06:29:34 GMTSecurityvulnerabilityhttps://calif.io/research/big-fishhttps://calif.io/research/big-fishA signed 16-bit shared-memory attachment counter could overflow after repeated forks, contributing to a race-driven use-after-free; combined with a separate out-of-bounds write, it enabled local privilege escalation. The exploit illustrates how old kernel state and memory-safety bugs can compose into a serious failure.Sun, 18 Oct 2026 06:29:34 GMTSecurityvulnerabilityhttps://courk.cc/rp2350-challenge-laserhttps://courk.cc/rp2350-challenge-laserThe investigation covers an infrared laser-injection platform, pulse synchronization, and attack scenarios including instruction skips and register corruption. Its methods and constraints are useful for engineers assessing hardware secure-boot defenses.Sun, 18 Oct 2026 06:29:34 GMTSecuritydeep-divehttps://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/Mandiant found that ARMORY CASTLE exploited a BeyondTrust Remote Support vulnerability as a zero-day, then escalated privileges and established persistence. The observed intrusion and defensive guidance make this more useful than a routine single-product advisory.Sun, 18 Oct 2026 06:29:34 GMTSecurityvulnerabilityhttps://adepts.of0x.cc/eufy-homestation2-firmware/https://adepts.of0x.cc/eufy-homestation2-firmware/The investigation dissects Eufy HomeBase 2 firmware and hardware, with Wi-Fi secrets, UART lockdowns and flash damage in scope. It offers hands-on embedded-device security work, though the excerpt gives few findings.Sun, 18 Oct 2026 06:29:34 GMTSecuritydeep-divehttps://pluralistic.net/2026/10/17/mercenary-spyware/#discover-techhttps://pluralistic.net/2026/10/17/mercenary-spyware/#discover-techThe report says an Israeli ad-tech company used Google, Facebook, and other major ad platforms to deliver mercenary spyware. The case highlights abuse risks in programmatic advertising systems.Sun, 18 Oct 2026 06:29:34 GMTSecuritynewshttps://cloud.google.com/blog/topics/threat-intelligence/investigating-ephemeral-supply-chain-tampering/https://cloud.google.com/blog/topics/threat-intelligence/investigating-ephemeral-supply-chain-tampering/Investigators found repeated brief changes to AOMEI update infrastructure that reverted to authentic files after five to ten minutes, delivering a multi-stage payload. The short windows show why point-in-time scans can miss supply-chain compromises.Sat, 17 Oct 2026 06:01:58 GMTSecuritydeep-divehttps://www.anthropic.com/research/ecdsa-curve-originshttps://www.anthropic.com/research/ecdsa-curve-originsAnthropic says Claude resolved the long-standing question of how NSA-provided ECDSA curve seeds were chosen, summarizing the explanation as “just timestamps.” The result is a notable cryptographic investigation, though the excerpt gives no method details or security changes.Sat, 17 Oct 2026 06:01:58 GMTSecuritydeep-divehttps://www.theguardian.com/technology/2026/oct/15/israeli-firm-digital-ads-enabling-installation-of-zero-click-spyware-researchers-sayhttps://www.theguardian.com/technology/2026/oct/15/israeli-firm-digital-ads-enabling-installation-of-zero-click-spyware-researchers-sayCitizen Lab says Discover-Tech’s ad platform enabled mass profiling and covert spyware delivery, and believes dozens of Al Jazeera devices were compromised. The case shows how advertising infrastructure can become an attack channel at broad scale.Sat, 17 Oct 2026 06:01:58 GMTSecuritynewshttps://words.filippo.io/seeds-solved/https://words.filippo.io/seeds-solved/A team identified the NIST curve seeds as outputs of drand48 seeded with a time in 1997–98, resolving a long-running cryptographic puzzle. The result adds historical clarity around widely used cryptographic primitives.Sat, 17 Oct 2026 06:01:58 GMTSecuritynewshttps://blog.cloudflare.com/verified-bots-accountability/https://blog.cloudflare.com/verified-bots-accountability/Verified bots use Web Bot Auth for identity, while BotBase catalogs them; Cloudflare is adding evaluations for behavior that deviates from its rules. This is useful context for designing accountability and abuse controls for automated clients.Sat, 17 Oct 2026 06:01:58 GMTSecuritydeep-divehttps://thereallo.dev/blog/someone-on-torrent-sites-kept-fucking-with-my-sonarr-setuphttps://thereallo.dev/blog/someone-on-torrent-sites-kept-fucking-with-my-sonarr-setupA torrent with an episode-like name ending in .exe entered Sonarr’s queue, where failed imports retried every 90 seconds; qBittorrent reported completion despite zero bytes downloaded. The incident illustrates risks in automated media-ingestion workflows.Sat, 17 Oct 2026 06:01:58 GMTSecuritydeep-divehttps://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/Citizen Lab reports the first public technical confirmation of a zero-click mercenary spyware attack delivered through targeted ads, including infections on Al Jazeera devices and a billion-bid-scale targeting operation. The findings expose risks at the intersection of ad systems, browser delivery and surveillance.Fri, 16 Oct 2026 06:22:18 GMTSecuritydeep-divehttps://blog.dfb.sh/blog/eap770-root-for-two-zeros/https://blog.dfb.sh/blog/eap770-root-for-two-zeros/The author reports finding the same bug class in at least 13 in-tree drivers, with code that works on x86 but can silently corrupt data on non-coherent architectures. It highlights how architecture-specific DMA assumptions can create broad kernel security and reliability risks.Fri, 16 Oct 2026 06:22:18 GMTSecurityvulnerabilityhttps://blog.cloudflare.com/programmable-gateway-dlp/https://blog.cloudflare.com/programmable-gateway-dlp/Cloudflare is adding a Forward action and custom validation functions so customer code can run inline during Gateway and DLP policy evaluation. This moves programmability into the enforcement path, where latency and execution boundaries matter.Fri, 16 Oct 2026 06:22:18 GMTSecurityreleasehttps://lwn.net/Articles/1100611/https://lwn.net/Articles/1100611/The stable kernel releases fix a flaw in skb_checksum_help() that could let an IPv4 packet with bad checksum metadata corrupt the network header. Kernel operators should assess their exposure and apply the relevant stable update.Fri, 16 Oct 2026 06:22:18 GMTSecurityvulnerabilityhttps://spritely.institute/news/end-to-end-encrypted-relays-for-ocapn.htmlhttps://spritely.institute/news/end-to-end-encrypted-relays-for-ocapn.htmlThe existing prelay encrypts OCapN traffic in transit but lacks end-to-end encryption, leaving the relay able to read or tamper with messages; the next Goblins release is planned to add E2EE. This addresses a meaningful trust boundary for communication across NATs and carrier-grade NATs.Fri, 16 Oct 2026 06:22:18 GMTSecurityreleasehttps://github.com/glincker/sslxhttps://github.com/glincker/sslxThe Rust and rustls-based CLI checks protocol versions, cipher strength, certificate validity, hostname matching, chain completeness and ALPN, and assigns a grade. It offers a compact way to inspect TLS without juggling multiple OpenSSL commands.Fri, 16 Oct 2026 06:22:18 GMTSecuritytoolhttps://blog.trailofbits.com/2026/10/14/package-managers-have-an-integrity-problem/https://blog.trailofbits.com/2026/10/14/package-managers-have-an-integrity-problem/A review of 25 package managers found that fewer than half use lockfiles that check for tampering by default, and only two verify every downloaded package. The findings expose a supply-chain integrity gap engineers should consider when choosing package tooling.Thu, 15 Oct 2026 06:22:59 GMTSecuritybenchmarkhttps://scotthelme.co.uk/passkeys-are-not-a-trap/https://scotthelme.co.uk/passkeys-are-not-a-trap/The piece challenges claims that passkey attestation lets websites restrict users to approved devices, arguing that synced passkeys generally do not attest in that way. Engineers responsible for authentication can use the explanation to evaluate claims about passkey privacy and deployment.Thu, 15 Oct 2026 06:22:59 GMTSecuritydeep-divehttps://www.bleepingcomputer.com/news/security/gitlab-warns-of-max-severity-rce-flaw-in-regex-compiler-engine/https://www.bleepingcomputer.com/news/security/gitlab-warns-of-max-severity-rce-flaw-in-regex-compiler-engine/An integer overflow in GitLab's CI/CD Regular Expression Compiler could let unauthenticated attackers execute code through a crafted pipeline regex; fixes are available in specified releases. GitLab operators should check exposure and patch promptly.Thu, 15 Oct 2026 06:22:59 GMTSecurityvulnerabilityhttps://daniel.haxx.se/blog/2026/10/14/a-uaf-turned-rce/https://daniel.haxx.se/blog/2026/10/14/a-uaf-turned-rce/A use-after-free in curl's HTTP/2 upload handling could lead to remote code execution; the write-up explains how it happened and discusses prevention work. Its reproducible report offers useful lessons for maintainers of network-facing C software.Thu, 15 Oct 2026 06:22:59 GMTSecurityvulnerabilityhttps://lwn.net/Articles/1100247/https://lwn.net/Articles/1100247/The disclosed flaws can escalate privileges to root on systems running Nix or Lix daemons, and affect systems that build untrusted derivations; fixes are available. This matters to infrastructure teams using these tools for builds and isolation.Thu, 15 Oct 2026 06:22:59 GMTSecurityvulnerabilityhttps://www.zetter-zeroday.com/who-is-planting-backdoors-in-ledger-crypto-wallets/https://www.zetter-zeroday.com/who-is-planting-backdoors-in-ledger-crypto-wallets/Hardware implants reported in Ledger wallets have been linked to about $102 million in stolen crypto, with reports spanning multiple device models and sellers. The investigation highlights the security risks of compromised hardware supply chains.Thu, 15 Oct 2026 06:22:59 GMTSecurityvulnerabilityhttps://simonkoeck.com/writeups/google-devsite-flask-session-pickle-rcehttps://simonkoeck.com/writeups/google-devsite-flask-session-pickle-rceThe researcher traced Google's developer-docs OAuth flow and decoded a large, signed Flask session cookie to inspect its contents. The investigation highlights how authentication flows and session handling can expose security-critical attack surfaces.Wed, 14 Oct 2026 06:38:54 GMTSecurityvulnerabilityhttps://blog.erincandescent.net/2026/10/mu-annoys-me/https://blog.erincandescent.net/2026/10/mu-annoys-me/The piece explains how signing a message hash can enable signatures on messages the signer has not seen, and compares protections in Ed25519 and ML-DSA. Protocol designers should understand how signature construction affects message-binding assumptions.Wed, 14 Oct 2026 06:38:54 GMTSecuritydeep-divehttps://github.com/colinhacks/zod/commit/d821685ea6732436fcdf786a81d076958471e467https://github.com/colinhacks/zod/commit/d821685ea6732436fcdf786a81d076958471e467The shown diff adds a push trigger to Zod's npm release workflow for changes to package manifests, replacing a previously manual release path. Engineers maintaining popular packages should scrutinize changes to publishing permissions and automation; the excerpt does not establish that malware was shipped.Wed, 14 Oct 2026 06:38:54 GMTSecuritynewshttps://words.filippo.io/right-answers/https://words.filippo.io/right-answers/The guidance says post-quantum transition plans now target completion by 2029, while symmetric cryptography remains sound and many asymmetric recommendations have changed. Engineers choosing cryptographic defaults should review the updated advice.Tue, 13 Oct 2026 08:14:15 GMTSecurityguidehttps://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllershttps://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllersResearch on the Danfoss AK-SM 800A found a hidden code-of-the-day mechanism that could bypass authentication and a command-injection flaw leading to remote code execution; Danfoss addressed the issues in firmware. The case illustrates risks in internet-connected operational technology, though it concerns a specific product.Tue, 13 Oct 2026 08:14:15 GMTSecurityvulnerabilityhttps://blog.kammel.dev/post/nixos_vex/https://blog.kammel.dev/post/nixos_vex/VEX documents provide machine-readable statements about whether a product is exposed to a known vulnerability, and the piece asks whether they can be generated automatically. Security and operations teams facing growing advisory queues may find the approach relevant.Mon, 12 Oct 2026 07:53:06 GMTSecuritydeep-divehttps://community.bitwarden.com/t/published-version-update-in-app-stores/102750https://community.bitwarden.com/t/published-version-update-in-app-stores/102750Bitwarden says upcoming app-store releases will use commercially licensed builds, while GPLv3 versions will continue to be published on GitHub and features remain available in both. The change matters to teams tracking the licensing and distribution of security software.Sun, 11 Oct 2026 07:44:51 GMTSecurityreleasehttps://cphpost.dk/2026-10-10/news/round-up/123456-password-used-in-massive-danish-cpr-data-breach/https://cphpost.dk/2026-10-10/news/round-up/123456-password-used-in-massive-danish-cpr-data-breach/At least three accounts, including an administrator account, reportedly used “123456” in a breach involving data linked to around 8.8 million CPR numbers. It is a stark reminder that weak account controls can expose critical personal data.Sun, 11 Oct 2026 07:44:51 GMTSecuritynewshttps://ndstudio.gov/posts/say-hello-to-ramparthttps://ndstudio.gov/posts/say-hello-to-rampartRampart combines regular expressions for identifiers with MiniLM to detect names and street addresses on-device. This offers a practical client-side layer for limiting what sensitive data reaches remote AI services.Sun, 11 Oct 2026 07:44:51 GMTSecuritytoolhttps://lwn.net/Articles/1097468/https://lwn.net/Articles/1097468/Python's random module is not suitable for passwords or tokens, while secrets is intended for those uses; the two have sometimes been confused despite the documentation. Engineers handling credentials should know which API provides the right security properties.Sun, 11 Oct 2026 07:44:51 GMTSecuritydeep-divehttps://www.bleepingcomputer.com/news/security/hackers-abuse-google-ads-bing-redirects-to-push-claude-clickfix-attacks/https://www.bleepingcomputer.com/news/security/hackers-abuse-google-ads-bing-redirects-to-push-claude-clickfix-attacks/The campaign routes Google ad clicks through Bing redirects and a compromised site to fake Claude installers, using cloaking to hide the payload from scanners. It illustrates how trusted redirect chains can complicate defenses against malvertising.Sun, 11 Oct 2026 07:44:51 GMTSecuritynewshttps://www.usenix.org/conference/usenixsecurity24/presentation/zhang-qibohttps://www.usenix.org/conference/usenixsecurity24/presentation/zhang-qiboESauron stimulates scene changes and detects the resulting electromagnetic patterns from camera memory activity to locate wired, wireless and offline spy cameras. The approach is a technically interesting example of sensing device behavior through side-channel emissions.Sat, 10 Oct 2026 07:39:10 GMTSecuritypaperhttps://beaksec.github.io/posts/telegram-desktop-one-click-account-takeover/https://beaksec.github.io/posts/telegram-desktop-one-click-account-takeover/A crafted link injects commands through Telegram Desktop's local socket, then invokes an internal URI that reads and sends a file without checking authorization. The chain enabled arbitrary file theft and account takeover; version 7.2.9 fixes it.Sat, 10 Oct 2026 07:39:10 GMTSecurityvulnerabilityhttps://karansaini.com/mmi-android/https://karansaini.com/mmi-android/The reported flaws let an attacker trigger MMI codes through a vulnerable dialer with little or no user interaction. The issue illustrates how app permissions and dialer handling can expose sensitive phone functions.Sat, 10 Oct 2026 07:39:10 GMTSecurityvulnerabilityhttps://00f.net/2026/10/06/zeroization-1/https://00f.net/2026/10/06/zeroization-1/The article shows how adding a zeroization call can result in more secret copies, including a `memset` example that the compiler optimizes away. Engineers handling secrets need to reason about generated code, not just source-level wipes.Thu, 08 Oct 2026 07:59:03 GMTSecuritydeep-divehttps://wiro.world/posts/calling-c-func-without-naming-it/https://wiro.world/posts/calling-c-func-without-naming-it/A student describes trying to get shell execution in a grading sandbox that rejects disallowed function names, and notes that the checker parses code with Clang. The technique is relevant to engineers designing source-based restrictions around untrusted code.Thu, 08 Oct 2026 07:59:03 GMTSecurityvulnerability