Waper
Use on the web

Cybersecurity

Major breaches and actively exploited vulnerabilities, threat research worth reading, and the policy and business moves in security.

  • Official
  • Public
  • 0 followers
Sign up to followCustomize it
You're reading the brief from Thu, Oct 22.
Back to the latest brief

Compromised eMudhra certificate-authority keys threaten TLS trust, while Microsoft linked a ConnectWise supply-chain attack affecting more than 2,200 tenants to a China-linked actor.

Cybersecurity5 items

PHP maintainers also issued urgent fixes for two critical vulnerabilities that could allow unauthenticated remote code execution.

Breaches & attacks

Eight eMudhra intermediate certificate-authority private keys compromised

Unit 42 reported that eight eMudhra intermediate certificate-authority private keys were compromised, creating risks of unauthorized TLS certificate signing and man-in-the-middle interception.

Why it matters: Compromised signing keys undermine certificate trust and could enable interception of connections users believe are secure.

Breaches & attacks

Microsoft links Storm-0940 to ConnectWise supply-chain attack

Microsoft attributed a ConnectWise supply-chain attack to China-linked Storm-0940. The actor used an AI-enabled penetration-testing tool to automate and accelerate its attack on more than 2,200 tenants.

Why it matters: The attack highlights how supplier access and AI-enabled tooling can expand the reach and speed of intrusions.

Breaches & attacks

Outdated cooling-system firmware costs EU supermarkets millions of euros

Hundreds of EU supermarket stores suffered losses totaling millions of euros involving outdated operational-technology firmware controlling cooling systems. The stores had relied on third parties to manage that firmware.

Why it matters: The losses demonstrate the direct operational and financial consequences of gaps in third-party OT maintenance.

Policy & business

Insurers diverge on coverage for agentic AI risks

Some insurers are developing specialized agentic AI coverage, while major carriers are excluding it. Those exclusions can leave enterprises exposed without their knowledge.

Why it matters: Businesses adopting AI agents may face coverage gaps that change how they assess and finance risk.

That's the whole brief

Feedback on an item only changes your own ranking.

Get this brief every morning

Follow it and each new brief shows up in your radar, or just subscribe by email. Every item links its sources.

Ask Kiki about this brief

Sign in to ask questions about this brief.

Recent briefs

  1. Tue, Nov 38 itemsA hijacked security-tool update channel delivered backdoors to Linux servers, while active exploitation hit Siemens industrial devices, Node-RED and Synology NAS systems. Other major developments include a breach affecting over 1.3 million people and a cyberattack on Brazil’s largest cryptocurrency exchange.
  2. Mon, Nov 26 itemsGoogle and partners disrupted a 1.3 million-device Android botnet, while active attacks continued against Ivanti gateways, GitLab servers and outdated BTCPay Server installations. New developments included Binance theft tracing and Polymarket’s reimbursement pledge.
  3. Sun, Nov 15 itemsThe FBI attributed the Binance crypto theft to North Korea-linked TraderTraitor, while a hijacked third-party script cost Polymarket traders about $2.7 million. Alpine Linux rebuilt its GitLab server after an attempted exploit, and newly detailed vulnerabilities affect Canonical infrastructure and Android phones.
  4. Sat, Oct 318 itemsActive exploitation of Ivanti Connect Secure flaws and a remote-root Linux kernel vulnerability lead this edition. Northflank and Chainalysis disclosed breaches, while OpenAI fixed a flaw that could expose private ChatGPT conversations.
  5. Fri, Oct 308 itemsBinance reported a $6.3 billion theft, while Florida disclosed a financial-aid breach exposing 4.9 million people’s Social Security numbers. A compromised coding extension and active exploitation of GitLab, Drupal and PHP flaws add immediate priorities for security teams.
  6. Thu, Oct 296 itemsActive exploitation of Cisco firewall, PHP and Brotli vulnerabilities makes patch prioritization urgent. Major data exposures affected DHS personnel and Sony ISP customers, while a cyberattack forced Moldova to take more than 80 public services offline.
  7. Wed, Oct 288 itemsCISA confirmed active exploitation affecting Brotli and Adobe Commerce, while a Sony subsidiary disclosed a breach involving approximately 2.5 million customer records. Other major developments include widespread public-service disruption in Moldova and new details of PHP2Shell attacks.

Who and what it tracks

  • CISAOrganization8
  • GoogleCompany5
  • MicrosoftCompany4
  • CrowdStrikeCompany2
  • Palo Alto NetworksCompany1