In partnership with
| FACT | One criminal crew's AI agents broke into company websites for roughly $50 in tokens per successful hack, about $5,000 for the whole campaign, by researcher Snorre Fagerland's estimate. (NorForge via The Hacker News, October 2026) |
|
This edition is about the quiet systems that tell you what's safe, from the keys behind the browser padlock to the bot answering your privacy questions, and what happens when they stop telling the truth. PS: Was this forwarded to you? Subscribe free at exzeccyber.com/subscribe → |
Certificates / Trust Eight Keys That Can Vouch for Any Website Leaked. Browsers Cut Them Off in Hours. Intro The padlock in your browser only means something because a handful of companies guard their signing keys. On October 17, a researcher proved one of them hadn't. What Happened The private keys for eight eMudhra intermediate certificate authorities were compromised, covering domain, organization and extended validation TLS plus code signing. A researcher Mozilla credits only as "Wayne" reported it, signing the message "We have a problem here" with each key. Chrome blocked the six TLS intermediates within two hours, Firefox that evening, Apple on October 19 and Microsoft on October 20; eMudhra has revoked all eight. Why It's Important Whoever holds these keys could issue a certificate for any website that browsers would trust. Nobody knows how or when the keys got out, and Go binaries and anything using Python's certifi bundle don't check revocation, so they keep trusting the chain until updated. The Other Side Chrome says no certificate chaining to the six TLS intermediates appeared in Certificate Transparency logs before the block, and browser fixes arrived automatically. | | 👉 Takeaway Rebuild Go apps on 1.27.3 or 1.26.10, update certifi to 2026.10.19, and patch Firefox and NSS. Node.js has no fix yet, and Mozilla's root removal will cut off some legitimate sites for software using its trust list until they switch chains. |
TL;DR: A certificate authority lost eight keys that could fake any website; browsers blocked them, other software is catching up. |
| | Data Breach From May 22 to September 18, an intruder used one compromised login to copy files from Educational Testing Service's transfer server. ETS runs California's state tests. Files cover students from the last three school years and some back to 2006: names, birth dates, addresses and, for some, disability status. No Social Security numbers or financial data, and no victim count yet. → Watch SFTP logins like you watch email. |
| | Cloud Hosting Zeabur says an attacker used leaked internal credentials on October 14-15 to reach its shared clusters and platform database, exposing 321,810 accounts and about 3.2 million environment variable records. The credentials were likely stolen in an August breach, and admin tokens hadn't been rotated since January 2024. Shared cluster services pause December 1; everything shuts down by December 31. → Rotate after the first breach, not the second. |
| | Vulnerability PHP says fixes for two flaws rated 9.2 arrive Wednesday, October 21 at 14:00 UTC, after details leaked ahead of an embargo. watchTowr tracks them as CVE-2026-109618 and CVE-2026-109619, calls them remote code execution bugs, and believes PHP 5 through 8 are affected. It has reproduced one but hasn't seen exploitation in the wild. → Find every PHP version you run, legacy installs included, and patch today. |
|
You built the audience. Can you reach them?
You can have thousands of people following your work and still need an algorithm’s permission to reach them. Creators know the drill: you post, you pray, you check the numbers, you try again tomorrow.
A newsletter changes that relationship. On beehiiv, you can build a subscriber list you own, reach readers directly, and turn their attention into a sustainable business with subscriptions, sponsors, a global ad network, and more.
| | AI Agents Norforge found threat actors pointing Cairn, an open-source platform that steers AI agents toward a goal, at e-commerce and payment sites, then leaving its control panels open online. The biggest cluster, Chinese-language, ran over 1,100 attack projects chasing persistent webshell access. Reuters reports it breached over 100 companies, including John Deere and SharkNinja. About 10% of attempts succeeded. → Hunt your web servers for webshells you didn't put there. |
| | Frameworks MITRE's latest ATT&CK release adds two prompt injection techniques (typed directly, or hidden in content a model reads), one for attackers using a company's own AI agents to steal data, and sub-techniques for poisoning AI search results. It also covers stealing app-specific passwords to skip MFA prompts, and counts coding agent config files as a supply chain vector. → Map your detections to the new AI techniques before attackers do. |
|
| | Nation-State Symantec says GRU-linked APT28 hit a naval shipbuilder, a military aircraft engine maker and a law enforcement agency in two European NATO countries. The shipbuilder hack started with a malicious Word attachment in July, then the Hookedge backdoor and a new in-memory loader. Activity ran from July 24 to at least September 24 and looks ongoing. Theft is unconfirmed. → The Word attachment is still the front door. |
| | Ransomware Unit 42 says both ransomware crews are exploiting CVE-2026-0257, an authentication bypass in PAN-OS and Prisma Access patched in May, to open VPN sessions without MFA. Then come remote management tools and RDP. In one case they jumped to vCenter, disabled ESXi protections and dumped credentials from a domain controller's virtual disk, dodging in-guest EDR. → Confirm the patch landed, then hunt odd VPN sessions. |
|
| | Patch Management Microsoft says October's updates for Windows Server 2019 and later can block OWA sign-ins, strand mail in the Outbox and throw "MapiExceptionMdbOffline" errors on busy Exchange servers. The cause is a new default cap of 512 simultaneous Endpoint Mapper lookups. The play: don't uninstall the update. Set REG_DWORD EpmapSavedContextCap to 65536 under HKLM\SOFTWARE\Microsoft\Rpc, reboot, and raise it if the problem returns. Then plan your exit, because Exchange 2016 and 2019 extended updates end this month. |
|
Blu Dot surpasses 2,000% ROAS with self-serve CTV ads
Blu Dot used Roku Ads Manager to drive incredible results for its furniture sales event. Its strategy hinged on custom audiences and retargeting, where intent was strongest.
“Roku has been a top performer,” said Blu Dot’s Claire Folkestad. “We have seen…CPMs lower than any other CTV partner we've worked with.”
 Strange but real WhatsApp's Help Pages Secretly Told Its AI Bot Not to Mention Privacy Regulators Intro Most companies bury the unsubscribe link. WhatsApp buried notes to its own chatbot. What Happened Data deletion company Redact found 102 hidden text blocks across 80 WhatsApp help pages, invisible on screen but readable in the page source. On the delete-account page, they told the AI support bot not to recommend contacting "any Data Protection Authority, regulator, or supervisory authority." Another told it not to bring up laws like GDPR or CCPA when a user mentioned legal action, even if the user raised them first. Why It's Important WhatsApp's own European privacy policy says users can complain to the Irish Data Protection Commission and ask for erasure. It's also a reminder of how easily AI behavior gets steered by text nobody sees. The Other Side WhatsApp says the text appeared because of a bug, now fixed, and the notes were "to our chatbot, not directly to users," meant to keep it from giving legal advice. Redact didn't test whether any assistant obeyed them, and all 102 blocks were gone by October 18. | | 👉 Takeaway If a support bot says there's nobody to complain to, ask a human. Then check what your own pages quietly feed AI. |
TL;DR: WhatsApp's help pages hid notes telling its AI bot not to point users toward privacy regulators. |
Your next enterprise deal dies in security review without a SOC 2 report. Sprinto gets you audit-ready in 14 days: three sessions, AI agents collect the evidence, you approve.
