Disgraced eMudhra drops out of TLS business after using cert private key of 4
eMudhra, the certificate authority that issued eight intermediate TLS credentials so weak that anyone could mint certificates for any website or mail server—one had a…
Category: ArsTechnica
Hackers got a four-day head start on epic PHP2Shell vulnerability
Amazon has warned that vulnerabilities in a programming language that underpins much of the Internet, discovered using AI tools, are being “broadly exploited” as governments…
333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email
Unknown hackers hijacked more than 300 Tor exit nodes and reconfigured them to favor unencrypted email traffic and redirect SSH connections through servers they controlled,…
PHP warns it plans to release 2 emergency patches imminently
Website admins, brace yourselves. Fixes for what are believed to be uncommonly severe vulnerabilities are scheduled to drop in a little more than 12 hours…
The Internet goes on high alert after discovery of 8 compromised TLS certs
Heartbleed is the name of a critical vulnerability in the OpenSSL cryptography library. In 2014, it came under mass exploitation. Exploits let many unaffiliated hackers…
Meta Muse exposes users’ personal and business secrets when they share conversations
Muse, the new general-purpose AI agent from Meta, can expose sensitive information when users share conversations through Web links, researchers reported Monday. Like many online…
PSA: Patch your Plex media server before someone hacks it
The published exploit chain was part of a proof-of-concept attack that the first researcher included when submitting a bug report to Plex. The complex code…
OpenAI models hacked a crypto wallet and breached more websites
In the other incident, a model instructed to retrieve figures from a public research dashboard bypassed the organization’s security controls and used the unauthorized access…
Targeted ads delivered 0-click exploits to install mercenary malware
Among the major vendors that listed Discover-Tech as a “certified” or “verified” vendor were Google and the advertising industry association IAB Europe. The Israeli firm…
Fridge hack costing millions and sparking fires stemmed from poor security
Besides running controllers with outdated firmware, the affected stores likely also failed to put the devices behind a VPN and create a restricted list of…
Anthropic warns small AI models could self-replicate through IoT devices
This finding was the starting point for further research that asked: Would it be possible for small models to create self-replicating infections that run themselves…
Let’s Encrypt cuts certificate lifetimes to 64 days starting February 2027
Let’s Encrypt is continuing a push toward tighter security by reducing free SSL/TLS certificate lifetimes from 90 days to 64 days, starting February 10, 2027.…