Eight eMudhra CA keys compromised, triggering emergency browser blocks

💥 BREACHES & INCIDENTS

• Eight eMudhra intermediate CA private keys compromised, triggering emergency browser and software blocks
  The private keys of eight eMudhra intermediate CA certificates have been compromised, prompting emergency blocks across major browsers and software platforms.
  • Affects clients trusting eMudhra/emSign intermediates chaining to roots in Mozilla, Chrome, Apple, and Microsoft trust stores; six TLS intermediates (DV/OV/EV, G3B/G3C) and two code-signing certs are compromised
  • A researcher known as Wayne demonstrated key control by signing the message 'We have a problem here - Wayne' with each of the eight keys and reported it to root programs on October 17, 2026
  • Anyone holding an intermediate key could issue fraudulent certificates for any website that browsers would accept; how the keys left eMudhra remains unknown
  • Chrome blocked the six TLS intermediates via CRLSet within hours and Firefox pushed a OneCRL block the same day; Apple blocked October 19, Microsoft October 20; eMudhra revoked the certificates
  • Fixes include Go 1.27.3/1.26.10 (CVE-2026-111943), Firefox 158.0.1 and ESR updates (CVE-2026-113470), NSS 3.131.1, Python certifi 2026.10.19, Rust webpki-roots 1.0.10, and Homebrew ca-certificates; Node.js and Composer fixes were pending
  Sources 📄 Source: blog.mozilla.org · 📎 Coverage: thehackernews.com · 👁 via The Hacker News, @campuscodi@mastodon.social (+2)

🔓 CVEs & KEV

• CVE-2026-113709 — argoproj argo-cd — CVSS 9.9 — Argo CD: A Kustomize Helm config home can run commands in the repo-serverArgo...

• CVE-2026-113708 — argoproj argo-cd — CVSS 9.9 — Argo CD: A Kustomize remote ref can run commands in the repo-serverArgo CD is...

• CVE-2026-113672 — argoproj argo-cd — CVSS 9.9 — Argo CD: A Jsonnet import can read files from the repo-serverArgo CD is a dec...

• CVE-2026-113802 — Wavlink WL-WN530BE1-A — CVSS 9.3 — Wavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.c...

• CVE-2026-105772 — Google ADK TypeScript (@google/adk) — CVSS 9.1 — Arbitrary file read and write in Google ADK TypeScript (@google/adk) FileArti...

• CVE-2026-113703 — giuseppe99barchetta SuggestArr — CVSS 9.1 — SuggestArr Authentication Bypass via X-Forwarded-For Spoofing Grants Unauthenticated Admin Access

• CVE-2026-111756 — follow-redirects — CVSS 8.2 — follow-redirects array-form headers bypass cross-origin credential strippingf...

🕵️ RESEARCH & DEEP DIVES

• Two claimed 10.0-severity PHP RCEs (CVE-2026-109618/109619) leaked before patch CVE-2026-109618 CVE-2026-109619
  Details of two unpatched PHP vulnerabilities claimed to be 10.0-severity RCEs have been leaked ahead of the official patch.

  • Affects PHP 5 and later, per claims circulating ahead of a Thursday announcement
  • Two CVEs — CVE-2026-109618 and CVE-2026-109619 — were leaked before a patch is available
  • The flaws are claimed to be 10.0 CVSS remote code execution vulnerabilities in PHP
  • The leak was flagged by Kevin Beaumont on Cyberplace and discussed on r/netsec
  Sources 📄 Source: reddit.com · 📎 Coverage: runtimewire.com · 👁 via @GossiTheDog@cyberplace.social, r/netsec

• CVE volumes surge to record levels as AI-driven discovery strains NVD and disclosure models
  AI-assisted vulnerability discovery has driven CVE volumes to record highs, overwhelming NVD enrichment and traditional disclosure processes.

  • Affects all organizations relying on NVD enrichment, Microsoft Patch Tuesday advisories, and open-source components
  • Monthly Microsoft Patch Tuesday advisories jumped from a pre-June average of ~100 to 975 in September and 1,415 this month, a more than tenfold increase
  • NIST received 263% more CVE submissions between 2020 and 2025 and will now enrich only priority CVEs (KEV catalog, federal and critical software), leaving others labeled lowest priority
  • Most new findings come from AI models mining decades-old code in legacy libraries; only 3 of September's 975 Microsoft advisories saw in-the-wild exploitation, and KEV grew just 37% versus a 105% CVE surge
  • The NVD analysis backlog climbed from ~13,000 in mid-2024 to over 25,000, and mean time-to-exploit turned negative (~-7 days in 2025) as attackers weaponize flaws before disclosure
  Sources 📎 Coverage: blog.talosintelligence.com · 👁 via Cisco Talos

• TikTok disrupted its largest August influence operation, targeting Haiti with Putin narratives
  TikTok disrupted its largest covert influence operation of August, which targeted Haiti with pro-Putin narratives.

  • TikTok users and audiences in Haiti were the target of the operation.
  • The network pushed Putin-aligned narratives aimed at Haitian audiences.
  • TikTok disclosed the disruption in its Covert Influence Operations transparency report.
  • The operation was the largest info-op TikTok disrupted in August 2026.
  Sources 📄 Source: tiktok.com · 📎 Coverage: mastodon.social · 👁 via @campuscodi@mastodon.social

• OffiDocs' 60 Chrome extensions with 2.3M installs exfiltrate users' browsing URLs
  OffiDocs' Chrome extensions covertly exfiltrate users' full browsing URLs via hex-encoded requests.

  • Affects users of 60 OffiDocs Chrome extensions with 2.3 million installs across four publisher accounts (officeonlinesystems, RedcoolMedia, ApkOnline, RunApps), plus 51 Firefox extensions and some on Edge and 360 store.
  • 37 of the 60 extensions hex-encode and exfiltrate every URL visited to offidocs.com and runapps.org endpoints, tagged with a per-install user ID, without explicit user consent.
  • Extensions include popular office tools like LibreOffice Editor, XLS Editor, Document Editor, and Ubuntu free online linux server, many marked Featured on the Chrome Web Store.
  • Server replies can trigger chrome.tabs.update() to redirect the user's tab to OffiDocs pages on redcoolmedia.net or runapps.org, decided per user and per URL.
  • The VPNOnline free VPN routes traffic through plain HTTP proxies and reports URLs matching a server-controlled keyword list downloaded hourly from onworks.net, with no URL-collection disclaimer.
  Sources 📄 Source: offidocs.com · 📎 Coverage: amibeingpwned.com · 👁 via r/netsec

📋 ADVISORIES

• BeyondTrust Remote Support arbitrary file upload flaw exploited as zero-day by ARMORY CASTLE
  A vulnerability in BeyondTrust Remote Support allowing arbitrary file uploads was exploited as a zero-day by a suspected PRC-nexus espionage actor.

  • Affects BeyondTrust Remote Support all versions through 26.2.3 (CVE-2026-102764); SaaS deployments are already patched, self-hosted deployments must apply the patch manually
  • The flaw exists in internal components that did not adequately validate the origin of received messages, enabling arbitrary file uploads and file operations on the appliance
  • Mandiant identified that ARMORY CASTLE (formerly UNC5221), a suspected PRC-nexus espionage actor, exploited the vulnerability as a zero-day in late August 2026, using multiple TTPs for foothold, privilege escalation, and lateral movement
  • CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog on Oct. 16, 2026
  • Exploitation is via Exploit Public-Facing Application (T1190) for initial access; risk rated HIGH for large/medium government and business entities
  Sources 📎 Coverage: cisecurity.org · 👁 via CIS Advisories

• NIST, CISA and NSA Detail Ten Voluntary Practices for Rogue AI Agent Incident Response
  NIST, CISA and NSA have published ten voluntary practices for preparing for, detecting, responding to, recovering from, and reporting rogue AI agent incidents.

  • Guidance applies to organizations deploying complex agentic AI systems, particularly the frontier SI industry, using 'super intelligence' terminology per executive order 14434.
  • The ten practices are grouped into five stages: prepare, detect, respond, recover, and report, with definitions for AI agents, AI control incident, and AI control near-miss.
  • Preparation covers asset and risk inventories, defense-in-depth, least privilege, zero-trust controls, credential management, and supply chain risk management.
  • Response entails isolating affected systems, revoking credentials, rebuilding compromised environments, determining blast radius, and root-cause analysis.
  • Final practices require notifying government per legal obligations (including CISA reporting) and sharing incident details publicly where appropriate.
  Sources 📎 Coverage: securityweek.com · 👁 via SecurityWeek

• YOOtheme Pro 5 critical security update scheduled for 21 October
  YOOtheme has pre-announced a critical security update for YOOtheme Pro 5, due 21 October at 16:00 CEST.

  • Applies to all sites running YOOtheme Pro 5 on Joomla or WordPress; Pro 4 and earlier are not affected.
  • The flaw is rated critical, affects every Pro 5 build, and was reported to YOO