Today's outlook

Eight eMudhra CA keys compromised, forcing emergency distrust across browsers — Palo Alto PAN-OS under active ransomware attack

By The IT Security Desk

Good morning. The Hacker News reported that Mozilla and Google's Chrome Root Program confirmed on October 20 that the private keys of eight eMudhra intermediate certificate authority (CA) certificates are compromised. An intermediate CA signs the certificates that websites present, so anyone holding one of these keys could issue a certificate for any website. The Register reported that one of the compromised private keys was the number "4", that the flaw makes it possible to impersonate any website or service, and that a massive clean-up is under way. The Hacker News reported the compromise is triggering emergency fixes across browsers and software. Keep browsers current so that the root-program distrust reaches your estate; eMudhra-issued certificates are the affected set to check against.

The Register reported that Palo Alto Networks' firewall OS has been under attack from multiple ransomware groups since June, with Unit 42 investigating network compromises across numerous industries. CISA's Known Exploited Vulnerabilities catalogue lists CVE-2026-0322 in PAN-OS as known to be exploited; its advisory record gives a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and lists versions up to the fix in 10.2.0 as affected. Follow Palo Alto Networks' advisory for the fixed release and any interim mitigation, and apply CISA's BOD 26-04 patching timelines.

BleepingComputer reported that the PHP security team is warning administrators to prepare for emergency updates to address two critical vulnerabilities, and that information about the flaws leaked ahead of their scheduled disclosure. Plan for an out-of-band PHP patch cycle.

CISA added six vulnerabilities to its KEV catalogue on October 20 based on evidence of active exploitation, naming Plex Media Server, EG Secure Solutions SiteGuard Server Edition and Siemens Software Center. Match these products against your inventory and apply the catalogue's remediation dates.

Help Net Security reported that Google is updating Chrome's Enhanced Protection mode to detect scam sites and warn users when a page tricks them into copying a malicious command.

On breaches: BleepingComputer reported that Zeabur is shutting down after an attacker used plaintext internal credentials to steal over 3.2 million environment variable records and data on 321,810 accounts. The Record reported that the California Department of Education warned students that assessment contractor Educational Testing Service suffered a months-long data breach, and that 23andMe's successor will pay California $6 million over cybersecurity failings tied to a 2023 breach.