October 21, 2026

What happened

The PHP security team announced an urgent release scheduled for 21 October 2026 at 14:00 UTC, addressing two vulnerabilities rated 9.2 (Critical) under CVSS v4.0. [1] [2]

The notice does not yet describe the vulnerabilities or identify the affected PHP versions; those details and patched version numbers are expected with the release. [3] [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   The PHP security team has announced an urgent security release for Wednesday, 21 October 2026 at 14:00 UTC.

2. [2]

   The release fixes two vulnerabilities, each rated 9.2 (Critical) under CVSS v4.0.

3. [3]

   The notice doesn’t yet describe the vulnerabilities or say which PHP versions they affect.

4. [4]

   The project will publish those details, along with the patched version numbers, when the release goes out.

Read the original article →

What happened

Vince Stoffer, Field CTO at Corelight, discusses how AI is changing SOC work and how attackers are using similar tools. [1]

The video describes LLM use for vulnerability analysis and detection engineering, including writing SIEM rules and small programs that analyze packets or Zeek metadata. [2]

Why it matters

Users of agentic triage report faster work and fewer false positives, while junior analysts can investigate network data more deeply. [3]

The post highlights shadow AI and loose permissions as issues to watch when bringing AI into the SOC. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   In this Help Net Security video, Vince Stoffer, Field CTO at Corelight, talks about how AI is changing work in the SOC and how attackers are using the same tools.

2. [2]

   He explains how LLMs help with vulnerability analysis and detection engineering, including writing SIEM rules and small programs that analyze packets or Zeek metadata.

3. [3]

   Those using agentic triage report faster work and fewer false positives, and junior analysts can dig deeper into network data.

4. [4]

   Stoffer … More → The post Bringing AI into the SOC means watching for shadow AI and loose permissions appeared first on Help Net Security .

Read the original article →

What happened

PHP planned an out-of-cycle security release at 14:00 UTC on October 21 for two critical vulnerabilities rated 9.2 under CVSS v4.0; the security team had not described them at the time of writing. [1] [2]

Known limitations

The story was written before the scheduled release, so the affected and fixed PHP versions were not yet confirmed in the available evidence. [1] [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   This story is developing and was written before PHP's scheduled 14:00 UTC release on October 21.

2. [2]

   PHP will ship an out-of-cycle security release at 14:00 UTC today, October 21, for two critical vulnerabilities that its security team has rated 9.2 on the CVSS v4.0 scale but has not described.

3. [3]

   Once the release is out, the affected and fixed versions below are confirmed by the official advisory.

Read the original article →

What happened

Security teams use tools spanning code, endpoints, cloud infrastructure, identity, and secrets management, while credentials cut across all of these areas. [1] [2]

The article gives an example of a developer finding an AWS key in a repository and says the first step is to remove it. [3] [4]

Why it matters

Removing a discovered key does not answer whether it remains active, who owns it, or what it can access. [4] [5] [6] [7]

Known limitations

The source also raises whether the same credential exists in a CI/CD variable, a local .env file, or a Slack thread, but the supplied text is truncated after this list. [8]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Security teams have tools for code, endpoints, cloud infrastructure, identity, and secrets management.

2. [2]

   Credentials cut across all of them.

3. [3]

   A developer finds an AWS key in a repository.

4. [4]

   The first step is obvious: remove it.

5. [5]

   But that does not answer the questions the security team now has: Is the key still active?

6. [6]

   Who owns it?

7. [7]

   What can it access?

8. [8]

   Is the same credential sitting in a CI/CD variable, a local .env file, a Slack thread, … More → The post Why security tools lose sight of the credential appeared first on Help Net Security .

Read the original article →

What happened

DevGuard is a free, open-source vulnerability-management platform that centralizes a software project’s security findings, ranks them by risk, and tracks them. [1]

DevGuard is an OWASP Incubating Project and can be self-hosted by anyone. [2]

Through one command-line interface, DevGuard runs six scan types: secret scanning, static code analysis, dependency checks against known CVEs, infrastructure-as-code checks, container scanning, and license checks. [3]

Why it matters

DevGuard combines multiple open-source security tools behind a single CLI for software-supply-chain vulnerability management. [1] [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   DevGuard is a free, open source vulnerability management platform that collects a software project’s security findings in one place, ranks them by risk, and tracks them.

2. [2]

   It’s an OWASP Incubating Project, and anyone can self-host it.

3. [3]

   One command line, six scans DevGuard runs secret scanning, static code analysis, dependency checks against known CVEs, infrastructure-as-code checks, container scanning, and license checks through one CLI that wraps existing open source tools.

Read the original article →

What happened

Citizen Lab found with high confidence that Vladan Đokić, rector of the University of Belgrade, had an iPhone infected with NSO Group’s Pegasus spyware in 2026. [1] [2] [3]

The infection used a zero-click exploit, so Đokić did not need to tap, open a file, or take another action to trigger it. [4] [5] [6]

Rade Bajić, a senior prosecutor, received Apple Threat Notifications on August 13 and 27; Citizen Lab treated this as a high-confidence indicator of likely mercenary-spyware targeting, but forensic analysis has not confirmed infection. [13] [14] [15] [16]

Citizen Lab did not identify who attacked Đokić’s phone; Pegasus is sold only to governments and state agencies, limiting the possible operators. [17] [18]

The two cases brought the reported total to at least 16 Serbian civil-society members targeted or infected with commercial spyware in 2026. [19] [20]

Why it matters

Once installed, Pegasus can provide its operator access comparable to the device owner’s, including private and encrypted messages and covert microphone or camera activation. [7] [8] [9]

The discovery occurred six days before Serbia’s October 25 snap parliamentary elections; Đokić had been publicly discussed as a possible Student List leader and had opposed a government crackdown on protesters. [10] [11] [12]

Source-supported guidance

The source recommends enabling iPhone Lockdown Mode immediately, keeping iOS updated, and having close contacts and colleagues screened. [21]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   The Citizen Lab published a research note confirming that the iPhone of Vladan Đokić, Rector of the University of Belgrade, was infected with NSO Group’s Pegasus spyware sometime in 2026.

2. [2]

   “In collaboration with the SHARE Foundation, we found with high confidence that Professor Vladan Đokić, Rector of the University of Belgrade, and prominent supporter of the Serbian student movement, was hacked with NSO Group’s Pegasus spyware in 2026.” states Citizen Lab .

3. [3]

   The Citizen Lab found the infection with high confidence and describes the investigation as ongoing.

4. [4]

   The infection used a zero-click exploit, meaning Đokić did nothing to trigger it.

5. [5]

   No tap, no opened file, nothing.

6. [6]

   The infection leveraged a zero-click exploit.” In a statement published by the university, Đokić called the spyware “ another attempt of intimidation .” He called for an independent investigation, the public release of its findings, and criminal prosecution of those responsible.

7. [7]

   Citizen Lab explained what a Pegasus infection means.

8. [8]

   Once installed, the spyware can give its operator the same access to a device as its owner.

9. [9]

   This includes private and encrypted messages, and the ability to turn on the microphone and camera without the owner’s knowledge.

10. [10]

    Đokić became a prominent figure in Serbia’s student-led pro-democracy movement after refusing to facilitate a government crackdown on protesters.

11. [11]

    The discovery came just six days before Serbia’s snap parliamentary elections on October 25.

12. [12]

    Until September, Đokić had been publicly named as a possible candidate to lead the Student List.

13. [13]

    “Additionally, we note that Rade Bajić, who, as a prosecutor, investigated official corruption in a failed project in Belgrade, received an Apple Threat Notification.” continues Citizen Labs.

14. [14]

    He received an Apple Threat Notification on August 13 and a reminder on August 27.

15. [15]

    The Citizen Lab treats this as a high-confidence indicator that his device was likely targeted with mercenary spyware.

16. [16]

    Forensic analysis of his device is still ongoing and no confirmation of infection has been published yet.

17. [17]

    Citizen Lab did not identify who was behind the attack on Đokić’s phone.

18. [18]

    Pegasus is sold only to governments and state agencies, which limits the number of possible operators.

19. [19]

    Citizen Lab confirmed Pegasus on a Serbian rector’s iPhone 6 days before elections, raising the known civil society spyware target count to 16.

20. [20]

    These two cases bring the known total to at least 16 members of Serbian civil society targeted or infected with commercial spyware in 2026.

21. [21]

    Enable Lockdown Mode on your iPhone immediately, keep iOS updated, and get your close contacts and colleagues screened as well.

Read the original article →

What happened

CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog, including vulnerabilities affecting Plex Media Server that are collectively called Plex2Shell. [1]

The supplied evidence identifies CVE-2026-96652 as a Plex Media Server server-side request forgery vulnerability with a CVSS score of 5.3. [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including four vulnerabilities impacting Plex Media Server that's collectively called Plex2Shell.

2. [2]

   The vulnerabilities are listed below - CVE-2026-96652 (CVSS score: 5.3) - Plex Media Server Server-Side Request Forgery (SSRF)

Read the original article →

What happened

State Bank of India identified 3,897 customer records containing personal information among approximately 375,000 records available on the dark web. [1]

The bank said it experienced an incident involving the loss of certain data, but it does not yet know where the identified data came from. [1] [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   State Bank of India has identified 3,897 customer records containing personal information in a set of about 375,000 records available on the dark web, and it does not yet know where the data came from.

2. [2]

   The state-owned bank, India's largest, said in a stock-exchange filing dated October 21 that it "has experienced an incident involving the loss of certain data." The count is

Read the original article →

What happened

A Department of Homeland Security order requires U.S. federal civilian agencies to remove DeepSeek products from their information technology systems. [1]

The removal requirement also covers third-party products or services developed using DeepSeek implementations. [1]

Federal civilian agencies may no longer purchase information technology products or services from DeepSeek or its affiliates. [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   federal civilian agencies must remove DeepSeek products from their information technology systems, along with any third-party products or services "developed using DeepSeek implementations," under a Department of Homeland Security order.

2. [2]

   They may also no longer buy information technology products or services from the Chinese AI developer or its affiliates Homeland Security Secretary

Read the original article →

What happened

Apple’s new anti-tracking protections in Safari and WebKit block connections to identity-resolution services that convert email addresses into persistent tracking identifiers. [1]

The described post-cookie method lets a third party collect a user’s email address when the user logs in to a website or signs up for a newsletter. [2]

Why it matters

The article describes the tracking process as sending the collected email address to a provider’s servers, which creates a tracking ID; the supplied text is truncated before the process is fully described. [2] [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Apple’s new anti-tracking protections in Safari and WebKit, the open-source web engine used by Safari, block connections to identity resolution services that turn email addresses into persistent tracking identifiers.

2. [2]

   How email addresses become tracking IDs This “post-cookie” tracking method allows a third party to collect a user’s email address when they log in to a website or sign up for a newsletter.

3. [3]

   The provider sends the address to its servers, creates a tracking ID permanently … More → The post Safari blocks trackers that turn your email into a tracking ID appeared first on Help Net Security .

Read the original article →

What happened

OVHcloud said a hacker tampered with its open-source command-line interface tool to distribute information-stealing malware. [1]

The affected OVHcloud CLI versions were v0.11.0 through v0.15.0; v0.10.0 was unaffected, and a new v0.16.0 release was available. [2] [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   OVHcloud, the French cloud computing and web hosting company, alerted customers that a hacker tampered with its open-source command-line interface (CLI) tool to spread information-stealing malware.

2. [2]

   According to Klaba, five versions of the CLI were modified, from v0.11.0 through v0.15.0.

3. [3]

   Version v0.10.0 was unaffected, and the new v0.16.0 release … More → The post Info-stealing malware slipped into OVHcloud CLI releases on GitHub appeared first on Help Net Security .

Read the original article →

What happened

Unknown threat actors breached TeamUpdraft's website and potentially obtained customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to backdoor WordPress sites. [1]

TeamUpdraft develops UpdraftPlus, a WordPress backup plugin with more than four million active installations. [2]

Known limitations

The supplied evidence does not establish the scope of affected customers, the number of compromised sites, or whether the unauthorized access was confirmed for each named service. [1]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Unknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to backdoor WordPress sites.

2. [2]

   TeamUpdraft is the developer behind UpdraftPlus, a popular WordPress backup plugin with over four million active installations.

Read the original article →

What happened

ThreatLocker announced Zero Trust AI Control (ZTAIC), a tool intended to help organizations deploy agentic AI while retaining control of their environments. [1]

ZTAIC is described as allowing security teams to provide AI agents with only the access needed for their tasks while restricting other access, including when agents invoke applications and processes. [2]

Why it matters

The announcement characterizes ZTAIC as adding external controls for AI-agent access and execution, in contrast to relying only on behavioral guardrails. [2] [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   ThreatLocker has announced the launch of Zero Trust AI Control (ZTAIC), giving organizations a tool to deploy agentic AI without surrendering control of their environments.

2. [2]

   ZTAIC enables security teams to give AI agents exactly what they need to perform their jobs while keeping everything else out of reach, even as agents invoke other applications and processes to take action.

3. [3]

   AI guardrails aspire to define how an agent should behave, but AI continues to find ways … More → The post ThreatLocker adds external controls for AI agent access and execution appeared first on Help Net Security .

Read the original article →

What happened

Grafana Labs announced a Knowledge Graph in every Grafana Cloud stack, along with new Digital Experience Monitoring capabilities and updates to Grafana Cloud Incident Response Management. [1]

Why it matters

The releases connect infrastructure and application dependencies with user experience and incident response, providing shared context for people and agents investigating problems and taking action. [2]

The article states that increasingly complex agentic systems and teams using agents to investigate and respond to problems require context that connects relevant information. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Grafana Labs has announced a Knowledge Graph in every Grafana Cloud stack, alongside new Digital Experience Monitoring capabilities and updates to Grafana Cloud Incident Response Management (IRM).

2. [2]

   The releases connect infrastructure and application dependencies with user experience and incident response, giving people and agents shared context to investigate problems and take action.

3. [3]

   As agentic systems become more architecturally complex and teams use agents to investigate and respond to problems, those agents need context that connects … More → The post Grafana Labs connects observability and incident response with Knowledge Graph appeared first on Help Net Security .

Read the original article →

What happened

A researcher found that attackers controlled more than 300 Tor exit relays in early October and used them to redirect SSH connections to servers that stole login passwords. [1]

Tor exit relays are the final hop in a Tor circuit, where traffic leaves the network for its destination. [2]

Known limitations

The supplied evidence limits the described interception to password logins made to an SSH server through Tor between October 1 and 5, after the user accepted the interception. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Attackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections to servers that stole login passwords, a researcher found.

2. [2]

   Exit relays are the last hop in a Tor circuit, where traffic leaves the network for its destination.

3. [3]

   Only a password login to an SSH server made through Tor between October 1 and 5, after accepting the interception

Read the original article →

What happened

The source states that an AppSec team can direct an AI agent running on a general-purpose model at its own web applications with little setup. [1]

The source attributes attack generation to the model, while placing the engineering needed to run attacks safely against production and make the results actionable in the surrounding harness. [2] [3] [4]

Known limitations

The supplied excerpt mentions an intrusion disclosed by OpenAI in July but does not provide enough context to characterize that incident. [5]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   An AppSec team can point an AI agent running on a general-purpose model at its own web apps with little setup.

2. [2]

   Sure, the model writes the attacks.

3. [3]

   But everything that makes those attacks safe to run against production and worth acting on afterward lives in the harness around the model.

4. [4]

   The harness is where the engineering in AI pentesting sits.

5. [5]

   The Hugging Face intrusion OpenAI disclosed in July

Read the original article →

What happened

PHP is scheduled to release a fix at 14:00 UTC on October 21 for two critical PHP2Shell flaws, each rated 9.2 out of 10. [1]

The security firm that suggested a workaround now says the two PHP2Shell flaws cannot be fully blocked before the fix, and that workaround is insufficient on its own. [2]

PHP has not provided its own workaround for the flaws. [1]

Known limitations

The supplied evidence truncates the article before stating what protections lower risk until the fix can be installed. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   PHP will release the fix at 14:00 UTC on October 21 for two flaws it rates 9.2 out of 10, and has given no workaround of its own.

2. [2]

   You cannot fully block the two critical PHP flaws called PHP2Shell before today's fix, and the one setting being passed around as a workaround is not enough on its own, the security firm that suggested it now says.

3. [3]

   Until you can install it, what lowers your

Read the original article →

What happened

Several ransomware groups have exploited CVE-2026-0257, an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect, against organizations in healthcare, education, government, and energy. [1]

The flaw affects the GlobalProtect portal and gateway on Palo Alto Networks physical and … [source text truncated]. [2]

CVE-2026-0257 results from reliance on cookies without detailed validation and integrity checking, enabling remote unauthenticated attackers to bypass security restrictions and establish an unauthorized VPN connection. [3]

Why it matters

The article states that exploitation began in June, while also stating that PAN-OS GlobalProtect was patched in May. [1]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Several ransomware groups are exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks’ PAN-OS GlobalProtect patched in May, to break into organizations in sectors ranging from healthcare and education to government and energy.

2. [2]

   The vulnerabilities affect the GlobalProtect portal and gateway of PAN’s physical and … More → The post Ransomware gangs have been exploiting Palo Alto GlobalProtect VPN flaw since June appeared first on Help Net Security .

3. [3]

   CVE-2026-0257 stems from the firewalls relying on cookies without performing detailed validation and integrity checking, which allows remote, unauthenticated attackers to bypass security restrictions and establish an unauthorized VPN connection.

Read the original article →

What happened

Proofpoint reports that generative AI is producing malicious emails that are fluent, personalized, and unique to each recipient. [1] [2]

Why it matters

The article states that email filters’ longstanding behavioral signals are fading as malicious messages become less distinguishable through wording, pretexts, and reused templates. [2]

Known limitations

Proofpoint shared examples of this shift at its Protect 2026 conference; the supplied text does not provide quantitative results or establish how broadly the change affects detection performance. [2] [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Generative AI has changed what a malicious email looks like.

2. [2]

   Messages that once gave themselves away through clumsy wording, generic pretexts, and reused templates now arrive fluent, personalized, and unique to each recipient, and the behavioral signals email filters have relied on for years are fading as a result.

3. [3]

   Proofpoint shared several examples of the shift at its Protect 2026 conference.

Read the original article →

What happened

Researchers disclosed Bronze Sandcastle, a previously undocumented China-aligned threat cluster observed targeting organizations in Asia and Africa since mid-2025. [1]

Sophos researcher Gabor Szappanos identified consistent Sandboxie DLL sideloading as Bronze Sandcastle’s most distinctive technical marker. [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Cybersecurity researchers have disclosed details of a previously undocumented China-aligned threat cluster known as Bronze Sandcastle that has been observed targeting organizations in Asia and Africa since mid-2025.

2. [2]

   "The most distinctive technical marker for Bronze Sandcastle is its consistent use of Sandboxie DLL sideloading," Sophos security researcher Gabor Szappanos said in a post published

Read the original article →

What happened

DHS ordered federal civilian agencies to remove DeepSeek and affiliated products, including third-party products and services developed using DeepSeek implementations, and barred their acquisition. [1] [2]

The order cites national-security concerns; reporting said DHS viewed DeepSeek models as potentially transferring sensitive data to China and potentially containing malware or other security vulnerabilities. [3] [4]

The ban took effect when issued, while existing contracts become covered only after the contracting officer formally updates them; agencies can request an exception with a strong justification. [11] [12]

Why it matters

The order does not apply to private companies or ordinary users, but government contractors may be affected and generally cannot use covered products or services for federal contracts without a waiver. [5] [6]

Source-supported guidance

The source says agencies should check their systems, while suppliers should disclose which AI models they use, where those models process data, and whether information leaves the customer’s environment. [7] [8]

Known limitations

The notice does not explain exactly what qualifies as a “DeepSeek implementation,” so agencies must ask suppliers whether their products fall under the ban. [9] [10]

DHS signed the order on July 24, 2026, but published it on October 20, 87 days later, meaning affected organizations had to comply before the public explanation was available. [13] [14] [15] [16]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   government ordered federal civilian agencies to remove DeepSeek products from their IT systems and stop buying them.

2. [2]

   “The Department of Homeland Security is publishing notice of the Secretary of Homeland Security’s issuance of an order (1) excluding information technology products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd (DeepSeek), to include affiliated entities as defined in applicable regulations, from federal civilian agency procurements; and, (2) removing all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations, from civilian agency information technology.” reads the order .

3. [3]

   The order cites national-security concerns.

4. [4]

   According to reporting on the notice, DHS said DeepSeek’s models could transfer sensitive data to China and may contain malware or other security weaknesses.

5. [5]

   The ban doesn’t apply to private companies or ordinary users, but government contractors may also be affected.

6. [6]

   They generally can’t use covered products or services for federal contracts unless they receive a waiver.

7. [7]

   The goal is to catch hidden uses of DeepSeek, including AI models built into apps, services and development tools.

8. [8]

   Agencies need to check their systems, while suppliers must disclose which AI models they use, where the models process data and whether information leaves the customer’s environment.

9. [9]

   The order also reaches third-party tools and services built with DeepSeek implementations, which is the part most organizations should notice.

10. [10]

    The notice doesn’t explain exactly what counts as a “DeepSeek implementation.” Agencies will need to ask suppliers whether their products fall under the ban.

11. [11]

    The ban took effect when issued, but existing contracts are covered only after the contracting officer formally updates them.

12. [12]

    Agencies can request an exception, but they must provide a strong justification.

13. [13]

    Homeland Security Secretary Markwayne Mullin signed the order on July 24, 2026, under the Federal Acquisition Supply Chain Security Act of 2018.

14. [14]

    DHS published it in the Federal Register on October 20 as document 2026-21447, under docket DHS-2026-0628.

15. [15]

    DHS signed the order on July 24 but didn’t publish it until October 20, 87 days later.

16. [16]

    This delay meant affected organizations had to comply before they could read the public explanation or see the signed order.

Read the original article →

What happened

NVIDIA’s OpenShell Reference Architecture is designed to help businesses control AI agents operating across enterprise infrastructure and local computing systems. [1]

The architecture combines NVIDIA’s OpenShell security software with hardware for running AI models, managing agent operations and enforcing security rules. [2]

Why it matters

The stated aim is to let agents perform useful work within defined boundaries while giving businesses tools to monitor their behaviour and stop activity that crosses those limits. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   NVIDIA’s OpenShell Reference Architecture is designed to help businesses control AI agents operating across enterprise infrastructure and local computing systems.

2. [2]

   It builds on NVIDIA’s existing OpenShell security software, combining it with hardware for running AI models, managing agent operations and enforcing security rules.

3. [3]

   The aim is to let agents carry out useful work within defined boundaries, while giving businesses tools to monitor their behaviour and stop activity that crosses those limits.

Read the original article →

What happened

Eight eMudhra intermediate certificates were secured with weak private keys that anyone could recover from the corresponding public certificates in under a second. [1]

A security researcher known as Wayne discovered the flaw on October 17 while checking the Common CA Database. [3]

The researcher signed data to demonstrate that the keys were compromised, although the supplied article text is truncated before describing the demonstration further. [4]

Why it matters

eMudhra states on its website that it has issued more than 60 million digital certificates. [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Eight intermediate certificates issued by Indian certificate authority eMudhra were secured with private keys so weak that anyone could recover them from the public certificates in under a second.

2. [2]

   On its website, the company highlights that it has issued more than 60 million digital certificates.

3. [3]

   A security researcher known as Wayne discovered the flaw on October 17 while running a check against the Common CA Database (CCADB).

4. [4]

   To prove the keys were compromised, he signed … More → The post eMudhra security blunder left trusted CA signing keys exposed to anyone appeared first on Help Net Security .

Read the original article →