October 2026

• Consensys Issues…

  Consensys has issued a security advisory to Ethereum operators regarding Web3Signer vulnerabilities tied to the recent compromise of eight eMudhra certificate authority certificates. While default setups remain secure, custom configurations utilizing Java trust stores could face exposure. The Root Cause: Weak eMudhra Certificates The security concern traces back to an independent discovery on October 17, 2026, revealing that private keys for eight eMudhra intermediate certificate authority (CA) certificates were generated using insufficient entropy. Most notably, six of these certificates shared an identical 1,024-bit RSA modulus—meaning a single weak key compromised multiple certificates. Because of this vulnerability, bad actors could potentially forge TLS certificates for any domain, impersonate legitimate servers, and intercept or alter network traffic. In response, major tech companies and browsers, including Chrome and Firefox, rolled out emergency blocks between October 17 and…

  Permanent link to “Consensys Issues Web3Signer Security Warning Following eMudhra Certificate Compromise”

• Multiple…

  Security researcher Abhinav Agarwal has identified four security vulnerabilities in HAPI FHIR, the widely utilized open-source Java library and server framework implementing the HL7 FHIR standard. These vulnerabilities directly impact Smile Digital Health's Smile CDR clinical data repository and health data platform (specifically demonstrated on HAPI FHIR 8.10.0 / Smile CDR 2026.05.R01). Because HAPI FHIR is a popular foundational framework integrated into various commercial healthcare products and platforms—impacting more than 30 U.S. payer deployments involving the health records of over 110 million individuals—identifying and patching these risks is critical for healthcare cybersecurity. Breakdown of the Four Vulnerabilities CVE-2026-113873 (High Severity — CVSS 8.7 / 7.5) Issue: Improper handling of highly compressed data. Impact: An unauthenticated attacker could send malicious, heavily compressed payloads designed to exhaust the server heap or crash services upon decompression…

  Permanent link to “Multiple Vulnerabilities Discovered in HAPI FHIR Component Impacting Smile CDR Health Platform”

• The "Gheist…

  Security researchers have uncovered an automated, highly organized threat campaign dubbed Gheist that targets developer infrastructure by mass-abusing compromised GitHub credentials. Tracked since mid-September, the campaign has planted secret-dumping workflows across more than 13,500 branches spanning over 850 stolen GitHub accounts, affecting everything from open-source hobby projects to private enterprise repositories. How the Gheist Attack Works Rather than relying on an external command-and-control (C2) server, Gheist operates entirely within GitHub's own ecosystem by exploiting built-in features and execution logs: Token Hijacking: The threat actors leverage stolen Personal Access Tokens (PATs) and compromised credentials sourced from infostealers or prior supply-chain breaches. Automated Planting: For every repository accessible to a stolen token, the tool creates a uniquely named branch (ci-sync-[random-hex]) and commits a malicious GitHub Actions workflow file named .github…

  Permanent link to “The "Gheist" Campaign: Stolen GitHub Tokens Weaponized to Exfiltrate Secrets at Scale”

• Two Critical…

  The maintainers of Wasmtime, a widely used standalone WebAssembly (Wasm) runtime developed under the Bytecode Alliance, have disclosed two critical security flaws. Tracked with a severe 9.9 out of 10 CVSS score, these vulnerabilities could allow a crafted, malicious WebAssembly module to break out of its designated sandbox and compromise the host environment. Both bugs reside in Cranelift, the default compiler engine used by Wasmtime to translate WebAssembly code directly into machine code. Understanding the Flaws CVE-2026-115889 (All Architectures): This bug affects Wasmtime across all processor architectures. It stems from how Cranelift historically stored internal tracking values using compressed 24-bit fields. Under specific scenarios—such as dealing with unusually large or complex WebAssembly modules—these fields would silently overflow without throwing errors, causing type confusion and allowing code to escape runtime boundaries.(Note: The main development branch addressed this…

  Permanent link to “Two Critical Wasmtime Vulnerabilities Expose WebAssembly Sandboxes to Escape Risks”

• The "Tailworm…

  A recent security disclosure known as the "Tailworm" report, published by researcher Erica Windisch of Cyberdione Labs, has highlighted a series of unpatched vulnerabilities and design concerns affecting Tailscale and its open-source equivalent, Headscale. Testing versions such as* Tailscale 1.104.2* and Headscale 0.29.5, the report outlines 11 specific findings, with the most critical focusing on Tailscale SSH and port forwarding. Key Takeaways of the Vulnerabilities 1. How the Attack Works (Lateral Movement & Privilege Escalation): Tailscale SSH differs from traditional SSH by relying on device identity rather than manually managed passwords or user-supplied keys. If an attacker gains an initial foothold on a single approved device within the mesh (via phishing, a vulnerable web app, etc.), they can exploit local and remote Unix socket/port forwarding behaviors built into Tailscale's SSH server (tailscaled, which operates with root privileges). In a lab setting, this…

  Permanent link to “The "Tailworm" Threat: Unpatched Tailscale SSH Flaws Can Let a Single Compromised Device Elevate to Root Across Your Entire Network”

• GMO Internet Hit by…

  Japanese internet and financial services giant GMO Internet Group has fallen victim to a sophisticated cyberattack targeting its Desktop Cloud service, operated under the popular Onamae.com brand. The security breach has placed up to 26,739 virtual private servers—frequently utilized by retail traders to run automated forex trading bots—at severe risk. In response to the crisis, company founder and CEO Masatoshi Kumagai has publicly appealed to the Japanese government to invoke the nation's newly enacted "active cyber defense" legislation. The incident came to light after GMO detected malicious software compromising customer servers, prompting the company to execute a phased, emergency shutdown of all Desktop Cloud plans. While initial disclosures suggested that user financial data and payment credentials remained secure, subsequent investigations revealed that attackers successfully accessed login data tied to automated forex accounts, executing unauthorized trades. In…

  Permanent link to “GMO Internet Hit by Major Hack Threatening 26,739 Trading Servers as CEO Urges Invocation of Japan’s Active Cyber Defense Law”

• ConnectWise Cloud…

  A major security breach involving ConnectWise Cloud Backup (formerly known as SkyKick) has exposed hundreds of Microsoft 365 tenant environments to unauthorized access. The incident unfolded when attackers successfully compromised administrative application credentials belonging to the backup service, turning a trusted vendor's master keys into access vectors for hundreds of enterprise systems. Microsoft has attributed the malicious campaign to a threat cluster designated as Storm-0940, a group security researchers link to state-sponsored operations originating from China. The attackers leveraged advanced automated methodologies, including the use of an open-source, AI-driven penetration testing framework known as ARTEX, to accelerate reconnaissance and achieve high-level privileges within compromised networks in a matter of hours. The breach specifically targeted the service integrations utilized by Managed Service Providers (MSPs). Because Cloud Backup requires deeply integrated…

  Permanent link to “ConnectWise Cloud Backup Breach Compromises Hundreds of Microsoft 365 Tenants in Sophisticated Supply-Chain Attack”

• Widespread Memory…

  A critical memory-corruption vulnerability residing deep within Google’s Brotli compression library has sent shockwaves through the global software development community. Tracked as CVE-2026-111497 and carrying a critical CVSS score of 9.2, the flaw affects any software package or language runtime that bundles or reuses the C-based Brotli decoding engine to unpack compressed data streams. Because Brotli is widely utilized across the internet to shrink web page sizes and accelerate traffic, the flaw's discovery has exposed a massive supply-chain attack surface. The vulnerability stems from an out-of-bounds memory write error in how the C decoder processes specially crafted, malicious compressed streams. When an unpatched application attempts to unpack hostile data, the flaw allows input to overwrite memory boundaries beyond the end of an allocated buffer. This can result in severe memory corruption, program crashes, denial-of-service conditions, or—in worst-case scenarios—the execution…

  Permanent link to “Widespread Memory-Corruption Flaw in Google’s Brotli Decoder Threatens Node.js, Bun, Python, and .NET Ecosystems”

• PHP2Shell: Critical…

  The PHP development team has issued an advisory warning of yet another potential Remote Code Execution (RCE) risk, designated as CVE-2026-115560. This new warning follows closely on the heels of emergency patches released just two days prior to address the critical "PHP2Shell" security flaws. While the timing has triggered widespread anxiety across the web development community, maintainers emphasize that this new vulnerability is separate and distinct from the earlier emergency issues. The newly disclosed vector impacts web applications configured in an exceptionally specific and unusual manner. Because of this narrow scope, PHP developers have classified the threat as an unlikely risk that does not warrant an immediate, emergency out-of-band patch. Instead, the project intends to fold the corrective code into its next routine bugfix release cycle while providing clear interim defensive guidance for system administrators. According to the advisory, the flaw can only…

  Permanent link to “PHP2Shell: Critical PHP vulnerabilities patched, update now!”

• The Netherlands…

  Since October 1, 2026 The Netherlands has taken a major stride in reinforcing its national digital security by officially joining the international standards organization OASIS. Spearheaded by the National Cyber Security Centre (NCSC) in The Hague, this strategic membership marks a critical shift toward unified global cooperation. Because modern cybercriminals and sophisticated threat groups operate fluidly across international boundaries—frequently targeting vital infrastructure like healthcare networks and banking institutions—isolated national defenses are no longer sufficient. At the center of this initiative is the adoption of open, globally recognized cybersecurity protocols known as STIX (Structured Threat Information Expression) and TAXII (Trusted Automated Exchange of Intelligence). Functioning as a universal dictionary for digital threat intelligence, these open standards allow disparate computer systems across multiple countries to speak the exact same technical language…

  Permanent link to “The Netherlands shares cyber attack data directly in OASIS standard”