IT Security News: Overnight roundup, 2026-10-22 Summary This period's security developments were dominated by the rapid escalation of emergency patching for foundational web infrastructure alongside a surge in AI-driven attack vectors and governance challenges. Critical vulnerabilities in widespread technology stacks—including…
Tech Giants Block eMudhra Certificates Tied to 8 Compromised Keys
Google, Mozilla, Apple, the Go project and others moved swiftly to block the affected certificates from the Indian CA, though it’s unclear how the keys…
Cybercriminals hack Staples to steal millions in gift cards
Staples Gift Card Hack, Nikkei’s Third Breach, Burger King Japan Leak, Broadcom Wi‑Fi “Foreverday,” and Ledger Spy Implants Host David Shipley covers a…
Just Eat Pauses AI Rollout Amid Bizarre Food Images
Delivery company apologises for strange and incorrect images after offering AI-generated placeholders for food items
Multi-Cloud Blind Spots Are Leaving Security Teams Exposed
Discover how multi-cloud environments create security blind spots, inconsistent access controls, risks and how CCSP strategies help strengthen cloud…
PSA: Upcoming Critical PHP Security Release
PHP has released 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities announced in this advance notice. WordPress updates won’t apply…
Philippines-based American pleads guilty to running expansive fraud scheme targeting US servicemembers
Robert Wayne Boling Jr. was the mastermind of an identity theft conspiracy that victimized thousands of military members and veterans. He faces up to 40…
FBI and CISA Warn of SafePay Ransomware Attacks on 600 Organizations
SafePay ransomware has hit 600+ organizations since 2024, using stolen credentials, VPN access and double extortion to pressure victims into paying. CISA,…
Certification authority eMudhra defends its laughably weak private keys
Says it passed audits and made just a minor mystery error
PHP warns admins of two critical flaws, emergency patches coming tomorrow
The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information…
Indian certification authority eMudhra’s private keys compromised – one of them was the number ‘4’
Massive clean-up job under way because this mess makes it possible to impersonate any website or service
Mozilla, Google, Apple block compromised eMudhra CA certificates
Certificate authority eMudhra revoked eight compromised intermediate certificates after researchers found their private keys were so weak that anyone…
Auto tech startup claims it traced hack attempt back to rival’s IP address
IQ.Lvbs implies that rival Comma.ai isn’t playing fair
IT Security News Hourly Summary 2026-10-22 09h : 22 posts
22 posts published in the last hour 06:34Nigerian sentenced to 8 years for long-running tax business hacking and fraud scheme 06:33Live Video Moderation Challenges Traditional Content Safety Systems 06:33Running a Self-Hosted WAF in Production: Practical Lessons From SafeLine 06:33ECHOTRIBBLE: The…
Nigerian sentenced to 8 years for long-running tax business hacking and fraud scheme
Chukwuemeka Victor Amachukwu hacked tax preparation businesses, filed false tax returns and enticed victims to send him money for investment schemes.
Live Video Moderation Challenges Traditional Content Safety Systems
Learn how live video moderation handles frame sampling, end-to-end encryption, behavioural signals, privacy and content retention in video…
Running a Self-Hosted WAF in Production: Practical Lessons From SafeLine
Why Put a WAF in Front of the Application? Web application firewalls are often introduced as a list of security features: SQL injection protection,…
ECHOTRIBBLE: The US Army’s AI Hacking Plan Raises Containment Questions
The US Army’s ECHOTRIBBLE initiative seeks autonomous AI hacking agents, raising questions about human oversight, containment and civilian network risks.
How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia
Kaspersky GReAT experts discovered a new UEFI bootkit, BlackX. It exploits the Baton Drop vulnerability (CVE-2022-21894) and is similar to the BlackLotus…
New Mexico Fines Meta $25bn Over Cambridge Analytica Scandal
Federal judge finds Meta’s ‘wilful’ deceptive conduct would have justified much larger fine under state’s unfair practices law
Ex-OpenAI Engineer Detained After Planting Secret Recorder at HQ
The perp, who has Saudi ties, was arrested for allegedly bugging an OpenAI conference room, highlighting a preventable insider threat vector.
Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 20)
Ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc) are exploiting PAN-OS vulnerability CVE-2026-0257.
Hackers Combine Claude Code, Codex, Grok, and DeepSeek to Automate Attacks Worldwide
A Chinese-speaking threat operator combined ARTEX, Claude Code, Codex, and configurations requesting DeepSeek, GLM, and Grok models to coordinate attacks…
Sovereignty vs. security: Microsoft’s Roger Halbheer says you’re asking the wrong question
In this interview with Help Net Security, Roger Halbheer, Customer Security Officer at Microsoft, argues that digital sovereignty is a security question…
Signal Vulnerability Could Keep Microphone Active Even After Users Hang Up
A critical vulnerability in Signal’s RingRTC calling library could let a malicious call participant keep receiving audio after another user tries to hang…