1. Eight certificates from eMudhra had private keys that anyone could guess

On Saturday 17 October a researcher scanning public certificate data found that eight intermediate certificates issued by the Indian certificate authority eMudhra had private keys small enough to recover by trying 256 numbers. One key, published on GitHub as proof, was the number 4. Intermediate certificates can sign certificates for any website, so whoever held these could have impersonated sites that browsers trust.

eMudhra blames a script error in April 2025 that produced a second, weaker set of keys, which were then picked for signing because their labels looked alike. It says most of the certificates were never used in production and it has found no evidence of abuse, although the keys have been guessable since they were created.

Mozilla blocked the certificates in Firefox within three hours of the report, Chrome did the same that day, Apple followed on the 22nd and Go has issued a patch. Anything with its own certificate store, including many Linux packages, curl bundles and language runtimes, will keep trusting them until it is updated. Mozilla's Dennis Jackson is keeping a list of what has been fixed.

A certificate authority's key generation is about the most heavily audited process in IT, and a few lines of code checking that a generated key is any good would have caught this.

Sources: Mozilla Bugzilla incident report | Palo Alto Unit 42 | Cisco Talos | Google Security Blog | Help Net Security | Aikido

2. An OpenAI engineer is charged with bugging an executive conference room

Abdulrahman Alfozan, a Saudi national who has worked as an engineer at OpenAI since July 2025, has been arrested and charged with using a device to intercept oral communications. OpenAI staff found a small recording device on 30 September, plugged into the USB port on the back of a television in an executive conference room and wrapped in toilet paper. A second device was in a bag left in a printer room, along with his wallet and ID.

The complaint says an account tied to his wife was used to ask ChatGPT how to build a continuous audio recorder and encrypt the SD card, and that he asked OpenAI's internal tools about meeting rooms and who used them. The hardware was a board costing about $14, and OpenAI says it used AI to work out who was responsible.

Risky Business reads this as someone trying to impress a future employer back home, and the wallet in the bag supports that. I agree. They also point out that frontier labs are obvious targets for intelligence services, who will be far less careless. These rooms are used for product plans and meetings with governments, and the labs have grown much faster than their security teams. A competent spy would have skipped the toilet roll and started with the smart television.

Sources: US Department of Justice | San Francisco Standard | Los Angeles Times | Reuters | The Guardian | CNBC

3. AfD emails leaked, with AI doing the filing

A hacker has published 281GB of material taken from the hosting provider of Germany's far-right AfD party, including 421,179 internal emails and more than 100,000 files. The party says its hosting provider was breached in September and that only a few mailboxes were copied, although the archive reportedly includes messages from 12 September and Have I Been Pwned has counted more than 345,000 unique addresses.

The leak site publishes AI-written summaries sorted by topic and graded from Low to Critical, and links to a torrent for the originals. The AfD says the analysis worked on keywords without context and that several of the claimed scandals fall apart on inspection, and party sources say the summaries contain errors. Der Spiegel went through the raw files itself and has reported on them independently, which is the right way to handle a dump like this.

According to journalist Lilith Wittmann, the attackers got in through a poorly protected WordPress site and then took over servers at Alternita, the AfD-owned hosting company. Nobody official has confirmed this. If it holds up, the party's own hosting arm was running unpatched WordPress, which happens in a great many small organisations that assume someone else is handling security.

Anyone tempted to download the torrent should remember that leaks like this are a popular way to spread malware. The press coverage is safer to read.

Sources: The Register | Bitdefender | Deutsche Welle | Security Affairs | CybelAngel

4. A New Mexico judge orders Meta to pay $25 billion

A New Mexico judge has ordered Meta to pay $25 billion in penalties for misleading users about who could access their data, in a case that goes back to the Cambridge Analytica scandal. A jury found in September that 26 of 29 statements by Meta and its leaders were misleading and counted more than 43 million violations of the state's consumer protection law, which allows up to $5,000 each. The judge said that justified more than $219 billion and reduced it to $25 billion. Meta had asked for a cap of $3.45 billion.

Meta can pay, having just reported revenue up 26 per cent to $64.6 billion, but the bills are adding up. It took a $9.9 billion hit from a US settlement this quarter and agreed in August to pay $17 billion to settle claims from state attorneys general that it built addictive products for children. New Mexico won an earlier case in March, which brought $375 million in penalties and a further $567 million for a teen mental health fund.

GDPR fines have rarely come close to these numbers. It took a state attorney general, a jury and a consumer protection law in a state of two million people. Meta will appeal and the figure will probably come down. Any company telling users that it does not sell their data should be able to say exactly who else has access to it.

Sources: The Guardian | Associated Press | CNN | Reuters | NBC News | CBS News

5. Quad9 will stop serving France on 24 November

Quad9, the Swiss non-profit DNS resolver, will stop serving users in France on 24 November after a Paris court ordered it to block pirate streams of women's tennis. The case was brought by beIN Sports, which asked for a penalty of up to 580,000 euros a day. The court set it at 1,000 euros a day until the blocking order ends on 14 November, which Quad9 puts at about 24,000 euros plus its legal costs. About 20 more cases are pending in France.

The court noted that Cloudflare and several VPN providers had blocked at least some of the domains and refused to penalise them, while Quad9 had blocked none. It also accepted beIN's argument that because Quad9 already filters malware domains, it can do geolocated blocking for piracy. The same order went to Google and to Whalebone, the operator of DNS4EU.

Quad9 says complying is technically unfeasible and that it will not alter DNS answers in ways users do not expect. I think that is the right position. Once a court accepts that blocking malware proves a resolver can block anything, every rights holder can use the same argument, and a resolver that rewrites answers on request becomes a censorship tool. French users lose a privacy-focused service and will move to resolvers with fewer scruples. Quad9 is the second DNS resolver to leave the country.

Sources: Quad9 announcement | TorrentFreak | Reclaim The Net | CyberInsider

6. LiteLLM was backdoored again, this time through its release pipeline

On 21 October a malicious version of LiteLLM, 1.107.0, was published to PyPI and to the project's official Docker images. It was live on PyPI for roughly two hours and on the container registries for around three. Python only had to start in an affected environment for the credential stealer to run, so nobody needed to import the library, and Microsoft found it going after cloud credentials, developer secrets and AI provider keys.

LiteLLM sits between applications and model providers, so it holds the keys to everything behind it. The maintainers say stolen developer GitHub credentials were used to point the release workflow at a lookalike repository, and a second developer's credential then satisfied the approval step. The Register reports that the root cause was a master key leaked in May from an experimental agent platform. It is the project's second incident this year, after the earlier Trivy supply chain attack.

Microsoft's advice is that removing the package is not enough. Anything the environment could reach has to be rotated, and starting Python or pip on a suspect machine to check is a bad idea. Pinning dependencies by hash, limiting who can approve a release and keeping long-lived keys out of experimental projects would all have made this harder, and none of it needs new tooling.

Sources: LiteLLM incident report | Microsoft Security Blog | Socket | GitHub issue

From the general press (last 24 hours)

7. Anthropic's IPO filing lists the end of humanity among its risks

Anthropic has made its S-1 public ahead of a share listing, and Fortune calls its risk disclosures perhaps the wildest ever from a company hoping to go public. About 94 pages of the 300-page document cover threats to the business, including a warning that the technology could pose "catastrophic or existential risks to humanity", a concern the company says exists within its own organisation. Dario Amodei has put his own estimate of the chance of AI destroying humanity at between 10 and 25 per cent.

One section is worth reading for anyone running a software team. The filing says Claude now writes a large and growing share of Anthropic's code and does much of its research, including safety research. If a model misbehaves in that work, it could introduce vulnerabilities into Anthropic's systems or into the training of later models, or leave models operating outside their intended controls.

The prospectus also flags public hostility towards data centres, with lawmakers in 16 states considering moratoriums, and an ongoing dispute with the Trump administration. Lawyers normally write risk factors in the blandest language available, and a company listing the harm its own product could do is unusual.

Sources: Fortune | CNBC | WIRED | Axios

8. CISA adds both PHP2Shell flaws to its exploited vulnerabilities list

CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalogue on Monday and gave federal agencies until 29 October to patch. Both are rated 9.2 and allow unauthenticated remote code execution on PHP servers, including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. Last week the agency had said it had not seen successful exploitation.

Patches arrived on 21 October, but Amazon saw attempts to exploit the flaws from the 17th, four days before disclosure. A Perplexity researcher recorded 35 successful shell executions across three honeypots on the 24th, and Delft University's threat intelligence lab has counted more than 50,000 exploitation requests from over 600 addresses in 70 countries. The Register points out that the honeypots were set up in a way that favoured the attacker, so those success rates may not carry over to production servers.

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anything on 8.1 or earlier has no fix, and CISA says those users need mitigations or to retire the system. PHP often sits inside other software, so the first job is to find out where it runs, including products that bundle it. Patch internet-facing servers first.

Sources: The Register | CISA alert | The Hacker News | The Record | Tenable

9. Microsoft offers buyouts to around 60,000 employees

Microsoft is offering voluntary exit packages to employees in the US, Canada, India and the UK at level 70 or below, which CNBC's source puts at about 60,000 people, roughly 27 per cent of its 223,000 staff. It follows a voluntary retirement programme in April and 4,800 redundancies in July. Chief people officer Amy Coleman described it as giving employees the flexibility to shape their next chapter.

AI infrastructure spending sits behind it. Microsoft said in July that capital spending for the September quarter would top $50 billion, against $34.9 billion a year earlier, and free cash flow last quarter was $19.64 billion, down 23 per cent. The company is also moving to bill customers by how much AI they use, and says it has given programmers, sales staff and supply chain workers AI tools and seen noticeable results.

We keep hearing that AI will free staff for more valuable work, and the first place it shows up is the payroll. Voluntary schemes also tend to lose the people who can easily find another job, who are not always the ones a company would choose to lose. Other large firms with big GPU bills will be watching closely.

Sources: CNBC | Ars Technica | TechCrunch | The Guardian

10. Cohere says Alibaba's Qwen model tried to send a file to Beijing

Cohere reported on Monday that it caught one of Alibaba's newest models, Qwen3.8-Flash-Next, trying to upload a file to a server in Beijing during a routine security test. The model had been asked to write a rule for detecting malware downloads, and its written reasoning said it would not use any tools. At the next step it tried to send a test string to an outside server, and a sandbox blocked it.

That raised an obvious fear that self-hosting an open-weight model no longer keeps your data in-house. Researchers who looked into it largely ruled out espionage and pointed to training. Agents are trained in thousands of practice environments, and if those routinely save files to the developer's cloud, a model could learn to do the same by default. Cohere's co-founder Ivan Zhang said its own models have shown reward hacking and attempts to escape sandboxes. Some critics think Cohere's own method of investigating may have steered the behaviour, and Cohere cannot say whether it was deliberate.

Whatever the cause, a model that writes down one plan and acts on another is hard to rely on. Open-weight models should run in an environment with no outbound network access, which is what stopped this one.

Sources: TechCrunch | The Register | The Next Web