Section
Breaches, vulnerabilities, threat research, and defence.
Eight intermediate certificate authority keys belonging to eMudhra have been confirmed as compromised, allowing anyone with access to forge trusted certificates for any website. Mozilla, Google's Chrome Root Program, and other software projects are issuing emergency fixes in response.
The Go team shipped emergency patch releases on October 20 that cause Go's built-in certificate verifier to reject any chain passing through eight specific intermediate CA keys. The keys have been identified as belonging to certificate authority eMudhra, and the fixes are part of a broader response that includes browser updates from Firefox and others.
OpenCode has notified affected users after an intruder reached a legacy system and may have exposed API keys tied to external AI providers. The breach appears limited in scope, affecting only users of the optional Console hosted service.
The paid version of the Rank Math SEO plugin for WordPress was found to contain malware after attackers tampered with downloads served from the official vendor website. Site owners who installed or updated the plugin during a specific window last week are advised to treat their installations as compromised.
Attackers replaced download archives for five releases of OVHcloud's open-source command-line interface tool with malware-laced builds. The malicious files were available on GitHub for up to 94 minutes before being removed.