Daily Briefing

Eight eMudhra CA keys compromised, forcing emergency distrust across browsers — Palo Alto PAN-OS under active ransomware attack

By The IT Security Desk

Good morning. The Hacker News reported that Mozilla and Google's Chrome Root Program confirmed on October 20 that the private keys of eight eMudhra intermediate certificate authority (CA) certificates are compromised. An intermediate CA signs the certificates that websites present, so anyone holding one of these keys could issue a certificate for any website. The Register reported that one of the compromised private keys was the number "4", that the flaw makes it possible to impersonate any website or service, and that a massive clean-up is under way. The Hacker News reported the compromise is triggering emergency fixes across browsers and software. Keep browsers current so that the root-program distrust reaches your estate; eMudhra-issued certificates are the affected set to check against.

The Register reported that Palo Alto Networks' firewall OS has been under attack from multiple ransomware groups since June, with Unit 42 investigating network compromises across numerous industries. CISA's Known Exploited Vulnerabilities catalogue lists CVE-2026-0322 in PAN-OS as known to be exploited; its advisory record gives a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and lists versions up to the fix in 10.2.0 as affected. Follow Palo Alto Networks' advisory for the fixed release and any interim mitigation, and apply CISA's BOD 26-04 patching timelines.

BleepingComputer reported that the PHP security team is warning administrators to prepare for emergency updates to address two critical vulnerabilities, and that information about the flaws leaked ahead of their scheduled disclosure. Plan for an out-of-band PHP patch cycle.

Read the full briefing →

Zoom out: US and allied agencies also published guidance on the SafePay ransomware gang (the FBI with UK and German agencies) and on responding to rogue AI agent incidents (NIST, CISA and the NSA).

Vulnerability in focus

CVE-2026-0322 — Palo Alto Networks. CVSS 7.2 CISA lists it as known to be exploited.

Affected: panos.

What to do: Follow the vendor advisory for the fixed release and any interim mitigation.

Elsewhere

Help Net Security: Privacy-preserving AI can protect your heart data, the bill is the problem Read it
SecurityWeek: Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI Read it
Help Net Security: DevGuard: Open-source vulnerability management for the software supply chain Read it
The Hacker News: PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert Read it
Help Net Security: Why security tools lose sight of the credential Read it
Help Net Security: Bringing AI into the SOC means watching for shadow AI and loose permissions Read it
Help Net Security: A critical PHP security release is coming today, so get ready to update! Read it
BleepingComputer: Mozilla, Google, Apple block compromised eMudhra CA certificates Read it
The Register: Indian certification authority eMudhra’s private keys compromised – one of them was the number ‘4’ Read it
The Register: Auto tech startup claims it traced hack attempt back to rival's IP address Read it
BleepingComputer: PHP warns admins of two critical flaws, emergency patches coming tomorrow Read it
CISA: CISA Adds Six Known Exploited Vulnerabilities to Catalog Read it

Sources

Indian certification authority eMudhra’s private keys compromised – one of them was the number ‘4’ The Register
PHP warns admins of two critical flaws, emergency patches coming tomorrow BleepingComputer
FBI says SafePay ransomware gang ‘among most active’ with more than 600 victims since 2024 The Record
Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software The Hacker News
Chrome flags malicious commands that scammers pass off as fixes Help Net Security
US Agencies Detail Incident Response Practices for Rogue AI Agents SecurityWeek
CISA Adds Six Known Exploited Vulnerabilities to Catalog CISA
Possible new Cellebrite iPhone Radio Zero-Day Schneier on Security
Auto tech startup claims it traced hack attempt back to rival's IP address The Register
Zeabur shutting down after second security breach in two months BleepingComputer
California warns all public school students of data stolen in contractor breach The Record
23andMe successor settles with California for $6 million over cybersecurity failings The Record
Palo Alto's firewall OS has been under attack from multiple ransomware groups since June The Register
Nigerian national given 8-year sentence for tax business hacks The Record

Share this issue

Facebook · X · Reddit · LinkedIn · WhatsApp · Email · Bluesky

Every briefing is on the site, with the advisory record behind it. All briefings