{"id":36929,"date":"2026-10-25T16:19:51","date_gmt":"2026-10-25T23:19:51","guid":{"rendered":"https:\/\/www.podfeet.com\/blog\/?p=36929"},"modified":"2026-10-25T16:25:57","modified_gmt":"2026-10-25T23:25:57","slug":"sb-2026-10-25","status":"publish","type":"post","link":"https:\/\/www.podfeet.com\/blog\/2026\/10\/sb-2026-10-25\/","title":{"rendered":"Security Bits \u2014 25 October 2026"},"content":{"rendered":"<h2>Feedback &amp; Followups<\/h2>\n<aside class=\"small-aside\">Listener and community feedback, developments in recently covered stories, and developments in long-running stories we&#8217;re tracking over time.<\/aside>\n<ul>\n<li>More misbehaving AI Agents:\n<ul>\n<li>\ud83c\uddee\ud83c\uddf3 <a href=\"https:\/\/thehackernews.com\/2026\/10\/cert-in-warns-ai-agents-accessed.html\">CERT-In Warns AI Agents Accessed Sensitive Data at Indian Organizations During Testing \u2014 thehackernews.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/openai-agents-disabled-safety-monitoring-one-lied-about-it\/\">OpenAI agents disabled safety monitoring, one lied about it \u2014 www.bleepingcomputer.com\/\u2026<\/a> (more alignment problems!)<\/li>\n<li><strong>Related:<\/strong> <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/anthropic-warns-self-replicating-ai-could-spread-to-your-smart-devices\/\">Anthropic warns self-replicating AI could spread to your smart devices \u2014 www.bleepingcomputer.com\/\u2026<\/a> (small AI models are becoming ever more capable)<\/li>\n<li><strong>Related:<\/strong> <a href=\"https:\/\/appleinsider.com\/articles\/26\/10\/17\/generative-ai-porn-apps-targeted-in-app-review-guidelines-update\">Generative AI Porn Apps Targeted in &#91;Apple&#93; App Review Guidelines Update \u2014 appleinsider.com\/\u2026<\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h2>Listener Questions<\/h2>\n<aside class=\"small-aside\">Submit your questions for future shows to Allison using the contact details at the end of the show, or post them in the <em>security-bits<\/em> channel in the <a href=\"https:\/\/podfeet.com\/slack\" target=\"_blank\">Podfeet Slack<\/a>.<\/aside>\n<h3>Passkey Backups?<\/h3>\n<p>NosillaCastaway Kantor:<\/p>\n<blockquote><p>\n  <a href=\"https:\/\/lapcatsoftware.com\/articles\/2026\/10\/6.html\">This<\/a> is an interesting take on passkeys &#40;and credential managers in general&#41; from the guy who develops StopTheMadness. It seems that he wouldn\u2019t mind passkeys if they were back-uppable. But isn&#8217;t their non-transferability a feature? If passkeys can be transferred to any old drive then anyone could potentially steal it or phish it. In this way, aren&#8217;t passkeys much better than private keys stored in <code>~\/.ssh\/<\/code>, which are just files you can move around?\n<\/p><\/blockquote>\n<p>This is a difficult question to answer directly, because there seem to be some misunderstandings in the mix, so I think the best thing to do is to explain two relevant features of the passkey world \u2014 there are two types of passkeys, and one <strong>can<\/strong> be backed up, and websites that support passkeys support so-called <em>modern authentication<\/em>, where there is no one-to-one mapping between account and authentication method.<\/p>\n<h3>Reminder \u2014 What a Passkey Actually Is<\/h3>\n<p>Before we go any further, let&#8217;s remind ourselves that a single passkey is made up of four parts:<\/p>\n<ol>\n<li>A private key (stored in a <em>vault<\/em> of some kind)<\/li>\n<li>A public key (shared with the website)<\/li>\n<li>A domain name<\/li>\n<li>A username<\/li>\n<\/ol>\n<p>The security of a passkey depends on protecting the private key, and the phishing resistance is enabled by the association between the domain name and the passkey.<\/p>\n<h3>Two Types of Passkeys \u2014 Device-Bound and Synced<\/h3>\n<p>Everything in cybersecurity is a tradeoff between security and convenience, and context is king.<\/p>\n<p>The most secure form of passkeys is the so-called <em>device-bound passkeys<\/em>. By definition, the private keys for passkeys of this type are stored in dedicated security chips. These chips generate unexportable private keys that are physically trapped within them; only the public key and the results of using the private key are accessible through the chip&#8217;s data pins. No matter how compromised your device gets, no malware can ever possibly get those private keys out!<\/p>\n<p>These passkeys generally live in one of two places:<\/p>\n<ol>\n<li>Dedicated USB dongles like YubiKeys<\/li>\n<li>Security chips on motherboards like the <em>Secure Enclaves<\/em> on Apple devices, <em>Trusted Platform Modules<\/em> (TPMs) on Windows\/Linux devices, and <em>StrongBoxes<\/em> on Android devices.<\/li>\n<\/ol>\n<p>Clearly, it&#8217;s physically impossible to make a backup of something you literally cannot access!<\/p>\n<p>Device-bound passkeys are used for the highest level of security, but they&#8217;re not very convenient.<\/p>\n<p>This is why we also have <em>synced passkeys<\/em> \u2014 these are stored in encrypted software vaults like the Windows Key Store, Apple&#8217;s iCloud Keychain, the Google Password Manager, and third-party vaults like 1Password and Bitwarden.<\/p>\n<p>These vaults do a very good job of protecting the private keys, but they can&#8217;t possibly be as secure as dedicated hardware security chips!<\/p>\n<p>What you get in exchange for this small reduction in security is the convenience of having your passkeys sync between your devices. As well as being synchronisable, these passkeys can also be exported.<\/p>\n<h3>Modern Authentication<\/h3>\n<p>To understand <em>Modern Authentication<\/em>, let&#8217;s start by looking at what we have retroactively named <em>Legacy Authentication<\/em>. On sites that use legacy authentication, there is a one-to-one mapping between accounts and passwords. Your account has <strong>a<\/strong> password!<\/p>\n<p>With Modern Authentication, that one-to-one relationship is gone; instead, each account can have arbitrarily many <em>authentication methods<\/em>. Most sites still allow you to set <strong>a<\/strong> password as <strong>one<\/strong> of your authentication methods, but you can also add arbitrarily many other authentication methods, the strongest of which are passkeys. You can add as many passkeys as you like to a single account.<\/p>\n<h3>Rethinking Backup<\/h3>\n<p>Backing up synchronised passkeys is easy \u2014 you use your chosen vault&#8217;s supported mechanisms for ensuring you retain access when you lose a device. For most modern vaults, that&#8217;s by some kind of cloud service that supports some kind of secure account recovery process. Some vaults will also let you export your secrets to some kind of file, which you can copy to a thumb drive or hard disk of some kind and store in a safe, lock box, or bank vault.<\/p>\n<p>The way you <em>&#8220;back up&#8221;<\/em> device-bound passkeys is by making use of modern authentication and adding another device-bound passkey to your account. To protect from device loss, the best solution is a dedicated hardware dongle that you can then store in a safe, lockbox, or bank vault.<\/p>\n<p>The same approach also works as an extra backup for synchronised passkeys. For example, to give me an extra safety net on my most critical identities, I add two synced passkeys \u2014 one stored in my iCloud Keychain, and one in 1Password.<\/p>\n<h3>So What About Phishing?<\/h3>\n<p>Passkeys are officially described as <em>&#8216;phishing resistant&#8217;<\/em>, not <em>&#8216;phishing proof&#8217;<\/em>, and that&#8217;s accurate. Even synced passkeys, which are technically exportable, are not phishable in the same way passwords are.<\/p>\n<p>What makes passwords so easy to phish is that the <strong>normal<\/strong> authentication flow involves users typing into text boxes, and fraudulent authentication flows are the same \u2014 users type their password into text boxes that look identical to the real ones; they&#8217;re just on a different domain. If a user forgets, or never even thinks, to look up at the address bar, game over!<\/p>\n<p>The same is true of multi-factor authentication mechanisms that rely on users typing numbers into text boxes.<\/p>\n<p>But passkeys are very different \u2014 users literally can&#8217;t complete authentication challenges; only vaults can, and look-alike sites do not fool vaults. Part of the standard passkey algorithm is verification of the domain name; if you&#8217;re on the wrong site, your passkey simply will not work!<\/p>\n<p>That really raises the barrier to entry. Your passkey can&#8217;t be phished by tricking you into logging in to a site; instead, attackers have to resort to some serious social engineering.<\/p>\n<p>Regardless of the type of passkey you use, one approach that&#8217;s always open is to trick you into adding an attacker&#8217;s passkey to your account. This generally involves tricking you into accepting dialogues that tell you explicitly that you are adding a <strong>new<\/strong> passkey to your account. People are tricked into doing this in the real world, but compared to regular phishing, it&#8217;s extremely rare!<\/p>\n<p>If you use synced passkeys, there are two other avenues of attack open to the baddies:<\/p>\n<ol>\n<li>They social engineer you into adding their device to your account, then your passkeys simply synchronise over to them as if they were you!<\/li>\n<li>They social engineer you into exporting your passkey to a file and sending it to them.<\/li>\n<\/ol>\n<p>Those kinds of attacks can and do happen, but compared to tricking you into typing your password into the wrong box, they&#8217;re <strong>much<\/strong> trickier for attackers to pull off!<\/p>\n<p>All of the known attacks against passkeys involve multiple steps, none of them part of your normal day-to-day routine, and clicking past multiple warnings. Just think of how many more opportunities there are for your <em>spidey-senses<\/em> to trigger!<\/p>\n<h2>Deep Dive 1 \u2014 An Illustration of What Happens When Certificate Authorities Mess Up (the eMudhra mess)<\/h2>\n<p><em>(Shout-out to NosillaCastaway Abhi who took the time to email us about this story!)<\/em><\/p>\n<p>Before explaining what happened, we need to take some a moment to remind ourselves of what Certificate Authorities (CAs) are and their place in the Public Key Infrastructure (PKI)<\/p>\n<h3>Context \u2014 The PKI, CAs, Root Certs, and Intermediate Certs<\/h3>\n<p>The vast majority of our online security depends on X.509 digital certificates and the infrastructure around them. We refer to the whole system as the <em>Public Key Infrastructure<\/em>, or PKI.<\/p>\n<p>The core of the PKI is asymmetric encryption, where you have pairs of public and private keys, and digital signatures. A certificate cryptographically binds a public key to some kind of identity, like a domain name or an email address. HTTPS uses domain name certificates, and S\/MIME email encryption and signing uses email address certificates.<\/p>\n<p>A certificate is simply a digitally signed file that contains a public key and an identity. Digitally signing something requires a key pair too, and usually, a certificate authority will use their private key to sign a certificate that binds your public key to your identity. The fact that a cert is signed with another cert creates a <em>chain of trust<\/em>, and that chain has to end somewhere!<\/p>\n<p>A <em>root certificate<\/em> is a certificate that was signed by the same key-pair it authenticates. Certificate authorities start by creating a key-pair, and using that same key-pair to sign a certificate that says it&#8217;s their key-pair.<\/p>\n<p>Anyone can do that! The protocols and algorithms that underpin X.509 certs and the entire PKI are open, and any server or personal computer can issue this kind of certificate, also referred to as a <em>self-signed certificate<\/em>. When you install Apache on your Linux server, it generates a self-signed cert for you as a placeholder until you can get one issued by a recognised CA. You can use the Keychain Access app on any Mac, or the Windows Key Store to create your own self-signed certificates for any identity you like.<\/p>\n<p>What makes your root cert different from those belonging to certificate authorities is simply trust! Every OS ships with a pre-installed set of trusted root certificates (you can view them in the Windows Certificate Store or the Keychain Access app), and only certificates signed by those root certificates are trusted by your computer. Untrusted certificates generate errors and warnings.<\/p>\n<p>You&#8217;re actually free to add your own certificates to this list \u2014 I do this at home with a self-signed cert I issued on my Mac that I then use to issue certs for my local servers. I then manually add the root cert to my devices, and they all start to trust my private certificate authority. Large organisations do this too, using in-built tooling in things like Active Directory to automate the distribution of the non-standard root certificates.<\/p>\n<p>So, Certificate authorities are critically important because they are the so-called <em>trust anchors<\/em> for the entire PKI. And their absolute crown jewels are the private keys that match their root certificates.<\/p>\n<p>The security of those private keys is critically important \u2014 if a CA loses control of one, the emergency OS updates will be pushed to all devices, removing the matching root certificate from the device, and in the process, instantly invalidating every single certificate that root certificate issued! That&#8217;s an existential threat to CAs!<\/p>\n<p>Because those private keys are so important, they&#8217;re not stored on network-connected devices. They&#8217;re literally kept offline, on a powered-down device in a safe! But to issue a cert you need the private key, so how can a key that&#8217;s offline sign anything? It can&#8217;t!<\/p>\n<p>This is why CAs use so-called <em>intermediate certificates<\/em> to sign the certificates they issue to customers. Every few years, they boot up the device that holds that priceless private key and use it to issue some certificates that they will then use to issue customer certificates. The private keys for these intermediate certificates are still heavily secured, but they&#8217;re secured online, using hardware devices similar in concept to the Secure Enclaves on iPhones.<\/p>\n<p>Note that these intermediate certs are not stored on people&#8217;s computers; instead, they are validated by checking them against the root certificates that are stored. If the private key for one of these certificates leaks, then it gets added to a so-called <em>revocation list<\/em> that contains just the IDs of <em>revoked<\/em> (invalidated) certificates rather than the entire certificate.<\/p>\n<p>Losing the private key of an intermediate cert is still <strong>bad<\/strong> \u2014 every cert signed with that intermediate cert is still invalidated when the intermediate cert is revoked, but it allows CAs to spread the risk. Firstly, root certs have very long validities, often decades, while intermediate certs are usually only valid for a few years at most. Secondly, a CA will use tens or even hundreds of different intermediate certs, spreading out the risk. If you have 100 intermediates, and you lose one, you invalidate 1% of the certs you issued, making 1% of your customers very cranky, but that&#8217;s still 100 times better than losing them all!<\/p>\n<blockquote><p>\n  You can see the full chain of certs between the one for a website and the root certificate for the issuing CA by inspecting a cert in your browser. When I did that on <code>podfeet.com<\/code> while writing these notes, I could see that the cert Cloudflare acquired for Allison for the site was issued by Google, and the Google root certificate is valid for 20 years (from 2016 to 2036), and the intermediate cert used is only valid for six years (from 2023 to 2029).<br \/>\n  {: .aside}\n<\/p><\/blockquote>\n<p>Finally, while every OS ships with a built-in set of trusted root certs, and every OS provides APIs for accessing those certs, apps are free to bundle their own set of trusted certs instead. Apple and Microsoft &amp; Google get to dictate what certs Windows, macOS, iOS, and Android trust; that&#8217;s a small number of companies. What if you don&#8217;t trust them? Well, you simply bundle your own set right into your app. That&#8217;s what Firefox and Chrome do. No matter what OS you run Firefox on, it will trust the same set of CAs, even if Apple, Google, and Microsoft disagree on one.<\/p>\n<h3>So What Happened this Week?<\/h3>\n<p>A major Indian CA named <em>eMudhra<\/em> effectively lost control of the private keys for <strong>eight<\/strong> of their intermediate certificates, exposing the entire world to the risk of fraudulent certificates.<\/p>\n<p>If you steal the private key matching a trusted certificate, you can sign things with that certificate, so if you steal the private key for a trusted root certificate or an intermediate certificate, you can issue your own certs with that key, and computers will trust that cert. Want to fake <code>google.com<\/code> for a really convincing AiTM attack without the usual certificate warnings, then issue yourself a cert for <code>*.google.com<\/code>, and you&#8217;re in business!<\/p>\n<p>Now, eMudhra were not hacked, and no one actually stole the private keys from them; it&#8217;s more embarrassing than that!<\/p>\n<p>Due to a typo in an automation script used to issue the intermediate certificates, the key length was <strong>short<\/strong>, not just a few bits shorter than it should be, but <strong>really<\/strong> short. One of the private keys was simply <code>4<\/code>!<\/p>\n<p>For context, Google&#8217;s intermediate cert used to sign the Cloudflare cert for <code>podfeet.com<\/code> uses the very latest Elliptic Curve algorithm with a key length of 256, while <code>4<\/code> is a three-bit number (<code>0b100<\/code>)!<\/p>\n<p>The PKI was designed to be able to handle key losses; hence there being a revocation process, so as soon as this woopsie was discovered, the eight certs were revoked, and all the major browsers and OSes updated their list of block-listed certificate IDs. This means that for regular users, this is a non-issue.<\/p>\n<p>The most noticeable inconvenience this caused is for owners of certificates issued by any of these eight revoked intermediate certificates. They needed to acquire and deploy new certs. In the past that would have been onerous, but in the days of Let&#8217;s Encrypt and the ACME protocol it&#8217;s nowhere near the challenge it once would have been.<\/p>\n<blockquote><p>\n  I&#8217;ve been through a few less dramatic revocations over the years in work, and while they were not fun, it was just a few hours of faffing about and double-checking we hadn&#8217;t missed anything. I&#8217;ve had worse days!\n<\/p><\/blockquote>\n<p>A more subtle potential issue for geekier users and organisations is the apps that bundle their own trusted CA lists. Firefox is an obvious example, but they reacted very quickly. It&#8217;s the less obvious ones that are more concerning. In general, single-platform apps usually rely on their OS&#8217;s trusted CA lists, but many cross-platform apps choose to bundle their own for consistency, and to avoid needing to maintain code for each OS&#8217;s specific APIs. The popular command-line HTTP utility <code>curl<\/code> is one notable example, and Google&#8217;s Go programming language is another.<\/p>\n<p>But again, this is just a simple case of staying patched so you stay secure.<\/p>\n<p>Finally, the organisation with the biggest problem is eMudhra themselves. Woopsies of this scale tend to be existential crises, and that&#8217;s proven to be the case here \u2014 eMhudra are exiting the CA business!<\/p>\n<h3>Links<\/h3>\n<ul>\n<li><a href=\"https:\/\/thehackernews.com\/2026\/10\/eight-emudhra-ca-keys-compromised.html\">Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software \u2014 thehackernews.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/mozilla-google-apple-block-compromised-emudhra-ca-certificates\/\">Mozilla, Google, Apple block compromised eMudhra CA certificates \u2014 www.bleepingcomputer.com\/\u2026<\/a><\/li>\n<li>Example of wider issues (other languages that bundle their own CA list are doing the same): <a href=\"https:\/\/thehackernews.com\/2026\/10\/go-issues-emergency-update-blocking.html\">Go Issues Emergency Update Blocking \u2014 thehackernews.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/thehackernews.com\/2026\/10\/emudhra-to-exit-global-ssltls-business.html\">eMudhra to Exit Global SSL\/TLS Business After 8 Intermediate CA Keys Found Easily Guessable \u2014 thehackernews.com\/\u2026<\/a><\/li>\n<\/ul>\n<h2>\u2757  Deep Dive 2 \u2014 Urgent Web Server Patches (PHP &amp; NGINX)<\/h2>\n<p>It&#8217;s not been a good week for website owners, with emergency patches for one of the leading front-end web servers, NGINX, and the most widely deployed server-side programming language, PHP.<\/p>\n<p><em><strong>TL;DR<\/strong> if you have a web server, be sure it&#8217;s patched! Also, if you&#8217;ve made your NAS visible from the internet, patch it (and strongly consider a safer solution like Tailscale)!<\/em><\/p>\n<h3>The Less-Bad One \u2014 NGINX<\/h3>\n<p>Five critical bugs were patched in NGINX, and in situations where they were exploitable, they were <strong>bad<\/strong>! Most were remote code execution, and one could cause client certificates to improperly validated. Client certificates are a very cumbersome but very secure alternative to passwords \u2014 very secure websites can require users to log on using a certificate issued to them by the website owner instead of a password, and this bug allowed forged certificates to appear valid!<\/p>\n<p>Thankfully, none of the exploits work on typical NGINX configurations, and it&#8217;s very unlikely any NosillaCastaways are running servers using client certificates.<\/p>\n<p>NGINX patched many more less critical bugs along with these five critical ones, so everyone should still patch their NGINX servers promptly.<\/p>\n<p>If you&#8217;re worried your configuration may be using one of the problematic combinations of directives, or if you just want to learn more about the issues, you&#8217;ll find a detailed description here:  <a href=\"https:\/\/thehackernews.com\/2026\/10\/nginx-fixes-5-flaws-including-possible.html\">NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks \u2014 thehackernews.com\/\u2026<\/a><\/p>\n<p>For what it&#8217;s worth, none of the NGINX servers I manage with any of my hats on were affected.<\/p>\n<h3>The Big One \u2014 PHP2Shell<\/h3>\n<p>This story really illustrates perfectly how much AI has changed things. The core underlying problem in PHP&#8217;s codebase has been known about for many years, but it was non-trivial to fix, and there appeared to be no practical avenues for exploitation. It was thought of as being like a broken window in an internal courtyard no one could get access to \u2014 sure, it should be fixed some time, but it didn&#8217;t seem to pose an immediate security risk. Until AI found a way!<\/p>\n<p>When AI revealed a novel path to exploitation, the PHP maintainers sprang into action, and not just on their own, in coordination with the broader web security community. Substantial changes were made to the code, and the process of managed disclosure was under way. Had that process gone to plan, news of the vulnerabilities and ready-to-deploy patches for all the major operating systems would have been released together near the end of this week. Instead, as the release date came closer, and the circle of people trusted with the information inevitably had to grow, someone betrayed the community and leaked the details on some semi-private online forums. And we now know there was limited exploitation in the days before the PHP maintainers finally went public.<\/p>\n<p>When it became clear the cat was out of the bag, PHP were forced to go early \u2014 they made an announcement that 24 hours later there would be a big announcement detailing a critical vulnerability, along with patches from the core PHP project.<\/p>\n<p>The fact that we got details and the so-called upstream packages at the same time was as good as it could have been in the circumstances, but by being forced to go early, the maintainers for the various software distribution mechanisms that bundle PHP were not ready with their patches. So, while you could go to the PHP website and download a manual installer, you couldn&#8217;t log into your server and get an update to the version that has been tweaked and bundled for your OS. Those came hours or even a day later. That meant that for many servers, there was a gap, and many organisations chose to power their systems down and trigger outages while they waited for the patches they needed.<\/p>\n<p>The major Linux distributions all got their patches within 24 hours, many within 12, which means that the biggest websites are probably all patched by now. But there are still some gaps:<\/p>\n<ol>\n<li>Obsolete versions of PHP have not been patched, and since PHP has introduced many breaking changes over the years, some sites, mostly internal corporate apps, cannot upgrade without being substantially rewritten!<\/li>\n<li>Many network devices like NAS servers deliver their user interface as a website, and many of those are powered by PHP. Those patches have been particularly slow to come out, and those devices are not on everyone&#8217;s radar when you think <em>&#8220;web server&#8221;<\/em>!<\/li>\n<\/ol>\n<p>There are some silver linings to all this, though.<\/p>\n<p>Firstly, because of how exploitation of these vulnerabilities works, attack attempts have a recognisable pattern, so many large providers were able to implement filtering to protect their customers. A fantastic example of this is Cloudflare, who rolled out protections for all their users within hours.<\/p>\n<p>Secondly, on closer inspection, it seems that while exploitation is definitely possible, and proof-of-concept exploits are out there, it&#8217;s not actually easy to reliably exploit the vulnerabilities in real-world conditions.<\/p>\n<p>Unfortunately, we can&#8217;t finish on a silver lining. PHP have addressed the critical issues, but the part of the codebase at the root of all this is still not in a great state. Attackers and AI bots are almost certainly focusing their attention on it now, and it seems inevitable that more fixes will be needed.<\/p>\n<p>To underline that point, PHP have released mitigations for a related bug that is not patched yet, but luckily, it only affects sites with very unusual configurations <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/php-shares-mitigation-for-new-and-unpatched-rce-vulnerability\/\">more details here: PHP shares mitigation for new RCE vulnerability with no patch \u2014 www.bleepingcomputer.com\/\u2026<\/a>.<\/p>\n<p>Before we end, there&#8217;s also a somewhat tragic callback to a recent instalment when Allison shared a link to an excellent <a href=\"https:\/\/sheets.works\/data-viz\/holding-up-the-internet\">interactive article<\/a> highlighting the small number of volunteers underpinning many major open source projects. PHP is one of those projects: <a href=\"https:\/\/sixcolors.com\/link\/2026\/10\/the-one-guy-who-manages-most-of-php-distribution-is-a-volunteer-of-course\/\">The one guy who manages most of PHP distribution is a volunteer, of course \u2014 sixcolors.com\/\u2026<\/a><\/p>\n<p>Finally, this is unlikely to be the last event like this while we make our way through this turbulent window where our existing code predates AI, but AI is trying to exploit it. That old code is full of vulnerabilities the AIs can, and will, find. New code is all being checked by AI before it gets published, so this period will end, but I doubt we&#8217;re through the worst of it yet!<\/p>\n<h3>Links<\/h3>\n<ul>\n<li><a href=\"https:\/\/cyberinsider.com\/php-releases-emergency-fixes-for-critical-php2shell-vulnerabilities\/\">PHP releases emergency fixes for critical PHP2Shell vulnerabilities \u2014 cyberinsider.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/tidbits.com\/2026\/10\/21\/php2shell-vulnerabilities-put-70-of-websites-at-risk\/\">PHP2Shell Vulnerabilities Put 70% of Websites at Risk \u2014 tidbits.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/appleinsider.com\/articles\/26\/10\/22\/critical-php-vulnerabilities-threaten-your-nas-not-every-vendor-has-a-fix\">Critical PHP Vulnerabilities Threaten Your NAS, Not Every Vendor Has a Fix \u2014 appleinsider.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/blog.cloudflare.com\/php-vulnerabilities-waf-protection\/\">Cloudflare deploys protections against php2shell vulnerability \u2014 blog.cloudflare.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/amazon-says-php2shell-exploitation-began-4-days-before-patches\/\">Amazon says PHP2Shell exploitation began 4 days before patches \u2014 www.bleepingcomputer.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/php-shares-mitigation-for-new-and-unpatched-rce-vulnerability\/\">PHP shares mitigation for new RCE vulnerability with no patch \u2014 www.bleepingcomputer.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/isc.sans.edu\/diary\/rss\/33452\">(Reliable)? php2shell exploitability \u2014 isc.sans.edu\/\u2026<\/a><\/li>\n<\/ul>\n<h2>\u2757 Action Alerts<\/h2>\n<aside class=\"small-aside\">Calls to action; if any stories in this section are relevant to you, there is some action you should take.<\/aside>\n<ul>\n<li>Another record-breaking Patch Tuesday: <a href=\"https:\/\/www.bleepingcomputer.com\/news\/microsoft\/microsoft-october-2026-patch-tuesday-fixes-1-411-flaws-3-zero-days\/\">Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days \u2014 www.bleepingcomputer.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/cyberinsider.com\/signal-fixes-critical-flaw-that-could-keep-audio-active-after-hangup\/\">Signal fixes critical flaw that could keep audio active after hangup \u2014 cyberinsider.com\/\u2026<\/a><\/li>\n<\/ul>\n<h2>Worthy Warnings<\/h2>\n<aside class=\"small-aside\">Potentially relevant warnings from government organisations, public interest groups, or the security community.<\/aside>\n<ul>\n<li>\u26a0\ufe0f <strong>Google Users:<\/strong> Google&#8217;s updated terms of service exempt Gmail, Photos &amp; Drive in their privacy policy, allowing all user content to these services to be processed for ad targeting \u2014 <a href=\"https:\/\/cyberinsider.com\/google-adds-gmail-photos-drive-ad-targeting-exception-to-privacy-policy\/\">cyberinsider.com\/\u2026<\/a><\/li>\n<li>\ud83c\uddeb\ud83c\uddf7 French NosillaCastaways are losing an excellent secure DNS option over misguided attempts to block sports streaming piracy \ud83d\ude41: <a href=\"https:\/\/cyberinsider.com\/quad9-to-leave-france\/\">Quad9 to leave France after court orders piracy-related DNS blocking \u2014 cyberinsider.com\/\u2026<\/a><\/li>\n<li>\ud83c\uddfa\ud83c\uddf8 <a href=\"https:\/\/cyberinsider.com\/proton-flock-map\/\">Proton hosts map of 300,000 Flock devices amid legal threats \u2014 cyberinsider.com\/\u2026<\/a> (a valuable privacy and civil awareness tool being threatened by <em>&#8216;lawfare&#8217;<\/em>)\n<ul>\n<li><strong>Opinion from Bart:<\/strong> I&#8217;m starting to see Proton in the same light as Cloudflare \u2014 a trustworthy company with a non-creepy freemium business model that behaves as good netizens whenever the need arises<\/li>\n<li><a href=\"https:\/\/www.theverge.com\/tech\/1012989\/mapquest-says-its-new-surveillance-layer-can-help-you-spot-flock-cameras\">MapQuest says its new Surveillance Layer can help you spot Flock cameras. \u2014 www.theverge.com\/&#8230;<\/a><\/li>\n<\/ul>\n<\/li>\n<li>A reminder never to connect a <em>&#8220;smart&#8221;<\/em> TV to your network: <a href=\"https:\/\/cyberinsider.com\/smart-tv-privacy-study-finds-tracking-persists-even-when-opting-out\/\">Smart TV privacy study finds tracking persists even when opting out \u2014 cyberinsider.com\/\u2026<\/a> (Use a separate, reputable box like an Apple TV)<\/p>\n<\/li>\n<li>Obsolete routers are not just a danger to their owners, but a menace to the entire internet: <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/hackers-hijack-d-link-ubiquiti-devices-to-resell-your-stolen-bandwidth\/\">Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth \u2014 www.bleepingcomputer.com\/\u2026<\/a> (Friends don&#8217;t let friends run obsolete routers!)<\/li>\n<\/ul>\n<h2>Notable News<\/h2>\n<ul>\n<li>\ud83c\uddfa\ud83c\udde6 \ud83c\uddf7\ud83c\uddfa Sadly, Ukraine&#8217;s drone strike on Yandex did not make a measurable difference in disinformation bots: \ud83c\udfa7 <a href=\"https:\/\/overcast.fm\/+AAIPMYvh9K8\">More or Less: Did Ukrainian strikes on Russian data centres stop disinformation bots? \u2014 overcast.fm\/\u2026<\/a> (Misinformation about Disinformation \ud83d\ude41)<\/li>\n<li>\ud83c\uddfa\ud83c\uddf8 <a href=\"https:\/\/appleinsider.com\/articles\/26\/10\/21\/meta-hit-with-25-billion-penalty-for-lying-to-users-about-privacy\">Meta Hit with $25 Billion Penalty for Lying to Users About Privacy \u2014 appleinsider.com\/\u2026<\/a> (New Mexico state case about Cambridge Analytica)\n<ul>\n<li><strong>Related<\/strong> (in case you thought the company has changed)<strong>:<\/strong> <a href=\"https:\/\/cyberinsider.com\/whatsapp-told-its-ai-chatbot-not-to-mention-privacy-regulators\/\">WhatsApp told its AI chatbot not to mention privacy regulators \u2014 cyberinsider.com\/\u2026<\/a> (<strong>intentional<\/strong> prompt injection \u2014 hidden text in support pages that humans can&#8217;t see but AI agents can)<\/li>\n<\/ul>\n<\/li>\n<li>More techical debt paid down: <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/abandoned-popcorn-time-app-exposed-millions-of-device-to-rce-attacks\/\">Abandoned Popcorn Time app exposed millions of devices to RCE attacks \u2014 www.bleepingcomputer.com\/\u2026<\/a>\n<ul>\n<li>This abandoned BitTorrent client used insecure HTTP connections for fetching software updates<\/li>\n<li>The app was abandoned, but it was still heavily used and still checking for updates. <\/li>\n<li>Attackers could have abused the situation to send malware to these devices<\/li>\n<li>The security community stepped in and sent an update to disable the insecure updates for the still-running apps instead!<\/li>\n<\/ul>\n<\/li>\n<li>A new open source option for organisations and enterprises: <a href=\"https:\/\/cyberinsider.com\/mozilla-launches-firefox-enterprise-with-self-hosted-browser-management\/\">Mozilla launches Firefox Enterprise with self-hosted browser management \u2014 cyberinsider.com\/\u2026<\/a> (<a href=\"https:\/\/blog.mozilla.org\/en\/firefox\/introducing-firefox-enterprise\/\">\ud83d\udce3 Mozilla&#8217;s Announcement<\/a>)<\/li>\n<li>Small changes making us all a little bit more secure:\n<ul>\n<li><a href=\"https:\/\/cyberinsider.com\/brave-adds-end-to-end-encryption-to-chats-with-ai-assistant-leo\/\">Brave adds end-to-end encryption to chats with AI assistant Leo \u2014 cyberinsider.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/cyberinsider.com\/eff-brings-privacy-badger-tracker-blocker-to-safari-on-macos\/\">EFF brings Privacy Badger tracker blocker to Safari on macOS \u2014 cyberinsider.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/www.bleepingcomputer.com\/news\/google\/google-chrome-adds-gemini-powered-scam-detection-warns-users-of-clickfix-attacks\/\">Google Chrome adds Gemini-powered scam detection, warns users of ClickFix attacks \u2014 www.bleepingcomputer.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/www.bleepingcomputer.com\/news\/microsoft\/microsoft-teams-to-get-ai-powered-context-aware-phishing-detection\/\">Microsoft Teams to get AI-powered, context-aware phishing detection \u2014 www.bleepingcomputer.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/cyberinsider.com\/apple-blocks-email-based-tracking-infrastructure-in-safari\/\">Apple blocks email-based tracking infrastructure in Safari \u2014 cyberinsider.com\/\u2026<\/a> (Apple have adapted their protections as the ad industry has adapted to the death of third-party cookies)<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h2>Just Because it&#8217;s Cool \ud83d\ude0e<\/h2>\n<aside class=\"small-aside\">Stories that are not important, that don&#8217;t require you to do anything, and that you don&#8217;t even have to worry about.<\/aside>\n<ul>\n<li>Lingering unsubstantiated concerns about Elliptic Curve Cryptography put to rest: <a href=\"https:\/\/cyberinsider.com\/claude-solves-decades-old-mystery-behind-nsa-cryptographic-numbers\/\">Claude solves decades-old mystery behind NSA cryptographic numbers \u2014 cyberinsider.com\/\u2026<\/a><\/li>\n<\/ul>\n<h2>Palate Cleansers<\/h2>\n<aside class=\"small-aside\">Anything upbeat and nerdy Bart and\/or Allison think you might enjoy.<\/aside>\n<ul>\n<li>\n<p><strong>From Bart:<\/strong><\/p>\n<ul>\n<li>\ud83c\udfa6 A follow-up from Allison&#8217;s pick last time, shared by Joop on <a href=\"https:\/\/podfett.com\/slack\">Slack<\/a>: <a href=\"https:\/\/youtube.com\/watch?v=NiCgcUTL9_Q&#038;is=03THjsk49FjPZp31\">The Insane Engineering of Fiber Optics \u2014 youtube.com\/\u2026<\/a><\/li>\n<li>\ud83c\udfa7 <strong>Why<\/strong> <em>&#8216;rubber ducking&#8217;<\/em> coding problems works: <a href=\"https:\/\/overcast.fm\/+ABMWblJSt1Q\">TED Talks Daily: Why the best learners talk to themselves with Tania Lombrozo \u2014 overcast.fm\/\u2026<\/a><\/li>\n<li>\ud83d\uddbc\ufe0f The week&#8217;s new in one Dr. Who meme (via Allister, also on Slack): <em>&#8220;Is Four a Lot? \u2026&#8221;<\/em> \u2014 <a href=\"https:\/\/outerheaven.club\/notice\/BBg2BaM4vQTasRD53g\">outerheaven.club\/\u2026<\/a><\/li>\n<\/ul>\n<\/li>\n<li><strong>From Allison:<\/strong>\n<ul>\n<li>In the vein of Cloudflare and the eMudhra CA flaw (if you know you know): <a href=\"https:\/\/www.threads.com\/share\/HmuZjIMDx\/\">www.threads.com\/&#8230;<\/a><br \/>\n<figure style=\"float: center; margin: 10px\"><img decoding=\"async\" src=\"https:\/\/www.podfeet.com\/blog\/wp-content\/uploads\/2026\/10\/Lava-lamps-with-4s-on-them.png\" alt=\"Thread captioin: I can&#39;t be bothered to explain this. If you know, you know and it&#39;s bleakly funny. If you don&#39;t know, it&#39;s likely utterly baffling, but with a bit of google this entire disaster will make much more sense. Photo is the wall of lava lamps at Cloudflare all with the number 4 on them\"  title=\"Lava lamps with 4s on them.png\" width=\"450 \" height=\"\"><\/li>\n<\/ul>\n<\/li>\n<\/ul><figcaption style=\"text-align:center\">If you know, you know<\/figcaption><\/figure>\n<pre><code>* CPG Grey video (from a year ago) explains how postal codes work in the US and why you need them _and_ the address, but the last part is all about how Ireland threw away their entire method and started over: [Your Post Code Is the Directions, Not the Destination](https:\/\/youtube.com\/watch?v=1K5oDtVAYzk)\n<\/code><\/pre>\n<h2>Legend<\/h2>\n<p>When the textual description of a link is part of the link, it is the title of the page being linked to, when the text describing a link is not part of the link, it is a description written by <a href=\"https:\/\/bartb.ie\/\">Bart<\/a>.<\/p>\n<table>\n<thead>\n<tr>\n<th align=\"center\">Emoji<\/th>\n<th align=\"left\">Meaning<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td align=\"center\">\ud83c\udfa7<\/td>\n<td align=\"left\">A link to <strong>audio content<\/strong>, probably a podcast.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">\u2757<\/td>\n<td align=\"left\">A <strong>call to action<\/strong>.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\"><em>flag<\/em><\/td>\n<td align=\"left\">The story is particularly relevant to people living in a <strong>specific country<\/strong>, or, the organisation the story is about is affiliated with the government of a specific country.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">\ud83d\udcca<\/td>\n<td align=\"left\">A link to <strong>graphical content<\/strong>, probably a chart, graph, or diagram.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">\ud83e\uddef<\/td>\n<td align=\"left\">A story that has been <strong>over-hyped<\/strong> in the media, or, <em>&#8220;no need to light your hair on fire&#8221;<\/em> \ud83d\ude42<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">\ud83d\udcb5<\/td>\n<td align=\"left\">A link to an article behind a <strong>paywall<\/strong>.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">\ud83d\udccc<\/td>\n<td align=\"left\">A <strong>pinned<\/strong> story, i.e. one to keep an eye on that&#8217;s likely to develop into something significant in the future.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">\ud83c\udfa9<\/td>\n<td align=\"left\">A <strong><em>tip of the hat<\/em><\/strong> to thank a member of the community for bringing the story to our attention.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">\ud83c\udfa6<\/td>\n<td align=\"left\">A link to <strong>video content<\/strong>.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n","protected":false},"excerpt":{"rendered":"<p>Feedback &amp; Followups Listener and community feedback, developments in recently covered stories, and developments in long-running stories we&#8217;re tracking over time. More misbehaving AI Agents: \ud83c\uddee\ud83c\uddf3 CERT-In Warns AI Agents Accessed Sensitive Data at Indian Organizations During Testing \u2014 thehackernews.com\/\u2026 OpenAI agents disabled safety monitoring, one lied about it \u2014 www.bleepingcomputer.com\/\u2026 (more alignment problems!) Related: [&hellip;]<\/p>\n","protected":false},"author":4,"featured_media":28385,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[147,214],"tags":[8449,3624,50,569],"class_list":["post-36929","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog-posts","category-security-bits","tag-emudhra","tag-php","tag-security","tag-security-bits"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/www.podfeet.com\/blog\/wp-content\/uploads\/2023\/05\/Security-Bits-Logo_1040x520.png","_links":{"self":[{"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/posts\/36929","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/comments?post=36929"}],"version-history":[{"count":2,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/posts\/36929\/revisions"}],"predecessor-version":[{"id":36931,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/posts\/36929\/revisions\/36931"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/media\/28385"}],"wp:attachment":[{"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/media?parent=36929"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/categories?post=36929"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/tags?post=36929"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}