TiDB Cloud breach: what PingCAP confirmed and what the attacker claims
A group calling itself FulcrumSec has published a leak page claiming it exfiltrated 10.6 TB of data from TiDB Cloud, the managed database service operated by PingCAP. The scale of that claim is disputed, but the intrusion itself is not: PingCAP has published an incident report on its trust hub confirming an unauthorized party used […]
The eMudhra CA compromise: weak keys, fast revocation, a slow cleanup
Somewhere out there, a researcher called Wayne spent the weekend signing test messages with private keys he was never supposed to have. The keys belonged to eight eMudhra intermediate certificate authorities, and getting them was not hard. The keys were generated so badly that anyone holding the public certificates could recover the private keys by […]
F5 Patches Three Critical NGINX Flaws in Out-of-Band Release
F5 has shipped out-of-band security patches for eleven NGINX vulnerabilities, and three of them are rated critical with a CVSSv4 score of 9.2. Out-of-band means the fixes did not wait for a regular release cycle, which tells you how F5’s threat model team views these. If you run NGINX anywhere in your stack, and almost […]
Application Gateway WAF learns to inspect IPv6 traffic
Azure’s Application Gateway Web Application Firewall now supports inspection and enforcement for IPv6 traffic, in public preview. Before this, the WAF could sit in front of dual-stack applications but its rules only bit on IPv4. IPv6 traffic flowed through uninspected, which was a genuine gap for anyone running regulated workloads on a dual-stack frontend. The […]
One parser, two bugs: the Broadcom WiFi flaw nobody issued a CVE for
Security researcher Quentin Kaiser presented new research on Broadcom’s WiFi WPS implementation at Hexacon in Paris on October 16, and the story behind the bug is almost as interesting as the bug itself. The short version: a memory corruption flaw in Broadcom’s proprietary 802.11 stack, present since at least 2010, exploitable over the air with […]
ConnectWise Cloud Backup breach: one vendor secret unlocked hundreds of Microsoft 365 tenants
Here is the part that should worry anyone running a Microsoft 365 tenant: the attackers never touched a user account. No phishing email, no stolen password, no MFA fatigue push. They authenticated straight into customer tenants as a vendor application, using a valid app secret that the vendor itself held. The vendor was ConnectWise Cloud […]
Azure Enclave reaches GA: managed workload isolation for government and regulated workloads
Azure Enclave went generally available on October 13 in commercial Azure and Azure for US Government, after a public preview that ran through the summer. The pitch is simple to state and hard to overrate for the target audience: Microsoft now operates the network isolation layer that government agencies, defense contractors, and regulated industries have […]
RPKI now covers 70 percent of internet routes
Routing security hit a number that has been a decade in the making. IPinfo measured the internet on September 28 and found 70.3 percent of routed IPv4 prefixes are now RPKI-valid, up from 54.0 percent a year earlier. Previous years moved 3 to 4 points annually. This year moved 16.4. The fine print on that […]
Targeted ads became a zero-click spyware pipeline
The Citizen Lab published research this week describing something that sounds like a threat model from a decade of worst-case thinking, except it is documented, evidenced, and apparently been running for years: targeted online advertising used as a delivery pipeline for zero-click mercenary spyware. The report, called AdFection, centers on an Israel-registered company named Discover […]
Passkeys are not a trap: the backlash post gets WebAuthn wrong
A post titled “Passkeys are a trap. Do not use them.” has been making the rounds on Hacker News this week, and Scott Helme’s rebuttal is the best response to it I have read. The short version: the trap argument rests on a misunderstanding of how WebAuthn attestation actually works, and the alternative it recommends, […]
Registry hijacks let attackers mint trusted TLS certificates for Google domains
Attackers did not need to breach Google, or any of the other organizations caught up in this incident. They needed DNS. Last month, someone compromised the third-party operators behind the .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) country-code top-level domains, changed authoritative DNS records, and quietly walked through domain control validation to collect […]
Forged RSA signatures without factoring: the attack nobody thought was possible
For roughly two decades, one assumption held firm: the only way to forge an RSA signature was to factor the modulus first, and factoring a 1024-bit key was a job for a nation-state budget. A team at UC San Diego and INRIA just knocked that assumption over. They forged a valid 1024-bit RSA signature without […]