Eight eMudhra TLS keys had entropy as low as 3 bits

Eight eMudhra TLS certificates found with catastrophically weak private keys

Eight TLS certificates issued by certificate authority eMudhra were found to have private keys with catastrophically low entropy. A normal NIST P-384 key holds roughly 384 bits of entropy; the compromised keys measured 4, 56, 66, 115, 155, 156, 230 and 237 bits, with the smallest at 3 to 8 bits. Filippo Valsorda said the keys fall into the extremely should-not-be-possible category and speculated a key generation interface had a size parameter mistakenly set to 1. Ben Cartwright-Cox guessed example code leaked into production, adding it is bonkers that no one noticed. Valsorda compared recovery to Heartbleed but said it is worse this time given more contexts, more people and more heterogeneity.

The Internet goes on high alert after discovery of 8 compromised TLS certs - Ars Technica →

Topics: Encryption

Qilin and Inc ransomware gangs exploit PAN-OS auth bypass since June

Multiple ransomware groups, including Qilin and Inc, have exploited a high-severity authentication bypass in Palo Alto Networks PAN-OS since early June, with Unit 42 investigating compromises across education, finance, healthcare, manufacturing, government and other sectors. CVE-2026-0257 affects GlobalProtect portals and gateways, letting attackers bypass restrictions and establish unauthorized VPN sessions. Palo Alto disclosed and patched the bug on May 13 with an initial medium rating; Rapid7 reported exploitation dating back to at least May 17. Andy Piazza of Unit 42 said attackers bypass multi-factor authentication, move laterally via RDP and SMB, harvest credentials and steal data before deploying ransomware, in one case pivoting to vCenter, disabling ESXi controls and dumping credentials from a domain controller VMDK.

Palo Alto’s firewall OS has been under attack from multiple ransomware groups since June →

Topics: RansomwareZero-day vulnerabilities

OVHcloud CLI releases backdoored on GitHub to steal developer secrets

OVHcloud warned that attackers compromised its open-source command-line interface to distribute information-stealing malware. The attacker hijacked a developer’s GitHub account, modified versions 0.11.0 through 0.15.0; version 0.10.0 and the latest 0.16.0 were clean. CEO Octave Klaba said the compromised release appeared at 14:47 on October 19 and was blocked at 16:21 after a customer report. GitHub’s release immutability setting was disabled, letting a privileged account alter existing releases without CI/CD checks, though pipelines were not impacted. Klaba urged affected users to clean systems and revoke all secrets. OpenSourceMalware linked the attack to a likely GlassWorm operation; the hijacked account had been compromised for over half a year.

OVHcloud CLI releases backdoored on GitHub to steal developer secrets →

Topics: Supply chain attacksMalware & infostealers

WPSplinter bug in Broadcom WPS code exposes millions of routers over Wi-Fi

Researcher Quentin Kaiser detailed a flaw he calls WPSplinter at Hexacon in Paris on October 16, named because Broadcom refused an official identifier. The bug sits in Broadcom’s old WPS code and mishandles message exchange, letting an attacker read router memory or run external code with only radio range, no Wi-Fi password or completed pairing. On an Orange Belgium Askey TCG3000 he pulled the Wi-Fi key from NVRAM; on a Proximus BBOX3V+ he got a remote shell over Wi-Fi alone. Kaiser confirmed it on gateways from Proximus, Orange and VOO, about 1.5 million devices in Belgium, with a global estimate in the low hundreds of millions. Broadcom said it knew since 2018 and declined a CVE.

Millions of routers can be hijacked over Wi-Fi thanks to a 16-year-old bug →

Topics: Zero-day vulnerabilities

Over 300 infected Tor exit nodes removed after SSH interception campaign

On Friday October 2 at 09:35, 333 infected Tor exit nodes began a coordinated campaign to intercept SSH connections and collect unencrypted data, roughly 10% of the network’s 3,000 exit relays. Attackers had gained access in August and deployed an Ebury 1.8.3 payload, an OpenSSH backdoor and credential stealer for Linux. SSH users exiting through infected nodes were redirected to one of 12 interception servers on Port 22, seeing a REMOTE HOST IDENTIFICATION HAS CHANGED warning with fingerprint SHA256:6baCZCPsl+AfQuujUS81fMEE/C7UeJ+AwjrImqmDB3E. The Tor Project marked relays BadExit on October 4 and operators shut servers down. Exitmap found over 300 redirecting nodes. Recommended mitigation is disabling password authentication for SSH keys.

How I got over 300 Tor exit nodes removed - KABA →

Topics: Malware & infostealers