Arstechnia

• Disgraced eMudhra drops out of TLS business after using cert private key of 4

  Flubbed key signing "ceremony" allowed minting of web credentials for any site.

• 333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email

  For 3 days this month, 333 exit nodes were hacked in hopes of stealing sensitive data.

• Enterprises keep buying software upgrades that IT thinks will make things worse

  Survey of 2,018 IT heads at big firms points to a lack of leverage.

• PHP warns it plans to release 2 emergency patches imminently

  Unconfirmed report claims PHP2Shell exploit remotely executes code on PHP sites.

• The Internet goes on high alert after discovery of 8 compromised TLS certs

  Intermediate certs allow anyone to mint web credentials for any Internet server.

• Meta Muse exposes users' personal and business secrets when they share conversations

  Meta is suspending the sharing feature while it investigates its privacy.

• PSA: Patch your Plex media server before someone hacks it

  A researcher says attacks chaining 4 vulnerabilities is hacking unpatched boxes.

• ReactOS reaches major milestone with NTFS install support

  ReactOS gains NTFS install support with new driver.

• OpenAI models hacked a crypto wallet and breached more websites

  The actions could have resulted in criminal charges had humans been behind the keyboard.

• Targeted ads delivered 0-click exploits to install mercenary malware

  The incident is likely 1st confirmation of mercenary spyware delivered by targeted ads.

• Fridge hack costing millions and sparking fires stemmed from poor security

  Incident hitting 700 supermarkets exploited outdated devices exposed to the Internet.

• Anthropic warns small AI models could self-replicate through IoT devices

  "Small weight-based replicators" could usher in a new generation of computer worms.

• Topgolf saved over $11.3 million after leaving VMware

  Topgolf and VMware "ran deep" before the migration.

• PC shipments fall 20.1 percent in “sharpest decline” since Q1 2023

  "The current decline may be just the beginning of a new downward cycle."

• Hackers obtain counterfeit TLS certificates for Google and other large services

  Compromise of 3 domain registries allows hackers to walk off with unauthorized certs.

• OpenAI agents tried to hack Wikipedia tools and flooded it with traffic

  The reports of OpenAI agents harming third-party sites keep coming.

• Licensing costs driving 90 percent of VMware users to explore options: Survey

  Users want to "reduce risk and avoid unnecessary disruption" while making changes.

• MCP for agent-to-agent comms may be the riskiest protocol you've never heard of

  Trust gaps in the new protocol spread malicious prompts from one agent to another.

• Apple changes full-disk access permissions to curb abuse from AI agents

  Meta says FDA isn't sufficient to Muse reading messages. Apple begs to differ.

• Hacks of 2 federal agencies in a month have spilled a bonanza of sensitive data

  It has been a bad month for federal government cybersecurity.