Security
Node.js patches Brotli code execution and TLS validation flaws
The October security release covers 10 CVEs and updates certificate trust data following the eMudhra incident.
Category
Security
Attacks, vulnerabilities, data privacy and defense, and what AI changes on both sides.
29 stories
Security
Mozilla blocks eMudhra certificates after private-key compromise
Eight intermediate certificate authorities were affected; the public record points to weak key generation rather than a confirmed theft.
Security
PHP patches two critical PHP2Shell remote execution flaws
Four supported branches have fixes; PHP says configuration changes alone do not provide complete protection.
Security
Morris II showed how AI assistants could spread a prompt worm
The controlled research demonstration moved malicious instructions through connected email assistants.
Security
Researchers identified laptop keys from their sound
A 2023 study reported 95 percent accuracy with phone recordings and 93 percent through Zoom under its test conditions.
Security
AIR-FI sent data from isolated PCs through memory emissions
The 2020 experiment used signals in Wi-Fi bands, but first required malware on the disconnected computer.
Security
Cloudflare lets Gateway run custom code on web traffic
The Forward action is in public beta; custom policy functions are planned before year-end.
Security
Firefox 158 fixes sandbox and memory safety flaws
Mozilla lists high-impact fixes in networking, storage, graphics and the update component.
Security
Android expands scam checks in messages and screen sharing
Google says new safeguards mix on-device analysis with an optional protected cloud service.
Security
Cisco Talos details patched flaws in Windows, macOS and apps
The October disclosures include bugs in Photoshop, Foxit Reader, Apple’s CoreWLAN and Windows drivers.
Security
Google says AI tools helped find and fix Chrome bugs
The company reports 1,072 security fixes across Chrome 149 and 150, more than across the previous 23 releases combined.
Security
Chrome blocks certificates after three domain hijacks
Attackers changed DNS records for Ghana, Sierra Leone and American Samoa domains, then obtained unauthorized HTTPS certificates.