Every Friday we recap the most important stories in cybersecurity, tech and policy, so you can catch up on what mattered in one short read.
Subscribe here for free 👇
https://www.internationalcyberdigest.com/newsletter/
Subscribe here for free 👇
https://www.internationalcyberdigest.com/newsletter/
International Cyber Digest
Newsletter
Subscribe to the International Cyber Digest Brief for cybersecurity stories, sources, and analysis.
❤4🥴1
‼️ BREAKING: The private keys of 8 certificates from Indian certificate authority eMudhra were compromised, Mozilla says. Firefox blocked them within 3 hours.
Each key should be a 116-digit number, but one was just 4.
Anyone can guess them and forge HTTPS certs for any website.
Each key should be a 116-digit number, but one was just 4.
Anyone can guess them and forge HTTPS certs for any website.
💩25🤣7😭2
‼️ CBP officers told Stop Cop City activist Samuel Tunick they wanted his GrapheneOS phone to hunt for "kiddie porn".
Court records show the ICE alert on him cited only "suspected terrorist activities".
He faces up to 5 years for giving them a duress pin that wiped the phone.
https://www.documentcloud.org/documents/28825074-tunick-photos-court-record/
Court records show the ICE alert on him cited only "suspected terrorist activities".
He faces up to 5 years for giving them a duress pin that wiped the phone.
https://www.documentcloud.org/documents/28825074-tunick-photos-court-record/
👏8🤬3😭2🔥1😱1
‼️ BREAKING: Elon Musk ordered last week's Starlink slowdown in Ukraine, the WSJ reports.
The ~160 km/h cap on military Starshield left some Ukrainian attack and interceptor drones virtually useless.
Musk had said limits are "decided by the US military and ultimately POTUS."
https://www.wsj.com/world/ukraine-starlink-elon-musk-trump-dbc49193
The ~160 km/h cap on military Starshield left some Ukrainian attack and interceptor drones virtually useless.
Musk had said limits are "decided by the US military and ultimately POTUS."
https://www.wsj.com/world/ukraine-starlink-elon-musk-trump-dbc49193
🤬27👏7🤪5👍3❤2🥰2💩2🤔1
‼️ BREAKING: Two leaked remote code execution flaws in PHP are real, watchTowr confirms.
PHP will ship fixes for two critical flaws, both rated CVSS 9.2, on Wednesday 21 October at 14:00 UTC, a day before the embargo was due to lift.
CVE-2026-109618 and CVE-2026-109619 first surfaced in a Hacker News post whose author admitted having no evidence beyond "source: trust me, bro".
Kevin Beaumont flagged the leak, and watchTowr confirmed it two hours later.
PHP says it may release sooner if details go public or exploitation appears. It has not named the CVEs or the affected versions.
PHP will ship fixes for two critical flaws, both rated CVSS 9.2, on Wednesday 21 October at 14:00 UTC, a day before the embargo was due to lift.
CVE-2026-109618 and CVE-2026-109619 first surfaced in a Hacker News post whose author admitted having no evidence beyond "source: trust me, bro".
Kevin Beaumont flagged the leak, and watchTowr confirmed it two hours later.
PHP says it may release sooner if details go public or exploitation appears. It has not named the CVEs or the affected versions.
😱4
‼️BREAKING: Cloudflare says it is already seeing early attacks on the two leaked PHP flaws, hours before the patch.
Its CTO Dane Knecht says WAF rules for the known exploit vectors are live for all customers, including free plans, but calls them "a STOPGAP only".
Websites are going dark while they wait. NotuBiz, used by 100+ Dutch local governments, pulled council information sites offline, including those of Den Bosch, Breda and Eindhoven.
explain xkcd and the Star Citizen Wiki are down too.
PHP ships the fix at 14:00 UTC today.
Its CTO Dane Knecht says WAF rules for the known exploit vectors are live for all customers, including free plans, but calls them "a STOPGAP only".
Websites are going dark while they wait. NotuBiz, used by 100+ Dutch local governments, pulled council information sites offline, including those of Den Bosch, Breda and Eindhoven.
explain xkcd and the Star Citizen Wiki are down too.
PHP ships the fix at 14:00 UTC today.
😭9🤣5👍4
‼️BREAKING: Security firm Calif appears to have a working exploit for the leaked PHP flaws, hours before the patch.
A briefly posted video credited to Calif shows it running commands on a WordPress 7.1.3 site on PHP 8.5.4. Kevin Beaumont says a screenshot from it is real.
A separate public PoC is also circulating, but its own author now says one of its attack chains is dead and code execution is unreliable.
Admins have two stopgaps until the fix lands at 14:00 UTC today.
Turning off session.upload_progress.enabled in php.ini disables the feature the leaked details point to. The only cost is upload progress bars.
Blocking every request with a multipart Content-Type at the web server goes further, but breaks file uploads.
Neither is official. Gina Peter Banyard, a PHP core developer at the PHP Foundation, says "the only mitigation is patching / upgrading PHP."
If you can afford to switch a server off for a day, she says, that might be the most sensible thing to do.
"I sadly know too much," she wrote.
A briefly posted video credited to Calif shows it running commands on a WordPress 7.1.3 site on PHP 8.5.4. Kevin Beaumont says a screenshot from it is real.
A separate public PoC is also circulating, but its own author now says one of its attack chains is dead and code execution is unreliable.
Admins have two stopgaps until the fix lands at 14:00 UTC today.
Turning off session.upload_progress.enabled in php.ini disables the feature the leaked details point to. The only cost is upload progress bars.
Blocking every request with a multipart Content-Type at the web server goes further, but breaks file uploads.
Neither is official. Gina Peter Banyard, a PHP core developer at the PHP Foundation, says "the only mitigation is patching / upgrading PHP."
If you can afford to switch a server off for a day, she says, that might be the most sensible thing to do.
"I sadly know too much," she wrote.
👍6
PHP: Originally created by Rasmus Lerdorf in 1994, it initially stood for Personal Home Page
‼️ PHP UPDATE: The Dutch parliament, the Dutch national cyber agency and Finland's central government have pulled websites offline ahead of the PHP patch.
Finland's state IT centre Valtori is shutting down public-facing central government web services. The National Land Survey of Finland is already down.
In the Netherlands, the Tweede Kamer, the NCSC and the Dutch Data Protection Authority are offline. So are tech site Tweakers and NotuBiz, which runs council information for 100+ local governments.
The University of Vienna switched off its websites, webmail and Moodle. The University of Freiburg and Finland's Haaga-Helia have taken services down too.
Fur Affinity, Pinboard, explain xkcd and every wiki on Miraheze are dark as well.
Valtori says its shutdown is a precaution, not the result of an attack or breach.
PHP was created by Rasmus Lerdorf in 1994, it initially stood for Personal Home Page
PHP's fix is due at 14:00 UTC today.
Finland's state IT centre Valtori is shutting down public-facing central government web services. The National Land Survey of Finland is already down.
In the Netherlands, the Tweede Kamer, the NCSC and the Dutch Data Protection Authority are offline. So are tech site Tweakers and NotuBiz, which runs council information for 100+ local governments.
The University of Vienna switched off its websites, webmail and Moodle. The University of Freiburg and Finland's Haaga-Helia have taken services down too.
Fur Affinity, Pinboard, explain xkcd and every wiki on Miraheze are dark as well.
Valtori says its shutdown is a precaution, not the result of an attack or breach.
PHP was created by Rasmus Lerdorf in 1994, it initially stood for Personal Home Page
PHP's fix is due at 14:00 UTC today.
🙏2🥴1
‼️ PHP UPDATE: 4chan has gone read-only and Something Awful has shut its forums as American sites brace for the PHP patch.
4chan says it is "temporarily read-only while we await an urgent PHP security update."
Something Awful says the flaw "allows for the kind of hacking you see in movies (but in real life)."
Bookmarking service Pinboard, game publisher Choice of Games, history site Damn Interesting and the explain xkcd wiki are offline too, as is art site Fur Affinity.
DeviantArt is also down "for maintenance" but has not said why.
PHP's fix is due at 14:00 UTC, 10am in New York.
4chan says it is "temporarily read-only while we await an urgent PHP security update."
Something Awful says the flaw "allows for the kind of hacking you see in movies (but in real life)."
Bookmarking service Pinboard, game publisher Choice of Games, history site Damn Interesting and the explain xkcd wiki are offline too, as is art site Fur Affinity.
DeviantArt is also down "for maintenance" but has not said why.
PHP's fix is due at 14:00 UTC, 10am in New York.
🔥6
‼️BREAKING: PHP has released its fix for the two leaked flaws, which can let attackers run code on servers without logging in.
"There are no complete mitigations, updating is the only safe choice," PHP says.
Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now.
PHP says Apache with mod_php is most at risk, with a demonstrated exploit that fires before any application code runs.
PHP 8.1 and older get no official update, though PHP has published source backports for 7.4, 8.0 and 8.1.
Source: https://www.php.net/archive/2026.php#2026-10-21-5
"There are no complete mitigations, updating is the only safe choice," PHP says.
Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now.
PHP says Apache with mod_php is most at risk, with a demonstrated exploit that fires before any application code runs.
PHP 8.1 and older get no official update, though PHP has published source backports for 7.4, 8.0 and 8.1.
Source: https://www.php.net/archive/2026.php#2026-10-21-5
🔥8❤2😱1