‼️ The git, curl and python3 in macOS still trust compromised eMudhra certificates, 11 days after Apple was told.

Anyone can recover their keys, so an attacker on your network could pose as GitHub and feed you code.

Researchers say macOS 27.2 even wiped fixes applied by hand.

https://x.com/IntCyberDigest/status/2115501599950766146

❗️ Britain will consult next year on where liability for cyber breaches should sit, its new budget says.

It could make software companies liable for insecure products, after years of relying on voluntary codes.

https://x.com/IntCyberDigest/status/2115516447904366686

❗️ A researcher working with MongoDB scanned 7.25 million public repos on Gitee, China's largest homegrown Git host, and found 26,400 live credentials.

About 1 in 766 repos held a working Alibaba Cloud key.

One was an active admin credential for a major enterprise AI platform.

https://x.com/IntCyberDigest/status/2115531547306815809

‼️ Russia added Apple and Microsoft to its surveillance registry on 2 October.

Listed firms must store Russian users' messages for 6 months and hand them to security services on request. The FSB can also demand keys to decrypt them.

Telegram was blocked in 2018 for refusing.

https://x.com/IntCyberDigest/status/2115546646746673651

‼️ BREAKING: A leak has exposed ~41,000 Homeland Security workers, including undercover ICE agents.

Wired found mobile numbers, ICE and CBP sites and groups tied to Palantir and Grok.

DDoSecrets says it came via DHS's Okta login. Okta says it has no evidence it was compromised.

https://x.com/IntCyberDigest/status/2115557036595552578

❗️ Attackers are hitting Windows servers with the critical PHP2Shell flaws, Morphisec says. Until now, every reported attack hit Linux.

It says it blocked a reverse shell on a customer's IIS server.

Survey shows 10k Qualys customers alone run 110M PHP installs on EoL versions.

https://x.com/IntCyberDigest/status/2115576845777183090

❗️ A critical Signal bug let the other person on a call keep listening after you hung up.

Flooding the call's event queue could stall your hang-up, leaving your mic and possibly your camera live.

Signal patched CVE-2026-113380 on Android in September. No attacks are known.

https://x.com/IntCyberDigest/status/2115591945250816455

❗️ Google's and Meta's Pacific cables rank 3rd and 5th of 32 for sabotage risk in a report for Congress's US-China commission.

A separate CSIS study tracked a Chinese research ship mapping US-linked cables on the high seas off Guam.

Neither cable is even in service yet.

https://x.com/IntCyberDigest/status/2115607044749189336

‼️ Putin says Russia is in "close contact" with Elon Musk so their satellites don't "interfere with each other" in orbit.

He called Musk "a real genius" beside a satellite from Rassvet, Russia's answer to Starlink.

2 weeks ago, SpaceX throttled Ukraine's Starlink drone links.

https://x.com/IntCyberDigest/status/2115622144180957582

❗️ The FCC votes Nov 19 on letting state prisons and jails jam inmates' phones for the first time.

Chair Brendan Carr would sidestep a US jamming ban by ruling the phones unauthorised.

Incarcerated journalists say those phones exposed abuse the DOJ found in Georgia prisons.

https://x.com/IntCyberDigest/status/2115637243876376971

‼️ Monero swap site https://t.co/8SieTIvG8L confirmed 3 months of its data leaked after a $5M extortion demand.

Hudson Rock found 4,580 orders tying a public crypto deposit to a Monero address and the IP behind it.

The leak still holds 4,002 orders flagged as deleted by users.

https://x.com/IntCyberDigest/status/2115652343421186137