JEDI-SEC | Security Research & Digital Defense

Category: Security News

  • EMudhra Intermediate CA Certificates Compromised

    EMudhra Intermediate CA Certificates Compromised

    Eight compromised eMudhra intermediate CA private keys risk unauthorized TLS signing and MitM interception. Read our analysis and containment guide.

    Source: Palo Alto Networks Unit 42 · 2026-10-22

  • The Current Landscape of OAuth Attacks

    The Current Landscape of OAuth Attacks

    Unit 42 explores modern OAuth threats and actionable steps organizations can take to protect their environments.

    Source: Palo Alto Networks Unit 42 · 2026-10-22

  • Facebook’s misleading privacy claims land Meta a $25 billion penalty

    Facebook’s Cambridge Analytica scandal may feel like very old news. But the consequences are still arriving, and the latest comes with a $25 billion price tag.

    Reuters reports that a New Mexico judge has ordered Meta to pay $25 billion in civil penalties after a jury found that Facebook misled consumers about its data practices and its handling of hate speech and misinformation. Meta says it expects to win on appeal.

    This case is about more than information ending up in the wrong hands. It concerns what Facebook told people about who could access their information, how much control users had, and how the company enforced its own rules.

    What Facebook told its users

    In September, jurors found that the company and its leadership made 26 misleading statements on data privacy, hate speech, and other subjects. For example, Mark Zuckerberg’s 2010 statement that:

    “We do not share your personal information with people or services you don’t want.”

    That assurance appeared in a statement the jury found misleading. The judge found that choosing who could see a Facebook post did not necessarily control what outside app developers could access. That access was governed by separate settings that many users did not know existed.

    New Mexico’s attorney general filed the lawsuit in 2021, following revelations that Cambridge Analytica obtained personal information from as many as 87 million Facebook users through a third-party app.

    But New Mexico’s case went beyond Cambridge Analytica.

    The state challenged Facebook’s representations to consumers about its data practices and its efforts to address misinformation and hate speech. The case centered on misleading consumers under New Mexico’s Unfair Practices Act, the state’s consumer protection law.

    The state argued that third parties had broad access to users’ information and that Facebook tolerated harmful content when doing so benefited its business. Meta disputed the allegations, denied selling users’ information, and said the state had taken statements out of context.

    New Mexico’s Department of Justice says the jury found 43,899,725 violations of state law. That does not mean nearly 44 million individual New Mexicans had their data taken. The count reflected the estimated audience for each misleading statement, rather than the number of individual people affected.

    State law allows penalties of up to $5,000 per violation. Judge Francis Mathew found that a penalty exceeding $219 billion was warranted under the law but reduced the amount to $25 billion.

    The judge said earlier penalties had failed to stop Meta from misleading consumers, including a $5 billion FTC penalty in 2019.

    The money is not earmarked for compensation payments to individual Facebook users. According to Attorney General Raúl Torrez, state law directs the penalties to New Mexico’s school system.

    Meta’s chief legal officer, C.J. Mahoney, said the company is confident it will prevail on appeal and characterized the lawsuit as an attempt to impose “a tax on speech.” Meta has also argued that a multibillion-dollar penalty risks violating constitutional protections concerning due process and excessive fines.

    How to stay safe on social media

    The case illustrates why privacy is not just a matter of choosing who can see a post. In a separate 2019 case, the Federal Trade Commission (FTC) alleged that Facebook had shared users’ information with third-party apps used by their friends, even when those users had chosen restrictive privacy settings.

    A few precautions can help you limit what you share, although settings alone cannot guarantee privacy:

    • Share selectively. Leave optional profile details blank, limit who can see your posts, and avoid publishing sensitive details such as your address or live location. Ask permission before posting information or photos involving other people.
    • Check app permissions. Does a social media app really need your contacts, precise location, or entire photo library? Turn off unnecessary access in your device settings.
    • Review tracking and advertising settings. Look for controls covering personalized ads, activity outside the platform, and data sharing. Restrict what you can, but don’t assume opting out of personalized ads stops all collection.
    • Be selective about connected apps. Before connecting a quiz, game, or other service to your account, check what information it requests. Decline access that seems excessive for what the service does.
    • Remember what “private” means. Restricting your audience helps control who sees your posts. It does not stop the platform itself from collecting or using information about your activity.

    Scammers don’t need to hack you. They just need you to click once. 

    Malwarebytes Identity Theft Protection catches suspicious activity before it becomes a problem.

    Source: Malwarebytes Labs · 2026-10-22

  • Disgraced Indian cert issuer leaves the cert issuing business

    Disgraced Indian cert issuer leaves the cert issuing business

    After embarrassing reports revealed weak private keys, one of which was just a single digit, Indian certification authority eMudhra has decided to take the L and get out of the global SSL/TLS cert game entirely. eMudhra announced Thursday that it was abandoning that arm of its business. Sure, the intense scrutiny heaped on the company was a factor, but the firm also argued that growing compliance costs and competition from free certificate providers had made the business increasingly difficult to justify. “Global SSL/TLS is a small part of eMudhra’s business contributing to about 1 percent of the global revenue,” the company explained, noting that free SSL/TLS cert issuance from large firms and increased compliance and data sovereignty requirements have made it a minor part of the firm’s operation, and one that doesn’t merit so much bad press. “The level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS’s place in our business,” eMudhra explained. “In view of this, after detailed deliberations our board has concluded that withdrawing from global SSL/TLS is the right decision for eMudhra and its shareholders.” An argument could be made that, even if SSL/TLS accounts for just 1 percent of its global revenue, a private CA key with a value of 4 still deserves a thorough public shaming. It’s only been two days since eMudhra’s weak private keys were exposed in public reports, following a report to Mozilla on October 17, and it wasn’t exactly hard for security researchers to recover them: The eight affected private-key values ranged from the number 4 (yes – a plain old number 4), to 56 and 66, to the far more complicated 115, 155, 156, 230, and 237. No quantum computer required to crack those keys. Wow – better save the qubits. This wasn’t just an embarrassing collection of numbers, either: The weak keys belonged to eight intermediate certificate authorities, potentially allowing attackers to forge certificates trusted by systems that hadn’t blocked them. eMudhra, however, maintains that the affected CAs had issued no end-entity certificates. eMudhra quickly went on the defensive about its mind-boggling key-management failure, acknowledging the weak keys while pointing to independent audits and a problem during its key-generation ceremony that it said produced the weak keys alongside the intended strong ones. “A flaw in the key generation ceremony caused a wrap/unwrap step to produce a second set of weak keys alongside the original strong keys,” the company said the day after the key fiasco was reported. “The weak keys were the ones published to the browser root stores.” Despite that, eMudhra said the relevant certificate infrastructure had undergone two years of independent audits and had been in browser trust lists since mid-2025, raising questions about why the weak keys weren’t caught sooner. eMudhra claimed on Thursday that the affected CAs had issued no end-entity certificates, that it had revoked those CAs within 14 hours of discovering the issue, and that neither its infrastructure nor its data had been compromised as a result of its key boo-boo. Still, the incident has given eMudhra another reason to shave off a small part of its business rather than continue facing scrutiny over its certificate operations. It’s still going to issue a root-cause report and fulfill its remaining commitments to browser root programs as it winds down the business. The company said it’ll continue to serve G1 RSA roots until it transitions customers to other certificate issuers, which it will do free of charge. “Revocation and certificate status services will keep running until every issued certificate has expired or been replaced,” the company said. ®

    Source: The Register — Security · 2026-10-22

  • As AI Risks Grow, Insurers Split on Covering the Damage

    As AI Risks Grow, Insurers Split on Covering the Damage

    Some build specialized agentic AI coverage, while major carriers quietly exclude it — leaving enterprises exposed without their knowledge.

    Source: Dark Reading · 2026-10-22

  • Scammers are finding new ways to target your phone. Here are 5 ways to protect yourself

    Scammers are finding new ways to target your phone. Here are 5 ways to protect yourself

    The warnings are everywhere these days. Don’t click this. Don’t open that. Don’t scan this. Don’t download that. These messages of caution, however well-intended, are so ubiquitous and constant that it should come as no surprise that some people have started to tune them out.

    How many people? About one in three, according to our recent study.

    Keeping up with every warning can feel exhausting. Meanwhile, scammers are finding new ways to target people and phones give them plenty of opportunities.

    Mobile phones give scammers multiple ways to reach people, from text messages and calls to social media posts. According to a 2022 Federal Communications Commission report cited by the Federal Trade Commission (FTC), texting is a more common communication method than voice or email.

    Criminals appear to be taking advantage of that fact. Consumers reported losing $470 million to text scams in 2024, up 26% from $373 million the year before and more than five times the amount reported in 2020. The FTC cites estimates that text message open rates run as high as 98%, compared to just 20% for email. People’s tendency to open and read their texts helps explain their appeal to scammers.

    Meanwhile, AI is making scams harder to detect, but better at impersonating people and companies to steal money, passwords, and identities.

    Voice phishing, or “vishing,” was a vanishingly small category of crime just a few years ago, but AI has made it considerably more convincing. Vishing doubled in the first half of 2026, according to CrowdStrike’s 2026 Threat Hunting Report. Meanwhile, 16% of adults in the Malwarebytes survey said they had received a voice-cloned phone call impersonating someone they knew in the past year.

    Our data also shows how difficult people find it to recognize scams: 85% of survey respondents said it’s hard to tell a scam from the real thing, up from 66% a year ago. And 84% said convincing video evidence no longer feels like the rock-solid proof it once was.

    Here are five ways to protect yourself

    1. Treat unexpected texts and social media posts with suspicion

     Legitimate institutions generally won’t ask for payment or personal information through unsolicited texts. And if the message is marked “urgent,” all the more reason to pause. Instead, go directly to the company’s official website and inquire there.

    AI-generated images and videos are making it harder to tell what’s real online, so don’t rely on what you see as proof that a request is legitimate. If the content involves someone you know, contact them directly using a number you already trust.

    2. Keep your operating system updated

    This is one of the most effective things you can do to keep your phone safe. Security updates patch vulnerabilities that malware takes advantage of. Malwarebytes’ threat research found Android malware detections rose 151% in the first half of 2025. On both iPhone and Android, automatic updates help decrease risk.

    3. Protect your accounts

    Use a strong, unique password for every account. A password manager can create and store them for you. Where available, use a passkey—a way to sign in using your device, often with your fingerprint, face, or PIN—that resists phishing.

    Turn on two-factor authentication, also called 2FA, for all your apps that allow it. This one step makes it harder for criminals who have your password to gain access to accounts on your phone.

    4. Be skeptical of voice calls, even from your mom

    This can be the hardest one to get your head around, but also one of the most dangerous and fastest-growing. AI-synthesized audio fraud has made it easier for scammers to sound convincingly like a loved one in trouble. Agree on a private code word with family members and friends in case of doubt or emergency. If you’re unsure, hang up and call the person on a number you already have. If the caller claims to be your bank, hang up and call back on a number you look up independently.

    Before opening a link in a text, email, or social media post, check the web address for misspellings or an unfamiliar domain. You can also copy it into the free Malwarebytes Scam Link Check for help assessing it.

    QR codes can hide suspicious links, too. Scammers sometimes place fake sticker overlays on top of legitimate QR codes in public spaces, and QR code phishing is morphing so fast that the FBI issued an alert in January about North Korean hackers using QR codes to target think tanks and government officials. Look for signs of tampering and check the web address your phone displays before opening it. If you’re not sure, don’t open the link. Instead, go directly to the organization’s official website or app.

    Scammers rely on speed and pressure, so the best defense is to slow down. If a message or call feels off, step away and check it through a channel you already trust.

    CNET Editors' Choice Award 2026

    “One of the best cybersecurity suites on the planet.” 

    According to CNET. Read their review →

    Source: Malwarebytes Labs · 2026-10-22

  • EU Regulators to Investigate Booking.com Over Scam Risks

    The EU Commission will assess whether Booking.com has adequately protected customers from phishing attacks

    Source: Infosecurity Magazine · 2026-10-22

  • New Serious PHP Vulnerabilities Released and Patched

    PHP maintainers have released fixes for two critical vulnerabilities:

    PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.

    Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.

    The vulnerabilities:

    • RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
    • RCE via stale global state, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.

    Updating PHP is the only way to regain security. Do it now.

    More news.

    Good explanations.

    Source: Schneier on Security · 2026-10-22

  • Iranian Hacking Group Found Hosting C2 Infrastructure in the US

    Stealthy malware campaign by ‘Prince of Persia’ threat group targeting organisations worldwide discovered operating on American soil

    Source: Infosecurity Magazine · 2026-10-22

  • Microsoft: Chinese State Actor Used AI to Compromise ConnectWise Tenants

    Microsoft said it has observed threat actor activity in multiple ConnectWise customer environments, with the attackers leveraging the ARTEX agentic AI platform

    Source: Infosecurity Magazine · 2026-10-22