Cybersecurity news
that matters to your business.

eMudhra, a digital trust provider with services in India, revoked eight intermediate certificate authorities in its Global TLS business after a researcher found their private keys were weak. The keys were created in an April 2025 ceremony, and a flaw in one key-handling step produced a weak set alongside strong keys. eMudhra says no certificates were issued from the revoked intermediates and no data was breached. Google Chrome and Mozilla have blocked the affected keys in their browsers.

eMudhra, a digital trust provider with services in India, revoked eight intermediate certificate authorities in its Global TLS business after a researcher found their private keys were weak. The keys were created in an April 2025 ceremony, and a flaw in one key-handling step produced a weak set alongside strong keys. eMudhra says no certificates were issued from the revoked intermediates and no data was breached. Google Chrome and Mozilla have blocked the affected keys in their browsers.

Trezor warned that a third-party email-provider breach was being used to send fraudulent security alerts to customers, according to BleepingComputer. The company said the messages were phishing attempts and that it was investigating. The messages' claimed wallet vulnerability is part of the lure, not a verified finding.

Trezor warned that a third-party email-provider breach was being used to send fraudulent security alerts to customers, according to BleepingComputer. The company said the messages were phishing attempts and that it was investigating. The messages' claimed wallet vulnerability is part of the lure, not a verified finding.

GreyNoise reports that attackers used two WordPress vulnerabilities against at least 49 organizations and stole more than 18,000 records from an unnamed Western government. It also reports exploitation and data extraction from 996 Zyxel GS1900 switches in 48 countries. The observations come from the firm's sensors and attacker infrastructure; the government victim remains unnamed and state sponsorship is not established.

GreyNoise reports that attackers used two WordPress vulnerabilities against at least 49 organizations and stole more than 18,000 records from an unnamed Western government. It also reports exploitation and data extraction from 996 Zyxel GS1900 switches in 48 countries. The observations come from the firm's sensors and attacker infrastructure; the government victim remains unnamed and state sponsorship is not established.

An update reported by BleepingComputer puts the AdaptHealth breach's affected population at approximately 4.1 million people. The incident involved a compromised contractor account and access to cloud business applications. This is an impact update about an earlier intrusion, not evidence of a new attack in September.

Spain's data protection agency received a report alleging that an AI agent found vulnerabilities, accessed systems, changed personal data and viewed invoices. The agency has not investigated or verified the report, so the incident details remain developing.