Eight intermediate certification authorities operated by eMudhra had their private keys compromised. Six issued TLS certificates, allowing someone holding the keys to create certificates that could appear valid for any website; the other two issued code-signing certificates that Apple’s frameworks do not trust. The six TLS authorities each have two certificate versions, producing 12 affected certificates: one chain leads through emSign ECC Root CA - G3, and the other through Sectigo’s AAA Certificate Services. eMudhra and Sectigo revoked the affected certificates. Apple began blocking all 12 on October 19, 2026, and also began blocking emSign ECC Root CA - G3 on October 23. These protections are delivered automatically, without requiring a software update, in Safari, Mail, and apps using Apple’s security and networking frameworks.
Most people need take no action. The concern is Mac command-line tools such as curl, git, Python, Ruby, Perl, and OpenSSL, which may rely on /etc/ssl/cert.pem and may not honor Apple’s blocks or check revocation. Administrators who need earlier protection can remove emSign ECC Root CA - G3 from that file; removing AAA Certificate Services as well blocks the cross-signed certificates. These edits affect every tool using the file and may prevent verification of some otherwise unaffected websites. A future macOS update will incorporate Apple’s changes and may replace the edited file, so administrators who make manual changes must check and reapply them until that update is installed. Tools with their own certificate stores require separate action from their developers.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A leak of DHS records exposed personal and workplace details for more than 41,000 employees and contractors, including undercover ICE agents and information about surveillance programs. Distributed Denial of Secrets published the data, while Okta said it had no evidence its systems were breached. (wired.com)
Several PDF tools generate advertised AES-256 keys from weak randomness, making encrypted files vulnerable to passwordless decryption. MuPDF versions before 1.28.5 expose only 9 bits of random state in the key, while Foxit relies on predictable time-based randomness. (v12.sh)
Distributed Denial of Secrets published a searchable database with contact information for nearly 40,000 DHS employees, reportedly obtained through an Okta single sign-on leak. The group says the database highlights officials overseeing agency policies and operations, including immigration enforcement and covert programs. (techdirt.com)
Distributed Denial of Secrets released personal and job data on more than 40,000 DHS employees, including staff in surveillance, intelligence, and undercover roles. The group says the data came from a hack of DHS’s Okta sign-on service, but Reuters could not verify the full trove and Okta reported no evidence of a compromise. (reuters.com)
An Android user says Claude Code uncovered 14,219 front-camera and infrared face-unlock images in system and Google Play Services caches, many with timestamps and location data. The user says images kept appearing and recommends checking device backups, though the claim has not been independently verified. (twitter.com)
Amplitude suffered a security incident that exposed contact information for a small subset of Coinbase customers and other clients. Coinbase says its systems and customer funds were unaffected, and it is notifying impacted customers and regulators. (twitter.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.