Mozilla received a report on October 17 at 20:06 UTC that private keys for eight eMudhra intermediate certificates were compromised, which could let attackers issue fraudulent HTTPS certificates. By 22:59 UTC Mozilla blocked the affected intermediates in Firefox via OneCRL, delivering protection without requiring browser updates or restarts. On October 20 Mozilla also removed the root that signed those intermediates from the NSS trusted store to protect users and downstream trust store consumers that do not use OneCRL; this removal may temporarily make some servers unavailable to non‑Firefox clients until those servers adopt new certificate chains. Mozilla coordinated with the issuing CA, root programs, and other trust store operators while investigating and preparing a responsible disclosure.
Mozilla recommends actions for other trust store operators: if clients reliably check revocation and fail closed, no further action is required because the CA has revoked the intermediates; if an operator can block specific intermediates, they should immediately distribute the entries listed in impacted-intermediates.json; otherwise consider distrust of the roots listed in roots.json (changes already applied to NSS). Contact for CA communication is [email protected]. Mozilla states it currently does not believe other CAs are affected and will publish additional details when available.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A PHP vulnerability currently has no working exploit, despite many fake PoCs circulating online. LLMs have falsely been portrayed as able to develop exploits, but practical testing shows no effective attack exists yet. (eliastaylor.com)
The Trump administration denaturalized two individuals who obtained U.S. citizenship by hiding their criminal activities. The move aims to revoke citizenship from those who gained it through fraudulent means. (justice.gov)
Meta's new enterprise terms state that if its AI makes a mistake, the customer is legally responsible. The terms also expand liability to content from partners and give Meta rights to scrape and use user content. (cio.com)
A vulnerability in HTTP/3 implementations allows remote clients to cause servers to allocate excessive memory by exploiting QPACK header compression. Seven of ten tested implementations are vulnerable, with some already patched to prevent resource exhaustion. (foxio.io)
Oracle has issued a security alert for CVE-2026-91403, affecting multiple Java and GraalVM products. Patches are available for supported versions, and Oracle recommends upgrading to ensure security. (oracle.com)
Help desks are increasingly targeted by social engineering attacks to reset MFA accounts. Effective verification methods for remote staff and contractors are being explored to prevent breaches. (news.ycombinator.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.