Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

certkit

Fixing distrusted InCommon certificates with ERR_CERT_AUTHORITY_INVALID

Oct 26, 2026 By Todd H. Gardner In CertKit
Starting Tuesday, October 27, a lot of university websites will open in Chrome to this. Chrome is distrusting a root certificate, emSign ECC Root CA - G3, after eMudhra generated CA keys as small as 4. Every InCommon certificate issued from eMudhra’s ECC chain since April chains to that root.
Read Post
gitguardian

OWASP Top 10 Kubernetes Security Risks Explained: Why Credentials Deserve a Closer Look

Oct 26, 2026 By Dwayne McDaniel In GitGuardian
GitGuardian researchers reached 44 active Kubernetes clusters through leaked secrets, and 30% had been exposed for more than two years. Here’s how the OWASP Kubernetes Top 10 explains these Kubernetes security risks, and why K03, Secrets Management Failures, turns one leak into a chain.
Read Post
Snyk

PHP Patches Two Critical Unauthenticated RCEs (CVE-2026-109618, CVE-2026-109619): [Updated for CVE-2026-115560]

Oct 26, 2026 By Snyk Security Research In Snyk
On Wednesday, October 21, 2026 at 14:00 UTC, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities, both rated CVSS v4.0 9.2, that can allow unauthenticated remote code execution. The PHP security team advises: "There are no complete mitigations; updating is the only safe choice." These are bugs in the PHP runtime, not in a Composer package.
Read Post
knowbe4

[Cybersecurity Awareness Month] Why Your Best Incident Reporting Tool Is Behavioral, Not Software

Oct 26, 2026 By Javvad Malik In KnowBe4
During an incident, the most valuable intel is from people on the ground. Security teams rely on their colleagues across the organization to report issues quickly and without trying to fix things themselves. However, many don’t report odd emails, strange pop-ups or the USB stick they found in the car park. This can be due to embarrassment, fear of getting into trouble or not wanting to be the one who cried wolf.
Read Post

Explaining PHP2Shell | Arctic Wolf Threat Brief

Oct 26, 2026 By Arctic Wolf Networks In Arctic Wolf
In this explainer from Arctic Wolf's Peter Ingebrigtsen, we break down what the PHP2Shell vulnerabilities are, how attackers are exploiting them, and the steps organizations should take now to reduce exposure. Arctic Wolf customers can use Aurora Exposure Management to identify affected assets and prioritize remediation, while the Aurora Agentic SOC helps detect and respond to post-exploitation activity such as webshell deployment, unauthorized command execution, persistence, and lateral movement.
View Video
miniorange

Passwordless Authentication Trends in 2027: What's Next for Login Security?

Oct 26, 2026 By Minal Purwar In miniOrange
Passwords are no longer the only weakness in digital identity. Passkeys and FIDO2 reduce reliance on reusable credentials, but attackers can still target account recovery, steal active sessions, or exploit permissions granted to automated systems. Therefore, the next phase of passwordless authentication must address these gaps without making everyday access unnecessarily complicated.
Read Post

Self Service Password Reset SSPR in Microsoft 365 Admin Center #bdrshield #dataprotection #business

Oct 26, 2026 By Vembu Technologies In BDRSuite
Learn how to set up Self-Service Password Reset (SSPR) for Microsoft 365 so users can reset their passwords without contacting IT support. In this video, discover how SSPR helps reduce password-related help desk requests and keeps employees productive. A password reset restores access—but it can’t recover deleted emails or lost files. BDRShield Microsoft 365 backup helps you restore the business data behind the login.
View Video
cato networks

Cato CTRL Threat Brief on Attacks Against Refrigeration Controllers

Oct 26, 2026 By Dr. Guy Waizel In Cato Networks
CERT-FR’s October 13 update reports compromises of refrigeration controllers, naming Danfoss AK-SM and AK-SC alongside Copeland/Dixell XWEB systems. The entry methods remain unconfirmed. CERT-FR warns that attacks are probably continuing and recommends removing public exposure, checking configurations, and securing remote access. Compromised operational technology (OT) can disrupt cooling, compromise stored products, and threaten cold-chain continuity.
Read Post
appsentinels

10 API Security Best Practices for Achieving PCI DSS 4.0.1 Compliance

Oct 26, 2026 By AppSentinels In AppSentinels
PCI DSS 4.0.1 is the first major standard to name API business logic as an attack type you must address. Requirement 6.2.4 lists attacks on business logic, including attempts to abuse or bypass application features through the manipulation of APIs, alongside injection and access control flaws. The timing matters. All requirements, including the ones that were future-dated, have been mandatory since 31 March 2025. Your next assessment will test controls that were optional a year ago. The reason is simple.
Read Post
Automating Third-Party Contractor Risk in Regulated Facilities

Automating Third-Party Contractor Risk in Regulated Facilities

Oct 26, 2026 By SecuritySenses In SecuritySenses
Third-party contractors are one of the largest unmonitored compliance gaps inside regulated facilities. While internal employees go through rigorous background checks, recurring safety training, and strict access provisioning, external technicians and vendors often bypass those controls at the front desk. When an HVAC technician, specialized equipment calibrator, or electrical contractor walks onto a regulated floor with an expired certification, the host facility absorbs the regulatory and financial liability.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.