Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

On Tuesday, October 27, Chrome will distrust an eMudhra root certificate, emSign ECC Root CA - G3. Mozilla already did. Most of the people who have to deal with it run IT at American universities. They get their certificates from InCommon, the certificate service Internet2 runs for higher education. The certificates say Internet2 on them, but since April, eMudhra, an Indian certificate authority, has issued them.

A well-written AI policy is where governance starts. It gets legal, security, and the business aligned on how much risk the organization is willing to accept, and nothing else in the program works without it. Every AI policy ultimately exists to protect the data held by the organization. In today’s world, data held in information systems is the crown jewel of most organizations but the same data can put the organization at risk if it leaks, gets stolen, or is mishandled.

The Evo Remediation Agent is now in Open Preview, bringing automated dependency resolution to Evo Agentic AppSec. AppSec teams can now run ongoing remediation campaigns across repositories and deliver proposed fixes to developers through validated pull requests. Fixing a dependency vulnerability can mean choosing an upgrade, resolving dependency conflicts, adapting the application, and/or checking the result. That work competes with everything developers are already building.

On October 21, 2026, the PHP project published fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2 and collectively known as php2shell. Since then, we have received questions about what to do.

A theme throughout our September updates is data. Build with data, use data to inform AI-assisted case work, and make data easier to read and share.

Ransomware attacks are on the rise, and no industry is safe. The motive behind such attacks is to encrypt confidential business data and demand a ransom to restore access. Many industries, including healthcare, experience ransomware attacks regularly. Patients’ records, critical operations, and life-saving systems are targeted by attackers. They can lock down data and systems within minutes, disrupting healthcare services.

An emergency vulnerability response begins before the patch arrives. On 20 October 2026, the PHP project announced two critical vulnerabilities, each rated CVSS v4.0 9.2, but withheld the technical details security teams would normally use to assess exposure. Organizations had a release window to prepare for, but no confirmed affected versions or attack vector.