Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Starting Tuesday, October 27, a lot of university websites will open in Chrome to this. Chrome is distrusting a root certificate, emSign ECC Root CA - G3, after eMudhra generated CA keys as small as 4. Every InCommon certificate issued from eMudhra’s ECC chain since April chains to that root.

GitGuardian researchers reached 44 active Kubernetes clusters through leaked secrets, and 30% had been exposed for more than two years. Here’s how the OWASP Kubernetes Top 10 explains these Kubernetes security risks, and why K03, Secrets Management Failures, turns one leak into a chain.

On Wednesday, October 21, 2026 at 14:00 UTC, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities, both rated CVSS v4.0 9.2, that can allow unauthenticated remote code execution. The PHP security team advises: "There are no complete mitigations; updating is the only safe choice." These are bugs in the PHP runtime, not in a Composer package.

At One Identity, we are proud to share that Gartner has recognized us as a Challenger in the 2026 Gartner Magic Quadrant for Privileged Access Management (PAM). We believe our Challenger placement is a recognition that reflects how well we execute: we are delighting the customers we serve, retaining them over the long term, and building a position that is well suited for what comes next.

During an incident, the most valuable intel is from people on the ground. Security teams rely on their colleagues across the organization to report issues quickly and without trying to fix things themselves. However, many don’t report odd emails, strange pop-ups or the USB stick they found in the car park. This can be due to embarrassment, fear of getting into trouble or not wanting to be the one who cried wolf.

Passwords are no longer the only weakness in digital identity. Passkeys and FIDO2 reduce reliance on reusable credentials, but attackers can still target account recovery, steal active sessions, or exploit permissions granted to automated systems. Therefore, the next phase of passwordless authentication must address these gaps without making everyday access unnecessarily complicated.

CERT-FR’s October 13 update reports compromises of refrigeration controllers, naming Danfoss AK-SM and AK-SC alongside Copeland/Dixell XWEB systems. The entry methods remain unconfirmed. CERT-FR warns that attacks are probably continuing and recommends removing public exposure, checking configurations, and securing remote access. Compromised operational technology (OT) can disrupt cooling, compromise stored products, and threaten cold-chain continuity.

PCI DSS 4.0.1 is the first major standard to name API business logic as an attack type you must address. Requirement 6.2.4 lists attacks on business logic, including attempts to abuse or bypass application features through the manipulation of APIs, alongside injection and access control flaws. The timing matters. All requirements, including the ones that were future-dated, have been mandatory since 31 March 2025. Your next assessment will test controls that were optional a year ago. The reason is simple.