eMudhra exits public TLS. Its certificates still need a managed transition
The certificate authority is withdrawing after its weak-key incident. Replacement, revocation services and software distru...
Ideas. People. A brighter tomorrow.
Security
36 stories
1Password lets agents sign in without reading the password
Approval moves into the password manager. What happens after login still depends on the agent—and EU-hosted accounts are n...
Railway’s breach response has two jobs: restore builds and retire exposed credentials
Builds are recovering in stages. Customers also need to revoke secrets at the services that issued them and understand the...
PHP2Shell: the investigation window starts before the patch
Amazon observed attack attempts before public disclosure. That changes the period defenders need to examine, without provi...
Cloudflare’s firewall now checks the answer, too. A blocked response is not a repaired server
Full-transaction detection adds outgoing evidence to incoming requests. The distinction matters when an attack has already...
iOS 27’s scam protection sends a risk signal. Your app decides what happens next
Apple’s anti-scam setting targets pressured actions by legitimate users. Its privacy notice also explains why the process...
Chrome adds a middle-ground warning for sites that look suspicious
Enhanced Protection distinguishes uncertain risk from established danger and looks for clipboard tricks used in social-eng...
The Tor relay incident shows why an SSH identity warning deserves a stop
A researcher traced 333 affected exits. The case separates route anonymity, endpoint authentication and the security of th...
1Password’s quantum-safe passkeys need a website on the other end
ML-DSA support is an early migration step. Updating the password manager does not convert every existing passkey or make e...