Weekly recap: PHP2Shell scans, Plex2Shell attacks, LiteLLM supply chain
CISA listed four exploited Plex flaws, while a leaked LiteLLM key led to a malicious Python package release.
78
- Mentions · 7d1
- Mentions · 30d68
- All mentions157
- First seenAug 17, 2026
- Last mentioned4d ago
Timeline
157 articles · newest firstOkta and Auth0 are removing trust in eMudhra emSign ECC Root CA – G3
Derived keys for eight intermediates can mint certificates for any domain; Okta reports no exploitation.
74
Okta and Auth0 are removing trust in eMudhra emSign ECC Root CA – G3
Derived keys for eight intermediates can mint certificates for any domain; Okta reports no exploitation.
74
eMudhra exits certificate business after weak intermediate keys
Eight intermediate keys were trivial values; browsers blocked them, and the firm says nothing was breached.
78
OpenAI, Anthropic, and Nvidia post record lobbying quarters
Nvidia spent $2.2 million, Anthropic $2.1 million, and OpenAI $1.5 million from July through September.
48
Weak eMudhra intermediate keys can impersonate sites; vendors block them
Go 1.27.3 and 1.26.10 distrust eight weak intermediates as CVE-2026-111943; Talos reports no malicious use yet.
78
Weak eMudhra keys expose eight trusted intermediate certificates
All eight P-384 private keys were integers below 256 and could be recovered from public certificate data.
78
Eight eMudhra intermediate CA private keys compromised
The intermediates chain to roots in major browser programs, so bundled trust stores need updates.
90
eMudhra CA private keys compromised, one was the number 4
Mozilla, Chrome and Apple are distrusting eight intermediates after keys such as 4, 56 and 115 were recovered in under a second.
86
"In every study that considered the question"
An essay argues that unlabeled icons in cars and iOS are harder to understand than text labels.
4
A week with RTX Spark: everything we’ve learned using Nvidia’s new laptops
The Verge tested Nvidia's Arm RTX Spark N1X laptops for local AI, apps, and gaming.
34
iPhone Duo sells out now backordered until next year
Apple’s foldable iPhone Duo sold out within minutes, with new orders backordered into late January.
3
Xcode 27.1 (27A9275)
Apple published Xcode 27.1 build 27A9275 with download links and no security details.
3
Meta and Apple team up to make Muse AI models run better on Macs
Meta released Muse Spark Open, an 816B open-weight model tuned with Apple to run on Mac Studios.
76
Remote Attestation Should Not Be Tolerated
A blog argues Google Play Integrity and similar remote attestation lock users out of devices they own.
24
TestFlight Update
Apple published a TestFlight update notice with no vulnerability details disclosed.
15
YouTube Music launches new labels as AI-generated music floods streaming platforms
YouTube Music adds disclosure labels identifying fully or partly AI-generated songs across its player.
46
YouTube sticks new labels on AI-generated songs
YouTube Music is labeling songs primarily created or altered with generative AI tools.
44
Xcode 27.2 beta 3 (27B5038j)
Apple listed Xcode 27.2 beta 3, but the notice gives no security fixes or vulnerability details.
4
OpenAI claims an ex-employee took its product plans and presented them to Apple
OpenAI says a former employee took over 100 product files and showed them to Apple.
52
Deezer will soon let you filter out AI-generated music
Deezer will let listeners hide AI-generated music after such tracks exceeded half of daily uploads.
24
VU#948176: Multiple TLS Libraries can Bypass Delegation Enforcement
CERT/CC says TLS libraries inconsistently enforce Name Constraints, with three assigned CVEs already fixed.
64
Judge orders OpenAI to turn over hiring records in Apple trade secrets case
A federal judge ordered OpenAI to quickly produce hiring records in Apple's trade-secrets lawsuit over former Apple staff.
46
iPadOS 27.2 beta 4 (24B5110a)
Apple listed iPadOS 27.2 beta 4, build 24B5110a, with no security details.
18
watchOS 27.2 beta 4 (24S5112a)
Apple listed watchOS 27.2 beta 4, build 24S5112a, with no security details.
18
iOS 27.2 beta 4 (24B5110a)
Apple released iOS 27.2 beta 4 (build 24B5110a) to developers.
20
visionOS 27.2 beta 4 (24N5114a)
Apple released visionOS 27.2 beta 4 (build 24N5114a) to developers.
16
macOS 27.2 beta 4 (26B5112a)
Apple released macOS 27.2 beta 4 (build 26B5112a) to developers.
18
Apple's new 'Switch to Safari' campaign details why you should ditch Chrome
Apple launched a Switch to Safari campaign claiming better privacy and speed than Chrome.
6
A Dynamic and Distributed Virtual GPU Cloud Built on Idle Apple Silicon Devices
Apple’s Minions paper turns idle Apple Silicon Mac GPUs into a distributed cloud for ML inference.
56
Researchers Discover New Domain Spoofing Techniques That Bypass Chrome’s Phishing Protections
Researchers showed IDN lookalike domains can evade Chrome’s Unicode display and near-match phishing warnings.
60
New Unicode Characters Let Attackers Create Convincing Lookalike Domains for Phishing
Researchers showed Chromium can display Unicode brand lookalike domains as readable text, bypassing Punycode warnings.
58
Inside ICMacOS: From an Infostealer to a Persistent RAT
SOCRadar analyzes ICMacOS, macOS malware that evolved from an infostealer into a persistent RAT.
52
Will the HomeView be Apple’s first smart home success?
Apple will reportedly unveil HomeView, a Siri-powered smart home hub, on Tuesday.
6
October 2026 Patch Tuesday forecast: Time for an Office cleanup
October 2026 Patch Tuesday forecast after September's record 973 Microsoft CVEs; Apple already patched exploited zero-day CVE-2026-86950.
40
DarkSword iOS Exploit Platform Uses Coruna Malware to Steal Crypto Wallet Recovery Phrases
DarkSword's Coruna malware uses iOS browser exploits to steal cryptocurrency wallet recovery phrases from iPhones.
72
Alexa Plus is better at running my home, but it’s not ready to run my life
A year-long review finds Alexa Plus strong for smart homes but weak as a personal assistant, with intrusive Echo ads.
28
Google says 180 billion images and videos now carry SynthID watermarks as detector goes public
Google opened its SynthID Detector publicly and says over 180 billion images and videos carry its watermarks.
52
Muse launches on the iPad
Meta’s Muse AI agent gains native iPad support and new business software connectors.
38
Google rolls out improved SynthID AI content detector, now available globally
Google's improved SynthID detector is now global for checking partner AI watermarks in media.
48
Related CVEs
by mentions- CVE-2026-8695026%8.8Out-of-Bounds Write in Apple CoreGraphics Enables Code Execution on iOS and macOS
- CVE-2025-4330065%10.0Actively Exploited Out-of-Bounds Write in Apple iOS/iPadOS/macOS Image I/O
- CVE-2026-654002%9.8Authentication Bypass in Apple macOS Screen Sharing
- CVE-2026-207002%7.8Exploited Memory Corruption Flaw in Apple iOS, iPadOS, macOS, tvOS, visionOS, watchOS
- CVE-2025-5517714%5.4Incorrect Authorization in WhatsApp Linked-Device Sync Used in Targeted Spyware Attacks
- CVE-2026-8877182%9.5Unauthenticated RCE in Citrix NetScaler ADC and Gateway
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- Authenticated RCE in GitLab CE/EE via Double Free in CI/CD Regex Parsing
- CVE-2026-62721<1%7.8Insufficient granularity of access control in User-Mode Power Service (UMPS) allows an authorized attacker to elevate privileges locally
Appears with
- Applevendor · 103
- Metaorganization · 25
- Googleorganization · 23
- macOSproduct · 20
- Metavendor · 17
- OpenAIorganization · 17
- Googlevendor · 16
- Microsoftorganization · 14
- Cloudflareorganization · 11
- Mozillaorganization · 11
- iOSproduct · 11
- Museproduct · 10
- iPadOSproduct · 9
- Microsoftvendor · 9
- OpenAIvendor · 8
- eMudhravendor · 7
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.