The eMudhra compromise has exposed private keys that cannot be made safe through a software update. Chrome blocked the affected intermediates by SPKI hash within 100 minutes of receiving the report, followed by Mozilla's OneCRL block later that evening. Researchers recovered the private-key values from public certificates in under a second, making revocation and distrust necessary regardless of the speed of the browser response. Chrome says no TLS certificates chaining to the six affected TLS-issuing intermediates had been logged to Certificate Transparency before the block. The broader cleanup remains ongoing: Mozilla's NSS update removes the signing root, while Go releases now reject chains through all eight affected keys. The cause remains unexplained, despite reports that the keys were generated in FIPS 140-2 Level 3-rated Utimaco HSMs. Chrome is also reviewing eMudhra's remaining CA certificate.

The exploitation of CVE-2026-0257 has proved more consequential than Palo Alto Networks' initial assessment suggested. Although the PAN-OS GlobalProtect authentication bypass was patched in May with a medium severity rating, Rapid7 later reported exploitation dating to at least 17 May, and Unit 42 linked it to ransomware groups including Qilin and Inc. In one intrusion, attackers reached a vCenter appliance, disabled ESXi's execInstalledOnly control and extracted domain controller credentials offline from a virtual disk. Because this technique operates outside the guest operating system, in-guest EDR cannot directly observe the credential extraction. Unit 42 also found cases where GlobalProtect profile mappings had inadvertently exposed management interfaces on ports 4443 and 3879.

The OVHcloud CLI compromise involved replacing published release archives rather than introducing a new version. Between versions 0.11.0 and 0.15.0, the affected packages were available for up to 94 minutes on 19 October before being removed following a customer report. OVHcloud attributed the replacement to a hijacked contributor account and disabled GitHub release immutability, which had allowed published files to be altered without passing through CI/CD checks. Versions 0.10.0 and 0.16.0, source builds and Docker images were unaffected. OpenSourceMalware reports that the account may have been compromised for more than six months and links the activity to GlassWorm through a Solana wallet indicator, although it did not analyse the payload. OVHcloud says the malware retrieves secrets from disk.

Siemens disclosed CVE-2026-110936, a DLL sideloading vulnerability in Software Center caused by loading libraries from an uncontrolled search path. An authenticated local attacker could place a crafted DLL in a searched directory to execute arbitrary code with the application's privileges. The flaw affects all versions before V4.0.9.8, carries a CVSS v4.0 score of 8.4, and is being actively exploited.

Forescout researchers identified ROMULUS, a shared ClickFix delivery panel found on six IP addresses, which serves PowerShell staging scripts and trojanized MSI installers. One route delivers a Stardock-based DLL sideloading package previously reported by Huntress, while another downloads password-protected archives containing LegionLoader. The loader sits in an executable inflated to roughly 882 MB with padding, and it contacts its command server using RC4-encrypted, Base64-encoded messages.

Mozilla received a report that private keys for eight eMudhra intermediate certificates were compromised, allowing attackers to forge HTTPS certificates for any website. Researchers recovered keys from public certificates in under a second, including values as small as 4, 56 and 115. Mozilla blocked the certificates through OneCRL, Chrome used a CRLSet update, and eMudhra has revoked them.

Attackers hijacked a developer's GitHub account and modified OVHcloud CLI versions 0.11.0 to 0.15.0 to distribute information-stealing malware that retrieves secrets from disk. The compromised release appeared on 19 October and was blocked about 94 minutes later after a customer report. OVHcloud said disabled release immutability allowed the changes, and researchers linked the activity to the GlassWorm operation.

Attackers altered AOMEI Backupper's remote configuration files for a few minutes at a time, causing the application to download and run a bundled dropper through its own promotional popup. The dropper installed Radmin Server alongside an attacker-built DLL that loads an encrypted PocketPy implant. ManageEngine found no software vulnerability was exploited, while Google and Mandiant track the activity as UNC7017.

Unit 42 observed ransomware operators, including Qilin and Inc, exploiting CVE-2026-0257, a PAN-OS authentication bypass that lets attackers establish GlobalProtect VPN sessions without valid authorisation. After gaining access, attackers bypassed multi-factor authentication, used remote management tools for reconnaissance, and moved laterally through RDP and SMB. In one case they pivoted to a vCenter appliance, disabled ESXi security controls and dumped domain controller credentials from its virtual disk.