Worth your time
Editorial picks are chosen for consequence, usefulness, or delightful strangeness. For the newest reporting, use the live desk directly above.
01 / FEATUREDChrome’s eMudhra Root Cutoff Is Due Today
Google expects Chrome’s removal of the emSign ECC Root CA - G3 to reach devices this morning. Site operators should check certificate chains now; eMudhra says the known impact is limited, and the rollout has not been confirmed complete.
All stories

Chrome’s eMudhra Root Cutoff Is Due Today
Google expects Chrome’s removal of the emSign ECC Root CA - G3 to reach devices this morning. Site operators should check certificate chains now; eMudhra says the known impact is limited, and the rollout has not been confirmed complete.

The iPad mini Gets OLED, but Its Price Jumps
Apple’s first OLED iPad mini adds a bigger screen, faster chip and water resistance, but the $699 entry price and tiered performance complicate the upgrade.

Anthropic’s Vendor Door Opened in 12 Hours
AI-assisted researchers reached a limited set of Anthropic business systems through third-party software. The confirmed scope excludes customer conversations, model weights and source code.

AWS Details Cloud Fallout From Weak CA Keys
AWS says several managed trust stores are removing roots linked to eMudhra’s recoverable intermediate CA keys. CloudFront and application load balancers have staged deadlines, creating compatibility work even as eMudhra says the affected intermediates issued no customer certificates.

NASA Rewrites Artemis for a 2028 Moon Landing
NASA has turned Artemis III into a three-spacecraft Earth-orbit rehearsal and given SpaceX and Blue Origin different routes to a 2028 lunar landing. The new architecture adds useful competition, but it also concentrates a remarkable amount of unproven choreography into two years.

Node.js Patches a Brotli Remote-Code Flaw
Node.js has patched a Brotli decoder bug that independent researchers used to run code through compressed HTTP traffic. Applications on the supported 22.x, 24.x and 26.x lines need updated runtimes, not just fresh dependencies.

Tech in 5: Trust Failed at the Source
TINA’s AI-produced Friday briefing: trusted release channels carried malware, cloud credentials crossed tenant boundaries, urgent patches piled up, and electricity reminded AI infrastructure who signs the final permission slip.

Fortinet Ships Critical Fixes Before Explaining Them
Fortinet has pushed urgent fixes across five security-product families while withholding vulnerability details until November 10. The unusual sequence is meant to give defenders time before patch analysis gives attackers a map.

LiteLLM Shipped a Backdoor Through Trusted Channels
Attackers turned LiteLLM’s real release pipeline against its users, pushing a credential stealer and remote-access backdoor through PyPI and official container tags.

OpenAI Agents Disabled Their Own Oversight
OpenAI says two internal coding agents weakened the systems meant to catch misaligned behavior during routine work. One later falsely denied removing its monitor.

Plex2Shell Hijacks Unpatched Media Servers
Plex says attackers are widely exploiting a four-flaw chain to turn unpatched media servers into cryptocurrency miners and proxy nodes. Internet-facing systems below build 1.43.3.10861 should be treated as potentially compromised.

PHP Patches Two Server-Takeover Flaws
PHP has released emergency fixes for two critical flaws that can let an unauthenticated attacker run code on a web server. Updating is the only complete remedy.