Data & infrastructure
-
French cyber authority identifies further Stormshield firewall and management vulnerabilities
France’s CERT-FR has issued another Stormshield security advisory, this time covering firewall and central management vulnerabilities associated with code execution, SQL injection, security bypass and service disruption.
-
eMudhra identifies weak certificate keys as browsers tighten trust protections
eMudhra says a flawed key generation process produced weak private keys for eight intermediate certificate authorities, prompting emergency browser protections and changes to certificate trust stores.
-
CERT-FR finds simple attack techniques behind nearly 200 web application data breaches
France’s national cyber incident response service followed nearly 200 web application data breaches in 2025, finding that many involved relatively simple attacker actions rather than exploitation of software vulnerabilities.
-
Cloudflare Zero Trust outage interrupts identity policy decisions
Cloudflare restored its Zero Trust connectivity after a 20 October fault affected Gateway traffic governed by identity conditions. Edge services recovered before its Access API; the company has not established a public root cause.
-
Go security releases restrict trust in selected certificate intermediates
Go has released versions 1.27.3 and 1.26.10, restricting certificate validation through selected intermediates. Maintainers cite security concerns but have not publicly named the authority, identified an affected organisation or established an exploitation event.
-
Google Cloud London outage disrupts UK banks as regulators seek answers
A power event in Google Cloud’s London region interrupted UK banking and public services on 20 October. The provider reported a nearly eight-hour incident, while MPs sought details of regulatory oversight of critical cloud suppliers.
-
Zeabur details credential failures and database access in October breach
Zeabur says attackers accessed its production database, stored environment variables and 101 Google Cloud dedicated servers. Its October investigation distinguishes confirmed access from uncertain database extraction and an unproven link to an earlier intrusion.
-
OVHcloud CLI downloads replaced with credential-stealing binaries
OVHcloud has confirmed that attackers replaced downloadable binaries for five versions of its command-line utility. The French provider removed the affected files and issued version 0.16.0, while customers assess possible exposure of local credentials.
-
PHP warns of two critical flaws ahead of 21 October security release
PHP has warned of two critical vulnerabilities rated CVSS v4.0 9.2 and scheduled security fixes for 21 October at 14:00 UTC. The advance notice does not establish technical exploit conditions, affected builds or active exploitation.
-
Hosting compromise exposes VMmanager control panels
A hosting provider has disclosed the compromise of VMmanager 6 infrastructure, warning that attackers accessed control-panel information and may have reached customer server environments at other providers.