Good morning!

PHP puts two critical flaws on notice as browsers and Apple block eight certificates with compromised keys. One asks you to wait for the fix; the other shows what happens after the keys are gone.

Here are the 7 things you don't want to miss:

1. ⚠️ PHP schedules an out-of-cycle release for two flaws rated 9.2

PHP's security team gave advance notice Tuesday for an out-of-cycle release Wednesday at 14:00 UTC, fixing two vulnerabilities it rates 9.2 without describing them. A leaked Hacker News post claimed CVSS 10.0 and PHP 5 and up; watchTowr confirmed the leak's core claims, saying fixes will reach only supported branches. PHP's notice names no CVE IDs and no affected versions. No exploitation has been reported. I would trust the vendor's scoreboard, not the leak's. (PHP)

2. 🤝 Practice the Thing You Just Read About

Every item above is something you will eventually have to do, not just read about. Threat Road's Cyber Security Labs give you an isolated VM, a guided exercise, and a target that only exists for you to break — Linux fundamentals through hands-on exploitation, in your browser, on your own schedule. No shared infrastructure, no waiting for a lab window, no permission slip. (Threat Road)

3. 🔐 The keys behind eight eMudhra certificates were compromised

Mozilla's security blog said Tuesday that the private keys for eight eMudhra intermediate certificates were compromised. They were reported to Mozilla on October 17; Chrome, Firefox and Apple blocked the certificates within days, and Firefox shipped an emergency release on Tuesday. eMudhra blames a script error that produced keys with insufficient randomness; Mozilla says there is no evidence of abuse. (Mozilla)

4. 🛡️ SafePay ransomware has hit at least 600 victims, six agencies say

The FBI, CISA and US Secret Service, with Germany's Rhineland-Palatinate criminal police and two UK law-enforcement bodies, tied SafePay to at least 600 victims across the Americas, Europe and Australia since August 2024 in an advisory published Tuesday. Initial access comes from stolen credentials, brute force, VPN flaws and five known edge-device flaws; the group runs a leak site and telephones its victims. (CISA)

5. 🌐 333 Tor exit relays were hijacked to intercept SSH logins

A researcher who publishes as kaba said Tuesday that 333 of Tor's roughly 3,000 exit relays — about 10% — were hijacked in early October to intercept SSH connections and capture passwords from anyone who accepted the interceptor's host key. The Tor Project flagged and evicted the relays within days; the write-up appeared October 20. I would rotate any password that crossed Tor that week. (kaba.cx)

6. 📋 Why CISA gave federal agencies three days to patch SiteGuard

CISA added a command-injection flaw in EG Secure Solutions' SiteGuard Server Edition to its known-exploited catalog Tuesday, giving federal agencies until October 23 to patch and run forensic triage. Exploitation was reported Sunday; the catalog listing is what makes the deadline binding. (CISA)

7. ⚖️ Pakistan's cybercrime agency detained the alleged $126 million postage operator

Pakistan's cybercrime agency arrested Faheem Akram on Tuesday after weekslong raids — the man US prosecutors in Miami indicted last month for running LabelsBank.com. The alleged site sold more than 5.1 million counterfeit postage labels at $2 apiece to over 5,200 customers; the Postal Service estimates more than $126 million in alleged losses. It is unclear whether he will be extradited. (ABC News)

Bonus. Threat Road Tip Of The Day

PHP's release is scheduled for 14:00 UTC today. If you run PHP, snapshot a staging copy and rehearse the upgrade before it lands in production: emergency releases skip the usual bake time, and a broken app in production is a longer night than the same test in staging.

Disclosure: Topic #2 in this newsletter is a promotion for Threat Road's Cyber Security Labs. Nothing else in this issue is sponsored.