Operations | Monitoring | ITSM | DevOps | Cloud

CA distrust wargame: moving every certificate in 10 minutes

Last week, dozens of schools found out their certificate authority was being distrusted and they needed to replace all of their certificates in a few days. We wanted to know how we’d handle it if our own CA went away, and how long it would take. So we tried it with one of our other products. It has 6 certificates from Let’s Encrypt, deploying to 18 targets across Windows IIS, Linux nginx, Elasticsearch, and a mail server. Then we wargamed it: “Let’s Encrypt is being distrusted.

Announcing SOC 1, FedRAMP 20x Class A, PCI, and HIPAA Milestones At Harness

Explore Harness' latest compliance milestones: SOC 1, FedRAMP 20x Class A, PCI DSS, and HIPAA assessments across its platform and runtime security. Harness announced four compliance milestones: its first SOC 1 audit, FedRAMP 20x Class A certification, and first PCI DSS and HIPAA Security Rule assessments. SOC 1 and FedRAMP 20x Class A apply to the Harness Autonomous SDLC Platform. PCI DSS and HIPAA apply to the Runtime Protection Agent.

Resque 3.2 Closes a CSRF Gap in resque-web: What Changes When You Upgrade

Resque 3.2.0 shipped on October 16 with a single change, listed under Security: resque-web now rejects state-changing requests that come from another site. Until this release, resque-web had no cross-site request forgery (CSRF) protection at all. A page on any other site could submit a form to your dashboard and clear your failed jobs or delete a queue, as long as the browser it ran in could reach resque-web and was logged in to it. The fix is small and most teams can upgrade without touching anything.

Apache ActiveMQ CVE-2023-46604: DripDropper Exploit Explained

When a CVSS 10.0 vulnerability is published, the expectation is that affected software gets patched within days. When it involves an open-source broker that processes business-critical transactions in enterprise environments, the expectation is that the security teams responsible for those brokers treat it as an emergency. “The attacks exploit a maximum-severity security flaw in Apache.

Fixing distrusted InCommon certificates with ERR_CERT_AUTHORITY_INVALID

Starting Tuesday, October 27, a lot of university websites will open in Chrome to this. Chrome is distrusting a root certificate, emSign ECC Root CA - G3, after eMudhra generated CA keys as small as 4. Every InCommon certificate issued from eMudhra’s ECC chain since April chains to that root.

Let's Encrypt Is Shortening Certificate Lifetimes

Let's Encrypt is cutting its certificate lifetimes in half, from 90 days down to 45 days by 2028. If your team still has a calendar reminder that says "renew the certs," this is the nudge to finally retire it. The change isn't purely a Let's Encrypt decision. It's part of an industry-wide shift driven by the CA/Browser Forum, and every publicly trusted certificate authority is heading the same direction.

Agentic SOC Tools 2026 Buyer's Guide

As we write this in Q4 2026, the agentic SOC solution market consists of a very complex array of products. Solutions being sold as "agentic SOC" include standalone AI SOC analysts, agentic SOAR platforms, AI agents embedded in SIEM/XDR products, and managed SOC services using autonomous agents. This makes the buying landscape complex, to say the least. This guide covers the key factors to consider when evaluating agentic SOC tools and provides a concise overview of the leading solutions to help you narrow down your shortlist.

Business Process Outsourcing: A Practical Guide to Choosing What to Keep In-House

Business process outsourcing, commonly called BPO, involves using a third party to perform selected business activities. A useful starting point is understanding what BPO means in practice: the business delegates specific processes while remaining responsible for its priorities, customer promises, and final results.

Strengthening the Security of Qovery's Access to Your AWS Account

Qovery now sends your organization ID as the sts:ExternalId when it assumes the IAM role in your AWS account, and the role's trust policy only accepts it on behalf of your organization. Your role is already updated. If you manage it with the qovery-role-creation CloudFormation stack, update the stack to the latest template. Romain is a staff engineer at Qovery working on the control plane and AI integrations. He writes about distributed systems, incident response, and MCP-based tooling.

Introducing Ergo: explainable policies on OPA

When an auditor tests a control, they ask two questions about each change: was the control met, and what evidence shows how that result was reached? Most automated controls can answer the first. A Rego policy returns allow: true or allow: false, but says nothing about what it checked. Engineers can hand-write violation messages to explain a failure, but a passing check leaves no record at all. When an auditor asks how a change passed, someone has to reconstruct the answer.

How to Secure Your PHP Infrastructure and Remediate PHP2Shell with Puppet

The detailed flaw coined “php2shell” is inherent in the PHP language itself, with multiple versions of PHP affected that have been released on the last decade. Ryan Austin, a Calif researcher who helped uncover the issue told the BBC it was, “The most serious vulnerability I’ve ever found". Wiz wrote in a blog post about the detailed findings that would allow hackers to exploit the PHP2Shell issue and take control of an affected web server.

How to Patch PHP2Shell Across Every Server and Prove Each Fix to Auditors

When a critical flaw surfaces in the language behind a large share of your web applications, how quickly can your organization name every server that runs it? PHP2Shell puts that question in front of every IT leader who runs PHP. The answer decides how long the business stays exposed. Here's the short version. PHP2Shell covers two flaws in the PHP engine, and either one lets an attacker run code on a web server with no login at all.

How Upsun handled PHP2Shell: protection in place 22 hours before the patch

On 21 October 2026, the team behind PHP released an emergency fix for two critical security flaws. PHP is the programming language behind a large share of the web, including WordPress, Drupal and many online stores. Researchers at Wiz named the flaws PHP2Shell. An attacker could use them to take control of a website without ever logging in. Updating a website, its CMS, or its plugins doesn't help. The only real fix is (and was) a new version of PHP itself.

Security Just Hit Machine Speed

What if we could eliminate vulnerabilities before they become a problem? Neil Watkins from Burns & McDonnell explains how AI, automated security assessments, and Harness CI/CD capabilities could transform vulnerability management. From reducing attack surfaces to rapidly responding to critical zero-day vulnerabilities, the future of security is about moving faster without slowing down developers.

How to Stop Secrets Leaking From Your Deployment Platform, and How Qovery Stores Yours

Railway's disclosure of leaked customer environment variables is a reminder that deployment platforms hold the keys to everything. Here is how secrets leak from platforms, the practices that prevent it or limit the damage, and exactly how Qovery stores secrets across its control plane and your data plane, with AWS Secrets Manager, Parameter Store, GCP Secret Manager, Doppler and Infisical. Romaric founded Qovery to make Kubernetes accessible to every engineering team.

PHP2Shell: What the Critical PHP Vulnerabilities Mean for Your Servers

TL;DR On October 21, 2026, PHP released emergency patches for two critical flaws known together as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). An attacker with no credentials can use them to run code on a PHP web server, in some cases with a single HTTP request. Upgrade to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 now. Then go through your logs, because exploitation attempts were recorded before the patch shipped. In this post.

Internet2's certificate authority (eMudhra) is being distrusted

On Tuesday, October 27, Chrome will distrust an eMudhra root certificate, emSign ECC Root CA - G3. Mozilla already did. Most of the people who have to deal with it run IT at American universities. They get their certificates from InCommon, the certificate service Internet2 runs for higher education. The certificates say Internet2 on them, but since April, eMudhra, an Indian certificate authority, has issued them.

Dispatching Ansible playbooks with CFEngine

In large organizations and infrastructures, it’s fairly common to use multiple configuration management tools. There are many reasons for this. Different teams may have different preferences, some tools suit certain use cases better than others, and existing systems can come with their own limitations. Whatever the reason, the tools don’t have to work in isolation. In this post, we’ll show how to run Ansible playbooks on CFEngine-managed hosts using Mission Portal.

PHP2Shell: How to Find Vulnerable PHP Versions on Your Devices

Last updated: October 21, 2026. We'll update this article as PHP and Linux distributions publish new information. PHP2Shell is the nickname of two critical vulnerabilities in PHP that let an attacker run code on a web server without logging in. PHP released the fixes on October 21, 2026, and IT and security teams now need to know which of their servers and computers run a vulnerable PHP version, so they can patch those first.

CertKit now has 86 built-in deployment templates

There are lots of ways to get a certificate. Getting it onto your Cisco ISE, IBM i, or WatchGuard VPN is the hard part. We keep making that easier. Since July, CertKit has added 51 new deployment templates, more than doubling the library to 86. Each platform has a built-in deployment template, and most have a deployment guide for the setup details. Setup is just picking a certificate and setting a few variables.

Kosli joins the Plexal & Barclays Eagle Labs Scaleup Programme

Kosli has been selected for the fourth edition of the Scaleup Programme run by Plexal and Barclays Eagle Labs. Following a competitive application process, we’re one of 25 high-growth UK technology companies chosen to take part. The programme is built for companies where growth for scaleups starts to present new challenges, with particular focus on scaling commercial performance, customer expansion, funding, and capital planning.

Certificate Lifecycle Management: How to Track, Monitor And Renew Digital Certificates

Certificate Lifecycle Management (CLM) is the process of tracking every digital certificate an organization uses, from the moment it is requested to the day it is retired. IT, infrastructure and security teams look into Certificate Lifecycle Management when they need to stop certificates from expiring unnoticed, keep up with shorter certificate lifetimes and know who answers for each one.

How to Troubleshoot TLS Handshake and Encrypted Traffic Issues with Packet Analysis

I remember the good old days, when troubleshooting application traffic often meant I could examine much of the conversation between a client and server in clear text. Not anymore. Today, nearly everything is encrypted. That is obviously a good thing for security and privacy, but it has also created a common misconception that packet analysis is no longer useful because engineers cannot see the application headers and payload.

YouTube Let AI Prototypes Read Production. The Token Did the Work.

TL;DR: Google Cloud’s post of 22nd July 2026 on why AI apps fail in production describes how a YouTube team gets AI prototypes in front of user research in weeks instead of quarters: a prototyping stack that hands each prototype read-only access to live production data through a proxy, keeps its code out of the production binary, and throws the prototype away once the idea is proven.

Antivirus scanning with CFEngine and ClamAV

Is the antivirus on your servers working correctly right now? Installing ClamAV takes a single command. The hard part is keeping it running on all servers, since freshclam fails without indicating a problem, cron jobs disappear, and no one notices until an audit. The new ClamAV module deals with this by ensuring that ClamAV remains operational on all hosts and also indicates to you in the Mission Portal when it isn’t.

Unable to get local issuer certificate, explained

Your site loads in Chrome fine. Then a deploy script, a webhook, or integration calls the same URL and gets this: Python says certificate verify failed: unable to get local issuer certificate. Node says unable to get local issuer certificate, or unable to verify the first certificate. It’s all the same problem. It’s a misconfiguration between your certificate and a trusted root. Either the server isn’t sending it, or the client doesn’t have it.
Sponsored Post

Windows Hardening & Continuous Compliance: Keeping 200+ Security Settings Secure 24/7

Every Operating System – not even counting the software installed on top of it – has a myriad of configuration settings that affect security. Windows Server alone has 4000+ configurable options, out of which 200+ are important for security & compliance efforts. They include: These settings are at the very core of all of your security & compliance efforts – and they are surprisingly often ignored.

AI Agents Hacked 395 Organizations. How Do You Stop Them?

AI agents just changed the speed of cyberattacks. Are security teams ready? In a massive AI-orchestrated cyberattack, hundreds of autonomous AI agents exploited vulnerabilities in PaperCut software, compromising 440 servers across 395 organizations in 48 countries. But the bigger question isn't how these attacks happened. It's how human security teams are supposed to respond when attacks move faster than they can react.

When AI Attacks at Machine Speed, Configuration Management Becomes Cybersecurity

The Australian Medicare AI agent incident highlights a broader shift in cybersecurity. AI does not need to create new vulnerabilities to increase risk. Its ability to continuously discover, test, and pursue existing weaknesses places greater emphasis on maintaining secure configurations over time, not just fixing issues once. Security teams are used to the idea that determined attackers will keep looking for a way in.

CVE-2026-74580: Possible VM Escape via the Vghost Vulnerability

CVE-2026-74580 is a high-severity Linux kernel bug in vhost, the subsystem that accelerates I/O for virtual machines. It gives a local user a reliable path to root on the host, and in some VM setups it lets a guest write into host memory. The CVE record has existed since August 21, 2026, but the full technical write-up, nicknamed "Vghost", only went public on October 12. It came with working exploit demos for both a local root escalation and a VM escape.

Deployment alerts: know when a renewed certificate doesn't land

Renewing a certificate is the easy part. Getting it onto the server is where automation breaks. Somebody rotates the API token on the firewall. A service account password expires. A VM gets rebuilt and the agent never comes back. The certificate renews right on schedule, the deployment fails, and the server keeps serving the old certificate until it expires. Renewed and deployed are not the same thing.

Fixes available for CVE-2026-92392 and other curl vulnerabilities

On 7 October 2026, Daniel Stenberg published a blog post describing a plan to release a new version of curl on 14 October 2026 in order to address 22 known security vulnerabilities. These vulnerabilities have varying severities, with a single vulnerability assessed as high (CVE-2026-92392), while the others have a low or medium severity. The curl maintainer has coordinated with downstream vendors, including Ubuntu, under embargo and the vulnerabilities have been publicly disclosed on the planned date.

SAP Security Patch and Vulnerability Monitoring Guide

Avantra monitors SAP security patch status across entire landscapes, checking each newly published SAP HotNews note against every managed system and tracking which systems still need it. It covers the patch side of SAP vulnerability management, which is a different job from code-level vulnerability scanning.

RISE with SAP Shared Responsibility: Security Monitoring Guide

Avantra handles RISE with SAP security monitoring for the layer that stays with the customer under the RISE with SAP shared responsibility model. SAP operates the infrastructure, network, database, and operating system, while the customer still owns application configuration, users and authorizations, custom code, and requesting the SAP Security Notes that SAP doesn’t apply proactively.

What Is an Antidetect Browser and How Do Teams Use It in 2026?

Modern websites recognize visitors through far more than cookies. Screen resolution, installed fonts, time zone, GPU details, and dozens of other signals combine into a browser fingerprint that can identify a device with surprising accuracy. For operations, marketing, and QA teams who manage many accounts or test from many environments, that creates real friction.

TryHackMe Alternatives for Blue-Team Training

For IT operations teams moving into defensive security, TryHackMe is a common first stop. Its guided rooms run in the browser, and its SOC Simulator has analysts triage alerts and write case reports in scenarios that can run in Splunk, Elastic or Sentinel. As skills develop, training needs change. You might want longer investigations, a certification that fits a development plan, progress reporting across several analysts or labs that look like your own tooling.

The NSA said wildcard certificates are bad. Everyone uses them anyway.

In October 2021 the NSA published an advisory titled “Avoid Dangers of Wildcard TLS Certificates.” It reiterated what security consultants had been saying for years: don’t use wildcard certificates. Single-name certificates per host are safer. Five years later, we counted the certificates that are actually used. One in three domains has a wildcard on it. For.bank domains, where you need a security review just to register, it’s four in five. Operators aren’t careless.

How to Integrate NinjaOne with a SIEM

In this episode of NinjaOne01, Jeff Hunter, Field CTO at NinjaOne, walks through NinjaOne’s new SIEM Exporter App. The app is a dedicated place to set up and monitor the webhooks that send NinjaOne activity data to your third-party SIEM (Security Information & Event Management) system. Note: this is an early access feature, so contact your account manager to have it enabled for your account. What this video covers.

How Configuration Monitoring Helps Detect Zero-Day Activity

Last updated: October 9, 2026 A zero-day vulnerability may be unknown, but its effects often are not. Exploitation can leave behind observable changes: a new privileged account, an altered management setting, an unexpected file, a modified access rule, or configuration drift from an approved baseline. That makes zero-day configuration monitoring an important part of a defense-in-depth strategy.

SSL Handshake Guide Covering Each Step and the Fixes That Prevent Outages

Why would a website that passes every uptime check still show customers a security warning? In most cases, the server is running and the network is healthy. The failure happens earlier, during the brief exchange in which the browser and the server agree on how to communicate securely. That moment is the SSL handshake. If it goes wrong, users get an error page while your dashboards stay green. Maybe a certificate expired; maybe a routine change left both sides on different protocol versions.

7 Layers of Agent Security (1 in 6 repos has leaked credentials)

I scanned 10,705 public GitHub repos for leaked credentials. After removing obvious placeholders, 3,543 still had something that looked like a key, and 1,680 held almost 7,000 credentials in recognizable formats like Stripe keys. If you're new to coding with agents (or you've been a dev for decades), this is the setup I'd want you to have before you ship anything public.

How Modern Firewalls Help Businesses Strengthen Network Security

As business networks become more complex, the methods used to attack them are evolving as well. Organisations now need to protect cloud services, remote workers, connected devices, internal applications, and large volumes of data, often across multiple locations. Traditional perimeter security alone is no longer sufficient to address this environment.

Certificate monitoring with TLS, chain, and post-quantum readiness

Most customers start CertKit with SSL host monitoring. On day one, you point CertKit at the systems you already run and get every certificate and when it expires. You start with confidence that you have everything under control. Then, you automate, letting CertKit take over the certificates as they need to be renewed. Each renewal is the last time you ever have to worry about that certificate.

Deutsche Bank leads the way on secure adoption of AI enabled software delivery

As AI accelerates software development and expands its scale, Deutsche Bank is taking a leading role in ensuring the technology can be adopted safely, securely, and responsibly across regulated industries. As an investor, Deutsche Bank’s Corporate Venture Capital arm participated in Kosli’s Series A funding round, reinforcing the bank’s view that automated governance will be a key enabler of AI-assisted software delivery in regulated industries.

What's taking DNS-PERSIST-01 so long?

In February, Let’s Encrypt announced that DNS-PERSIST-01 was coming, “some time in Q2 2026.” It’s October, and it’s nowhere close to ready. We’ve been waiting for DNS-PERSIST-01 since January, along with every other ACME client and lots of organizations. DNS-PERSIST-01 promised to simplify domain validation and make automation easier, but we had to wait on Let’s Encrypt. Let’s Encrypt is waiting on a redesign, a standards body, and maybe one more vote.

9 Best AI Penetration Testing Companies for Enterprise Security Teams

Enterprise security teams know the value of penetration testing. The problem is the schedule. A large organization may run hundreds of web applications, thousands of API endpoints, mobile apps, AI features, and a sprawling external attack surface, and much of it changes every week. An annual or quarterly pentest examines a snapshot of that environment, produces a report weeks later, and leaves most of the year untested.

HIPAA Wasn't Written for AI Agents. It Applies to Them Anyway

In short, healthcare is adopting AI agents faster than almost any other industry. More than 85% of Epic’s customers already use Epic AI, Epic’s Agent Factory will let every health system build agents of its own from 2027, and 43% of health systems were piloting agentic AI at the start of this year.

A Simple First-Project Workflow for Trying Seedance 2.5

A first AI video project becomes difficult to evaluate when the idea includes several subjects, changing locations, camera moves, and a detailed story. If the output fails, a beginner may have no clear way to tell what went wrong. A small project gives each revision a useful purpose. Try Seedance 2.5 with one visible action and a simple ending. Treat the first output as a draft to inspect before editing.

NetScaler Console Indicators of Compromise Detection

On September 27, 2026, Citrix published a security bulletin covering eight new vulnerabilities in NetScaler ADC and NetScaler Gateway. Some of these vulnerabilities are critical and have already been exploited in the wild. Citrix released fixed NetScaler builds and recommends upgrading affected appliances as soon as possible. However, when a vulnerability is already being actively exploited, installing the update only solves part of the problem.