Last week brought us at least two broken embargoes: php2shell leaked onto Hacker News a day early, and a batch of Linux kernel bugs landed on the public kernel mailing list instead of the private security list. This week has been slightly less exciting overall, fortunately, but Akamai’s security team published a pointed essay titled “TLP Is Not a Suggestion”, and it’s hard to argue with the timing.

When a researcher finds a serious bug, the usual process is “coordinated disclosure”. The developers get time to build a fix, and downstream vendors get advance notice under embargo so patches and protections are ready the moment details go public. The Traffic Light Protocol (TLP) is the vocabulary everyone uses to say who may know what: TLP:RED for named recipients only, TLP:AMBER for an organization and its clients on a need-to-know basis, TLP:GREEN for a trusted community, and TLP:CLEAR for anyone. It has no legal teeth whatsoever. It’s not classified data in a legal sense. It works because everyone involved agrees to make it work.

Akamai’s complaint isn’t really about the original php2shell leak, but about what came after: vendors and researchers racing to confirm, reproduce, and publish first. According to Akamai, a researcher published a reconstruction of the bug before the patch existed, and exploitation attempts started before most admins knew there was anything to patch. They draw parallels to Heartbleed in 2014, where a handful of companies got early notice and then advertised that they were already safe while Linux distributions were caught flat-footed, and to Meltdown and Spectre in 2018, where a six-month embargo collapsed six days early.

In the rush to publish, it’s also become less clear what the actual severity of the bug is in the real world. It clearly exists, and is of concern, but groups are still struggling to prove a complete exploit path, with several challenges showing results but nothing definitive so far.

Their advice boils down to “protect first, publish second”: push the detection rules and virtual patches, tell your customers privately, and save the blog post for after the official advisory. With AI tooling shrinking the time between “details exist” and “working exploit” to hours, the cost of a broken embargo is going up, not down.

UEFI network boot bug in most servers

Speaking of broken embargoes, Ars Technica reports on CVE-2026-97631, a CVSS 9.5 code execution bug in TianoCore EDK II, the open source codebase which nearly every firmware vendor builds on. That includes AMI, Insyde, Phoenix, and Microsoft’s own Project Mu fork.

UEFI is the current iteration of what we knew as the PC BIOS: the firmware that runs before your operating system, initializes the hardware, and hands off to the bootloader. It’s also where Secure Boot starts its chain of trust, and where the TPM gets set up. Code running in UEFI runs before any of the operating system’s defenses exist, which makes it extremely attractive to attackers. The Preboot eXecution Environment (PXE) is the UEFI feature that lets a machine boot from an image downloaded over the network, which is common in data centers and labs with large numbers of identical machines.

The bug is a 16-year-old buffer overflow in how the PXE driver stores ICMP error messages: it copies incoming errors into a fixed 504-byte buffer without properly checking the length. An attacker who can send a packet to the machine while it’s network booting can overwrite adjacent memory and, if they know the specific firmware build, run code at the highest privilege level before Secure Boot ever gets a say. Buffer overflows are nothing new, in fact they’re one of the oldest bug classes turned into exploits, but most operating systems today offer protections to reduce the severity.

The pre-boot environment of UEFI has no such niceties, making the attack simple and completely effective. HD Moore told Ars it could be used to break disk encryption for an attacker with short-term network access, and that it will likely be a “forever” bug living on in out-of-support systems. If this sounds familiar, it’s because PixieFail found a similar family of PXE bugs in the same EDK II network code in 2024, and, as Ars notes, the fuzzing projects that followed missed this one.

The disclosure was supposed to wait until January, but AMI published a pull request with the fix last month, and once the researchers noticed, TianoCore had little choice but to publish an advisory. If your machines boot only from local disks, you’re not affected, and that covers most home and small office systems. If you do use network boot, check with your firmware vendor, and consider turning off PXE booting where you don’t need it. Fortunately, this one is largely irrelevant for home users unless your network somehow gives direct access from the Internet to a server pre-boot environment, but it’s got potential to be a real issue for server hardware.

Certificate authority fallout continues

Last week we covered the eMudhra intermediate certificates whose private keys turned out to be tiny integers. This week, eMudhra announced that it is exiting the global SSL/TLS certificate business entirely. The press release insists the company “handled the recent incident diligently”, that its infrastructure was never compromised, and that TLS was only about 1% of revenue anyhow, but that “the level of social media amplification around this incident has brought scrutiny that is out of proportion.” Having your keys guessable by anyone with a few minutes of free time will do that.

Meanwhile, GoDaddy has self-reported to Mozilla that it couldn’t meet the deadline to revoke 404,607 certificates that didn’t match its own published certificate policies. The rules browsers and CAs agree to, the CA/Browser Forum “Baseline Requirements”, say a CA must revoke a mis-issued certificate within five days. GoDaddy managed to revoke 170,566 by the deadline, and about 227,000 a day later.

Mass revocation is genuinely hard: every one of those certificates is installed on someone’s server, and revoking it before it’s replaced breaks their website. That’s exactly why the browser root programs care so much about CAs being able to do it on time. Short-lived certificates, the kind Let’s Encrypt has been pushing for years, make this a lot less painful because a bad certificate expires on its own in days instead of months. We’ll be living the revocation long-tail experience with eMudhra certificates for years with devices which don’t, or can’t, check revocation lists for the long-running CA certificates.

Tailscale wormability

Tailscale and headscale, its self-hosted, open source control server, have become extremely popular. This is especially so in the maker and homelab world, where they are used for building private networks between devices. Under the hood, Tailscale builds a mesh of WireGuard VPN tunnels between every device, with a central control server deciding who can talk to whom. It also offers “Tailscale SSH”, which replaces the normal SSH server on a device and authorizes logins based on which device is connecting, rather than passwords or keys.

Erica Windisch of Cyberdione Labs has published a report called Tailworm detailing a series of findings in Tailscale and headscale. The most serious is in Tailscale SSH, which runs as root: socket forwarding requests are handled with root privileges and are subject to race conditions, letting an ordinary user with SSH access to a device replace or connect to privileged sockets (like the Docker socket or the init system) and gain root. Combined with capturing the keys used to enroll new devices, Windisch reports that a single compromised device could spread automatically to every device the access policy allows, at under a second per hop, with no passwords or stolen keys required. She also found an experimental app connector feature that can be used to reach destinations the network policy never allowed, including cloud metadata services that hand out credentials. And to top it all off, Windisch discovered unauthenticated memory exhaustion attacks against internet-facing headscale servers.

Notably, the researchers didn’t follow coordinated disclosure, arguing that “infrastructure is vulnerable today” and that rapid awareness will speed up fixes. Whether you agree with that or not (see the first story this week), the mitigations are practical: use per-device access rules for SSH rather than broad tag or group rules, disable SSH forwarding where you can, and expire node keys on servers. Fortunately it doesn’t seem like the bug is vulnerable to the Internet at large. A compromised device inside your Tailscale network could reach other devices in your network, but it won’t melt the Internet, yet.

A One-Byte Typo in Embedded TLS

FoxIO is back with three TLS bugs in GoAhead, a small embedded web server that runs the management interface on an enormous number of devices: routers, printers, firewalls, and industrial controllers from vendors including Palo Alto Networks, D-Link, HP, Canon, Honeywell, Siemens, and Rockwell.

The most severe (CVE-2026-115881, CVSS 9.1) is that GoAhead’s OpenSSL integration loads the configured certificate revocation list, but never actually turns on revocation checking, so revoked client certificates keep working, but the most fun is in the Mbed TLS integration: a copy-and-paste error passes the size of the one-byte Diffie-Hellman generator as the size of the 256-byte prime modulus. The result is a “2048-bit” key exchange using a prime of 255, which leaves exactly eight possible shared secrets. An eavesdropper can simply try all eight. (Clients like OpenSSL reject the broken parameters, but more permissive embedded clients happily accept them.) A third bug (CVE-2026-115884) lets an overly long certificate chain bypass a depth check when built against older LibreSSL. Feels eerily similar to the eMudhra one-number password, and the timing is spooky.

It’s a good reminder of Apple’s infamous “goto fail” bug in 2014, where a single duplicated line silently skipped certificate verification. Crypto code fails quietly: the handshake completes and everything looks fine. GoAhead 6.1.1 fixes all three, but for the hundreds of millions of embedded devices running it, the fix depends on every vendor shipping a firmware update, and on owners installing it. Which will surely happen rapidly and effectively, right?

Volt Typhoon’s Chain of Routers

Kim Zetter reports on new research from Lumen’s Black Lotus Labs into how Volt Typhoon, the Chinese state hacking group that US officials say has been “pre-positioning” inside American critical infrastructure, actually gets in and out.

Attackers rarely connect to a target directly from their own systems. Instead, they bounce through chains of compromised devices, often called “ORB networks” (operational relay boxes), so the traffic appears to come from somewhere innocuous. The sudden burst of news about Residential Proxy Network tools in the Spring and early Summer of 2026 could have been related: proxy networks provide a way to appear inside a country, or state, or even specific city.

Volt Typhoon’s version, which the researchers named Silent Train, is unusually disciplined: each chain of compromised servers, home routers, and IoT devices is assembled and used for a single intrusion, then dismantled and wiped. All this often in under two minutes, suggesting automation. Devices outside the US are never the same models as devices inside the US, presumably so no single vendor’s telemetry can see the whole chain. Targets included government agencies, defense contractors, telecoms, emergency communications, satellite operators, and energy, water, and rail operators, clustered in Hawaii, California, and Texas.

The chains included more than 27 classes of devices, including TP-Link and Netgear consumer routers, with a new device type added about once a month. Most of these were compromised through known, already-patched vulnerabilities. If you’ve got an old router or IoT gadget that hasn’t seen a firmware update in years, it may well have spent some time as a train car. Update it, retire it, or upgrade it with OpenWRT or another modern embedded distribution.

Discover-Tech and Starlink

Last week we talked about Citizen Lab’s research showing the Israeli ad-tech company Discover-Tech used targeted ads to deliver Candiru spyware. Gizmodo reports that the same company appears to be the top bidder for ad impressions on Starlink connections in 105 countries.

Research from TrendAI found an entity it labeled SHADOW-EARTH-79 won about 12% of ads shown to Starlink users, compared to a 3% baseline elsewhere, and over 80% of Starlink ad wins in Argentina, the Philippines, and Japan. It was also the top bidder in Syria, Libya, Yemen, and South Sudan, markets where, as TrendAI put it, “the demand for legitimate Western advertising in sanctioned or active-conflict states is effectively zero.” Reuters later reported that SHADOW-EARTH-79 was TrendAI’s internal name for Discover-Tech. The company spent about $109,000 on bids over four months with no recorded conversions, which is not how a business that wants to sell things behaves.

Real-time ad bidding shares device and location details with every bidder, whether they win the auction or not. Users of satellite internet are exactly who someone would want to locate in places where it’s restricted or politically sensitive, and the ad market will happily tell you where they are. Ad blockers continue to look less like a convenience and more like a necessity.

Quad9 leaves France

Quad9, the free, privacy-focused DNS resolver run by a Swiss nonprofit, is withdrawing service from France on November 24th, after losing a court case brought by the sports broadcaster beIN.

A DNS resolver turns names like “hackaday.com” into IP addresses. Quad9 doesn’t host any content, but the court ordered it to block resolution of domains beIN says are pirating its broadcasts, for users in France. Quad9 says it can’t comply: it doesn’t track who its users are or where they are, and the only alternatives are blocking the domains for the entire world, applying French law globally, or trying to geolocate users by IP address. It tried geolocation in a similar case brought by Sony in Germany, and was fined for contempt when Sony’s lawyers simply used a VPN. (Quad9 eventually won that case, after several years and six figures of legal costs.) With about 20 similar cases pending in France, it decided to leave.

As the EFF points out, none of this removes a single infringing website from the Internet; it just takes a malware-blocking privacy service away from French users, who can switch to another resolver in about thirty seconds. Making infrastructure providers act as copyright enforcement is a tool that’s very easy to repurpose for blocking other things. A net loss for Internet-savvy users in France, but kudos to Quad9 for standing up for principles.

Crime Stoppers Tips Leaked

The CBC has analyzed data stolen from P3, the tip management platform used by Crime Stoppers programs internationally, and found more than 1.5 million Canadian tips from the past 25 years. More than half contained personal information, including addresses, phone numbers, license plates, and banking details for cash rewards. Over 4,300 tipsters identified themselves by name, and even tips flagged by staff as having exposed the tipster were stored unredacted.

The data was stolen in March by a hacktivist group that said it wanted to disprove the platform’s claims of being “anonymous” and “secure”. After the CBC’s report, Toronto Crime Stoppers paused its program and at least six Ontario police services suspended their partnerships. Toronto’s chair, Sean Sportun, told the CBC, “It clearly seems that you have more data than us, which is a little concerning,” saying the platform’s owner, Navigate360, never provided the text of the stolen tips despite months of requests.

The most fundamental problem here may be retention. A system that promises anonymity kept 25 years of tips, including closed cases, in one place. The safest data is data that you don’t have.

DHS Employee Directory Leaked

WIRED reports that Distributed Denial of Secrets has published records on more than 41,000 Department of Homeland Security employees and contractors, including ICE and CBP. DDoSecrets says the data came from DHS’s Okta login system; Okta told WIRED it has “no evidence our data or systems were compromised.”

Beyond names, emails, and phone numbers, the leak includes over 55,000 access permission groups, which map out which people have access to which internal systems, including groups referencing certified undercover operations, wiretap programs, phone forensics tools, and AI services. A security expert quoted by WIRED called it “an extraordinarily valuable intelligence resource for those seeking to penetrate DHS”. Following ShinyHunters’ claimed theft of personal data on nearly every FBI employee, it’s been a rough autumn for federal identity systems.

FEC filing system knocked offline

The US Federal Election Commission took its electronic filing system offline a week before the November 3rd elections, after what an FEC filing officer described in an email seen by Reuters as “a bad actor attempting to breach FEC systems.”

The FEC doesn’t run elections, so there’s no impact on voting, but the outage blocks the 24- and 48-hour spending reports that show how much super PACs and other groups are spending on specific races in the final days. With the midterms already the most expensive US election ever, that’s a meaningful blind spot, at exactly the moment it matters most.

AI-orchestrated Bank Attacks

Last week we covered an attacker using a swarm of AI agents to break into websites. This week, Straiker published an analysis of CARLIY0S, a system it says the long-running CyberCartel group used to attack more than 400 financial targets across Latin America. CARLIY0S was built on PentAGI, an open source automated penetration testing framework, and assigned different jobs to different commercial AI models, including Kimi, Grok, and Claude. Four Claude-based roles were set up to evaluate attack options, debate targets, and return a decision through a designated “arbiter”.

According to Straiker, the group got around model safety policies by framing requests as authorized red team work or capture-the-flag exercises, and even instructed the models to never output the group’s name to frustrate attribution. Straiker says it accessed the group’s stolen credential database, with thousands of records including API keys, database credentials, JWT signing keys, and backdoors. Anthropic has since revoked the credential the group used to reach Claude, and xAI is investigating.

The “it’s just a pentesting tool” defense is going to get a lot of use in the coming years. Automated offensive frameworks are genuinely useful for defenders, and unfortunately also genuinely useful for anyone else who can convince the model they’re a defender.

Bulletproof Hosting Seized

The DOJ has seized the domain of Virtualine, a “bulletproof” hosting provider. Bulletproof hosts sell servers and domains to criminals with the explicit promise of ignoring abuse complaints and law enforcement requests, and they’re the plumbing behind a lot of phishing, malware, and spam.

Virtualine wasn’t subtle about it. According to the DOJ, it advertised on cybercrime forums that customers could use it “for all illegal/black hat activities (including phishing, carding, email spam, port scanning and all others)”, offered an “additional protection plan” that would move a customer’s infrastructure to an unaffiliated shell company after a law enforcement request, and bragged that it “ignored more abuse than your last three therapists.” Despite a supposed ban on child abuse material, it continued hosting a site selling exactly that after repeated notices from law enforcement in multiple countries. Marketing copy is evidence, it turns out.