Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

astra

Nvidia Brev Security Breach: SSH Keys for Customer VMs Exposed

Nov 5, 2026 By Ephrim Holyson In Astra
Nvidia disclosed in early November that its Brev cloud development platform experienced a security incident with unauthorized activity spanning October 4 through October 20, 2026. Brev is the GPU-instance platform Nvidia acquired from Brev.dev in July 2024, used by developers to spin up on-demand cloud GPU compute for AI and ML workloads.
Read Post
Feroot

Lessons from the Polymarket breach: why the third-party code you trust is the biggest risk to your website and mobile app this holiday season

Nov 5, 2026 By Feroot In Feroot
Do you know what third-party code is running on your website and inside your mobile app right now? Feroot identifies malicious scripts and SDKs and blocks attacks like this one in real time, and has already blocked them for multiple clients. Get a complimentary Feroot scan of your web pages and mobile apps. Third-party code has become the easiest way to reach a company's customers. It runs in their browsers with the site's full trust, and almost nobody reviews it.
Read Post
jfrog

bREACHYing the Perimeter: How One HTTP Request can Hijack your AI Robot

Nov 3, 2026 By Yuval Moravchick In JFrog
Software supply chain attacks are on the rise, and naturally taking the headlines. But with the rise of localized models and common software embedded into smart “things”, risks may even be hidden in plain sight – or, in some cases, quite literally watching you. Vulnerabilities and malicious packages may extend risks to the unlikeliest of places, demanding change and accountability in even some well-intended innovations.
Read Post
How Layered Cybersecurity Stops Ransomware and Data Breaches in Mid-Sized Businesses

How Layered Cybersecurity Stops Ransomware and Data Breaches in Mid-Sized Businesses

Nov 2, 2026 By SecuritySenses In SecuritySenses
A layered cybersecurity strategy protects mid-sized businesses by building multiple overlapping defenses, ensuring that if hackers breach one layer, another stops them before data is stolen or encrypted. Single-point solutions fail against modern cyber extortion, leaving growing organizations severely vulnerable. Today, threat actors aggressively target smaller companies that lack enterprise-grade defenses. In fact, an alarming 88% of SMB breaches involve ransomware, making small businesses more than twice as likely to face an attack compared to large enterprises.
Read Post
cloudflare

4 real? Tracking exploitation and patching of eMudhra's weak keys

Oct 30, 2026 By Cryptography In Cloudflare
On October 19, 2026, we learned about eMudhra’s eight shockingly weak keys: where eMudhra was trusted to pick a 115-digit number for their virtual combination lock protecting the Internet, they picked the number 4. Not even four digits, just the number 4. The other seven keys were similarly weak: 56, 66, 115, 155, 156, 230 and 237. The next day, we wrote a blog post on the immediate action we took to mitigate this leak, and what customers needed to do on their end to stay secure.
Read Post
miniorange

eMudhra CA Key Exposure: How miniOrange PAM Enables Control

Oct 30, 2026 By Minal Purwar In miniOrange
The eMudhra CA key exposure involved eight intermediate certificates generated with weak private keys. Although the affected intermediates had not issued publicly trusted end-entity certificates, changes to certificate trust stores created a need to identify dependencies and plan certificate replacement across affected environments.
Read Post
cato networks

Cato CTRL Threat Brief: eMudhra Certificate Compromise Highlights the Value of Protection Delivered by an AI-Native SASE Platform

Oct 29, 2026 By Dr. Guy Waizel In Cato Networks
Eight eMudhra intermediate certificate authority (CA) private keys were compromised after being generated with insufficient randomness. Attackers could use these keys to forge certificates and impersonate legitimate websites or services to clients that still trust them. An attacker able to intercept a connection could potentially read or modify sensitive traffic.
Read Post
appsentinels

What the SBI Data Exposure Tells Indian Banks About DPDP Readiness

Oct 27, 2026 By AppSentinels In AppSentinels
India’s largest bank confirmed a data loss incident in a 21 October 2026 filing with the BSE and NSE. The alert came five days earlier, on 16 October, through SBI’s threat intelligence channels, which its filing names alongside the Defence Cyber Agency, and from CERT-In. Both flagged suspected customer data on the dark web.
Read Post
tanium

eMudhra CA Compromise: Find and Fix Your Exposure with Tanium

Oct 24, 2026 By Guardian Research Team In Tanium
On October 17, 2026, a researcher reported that eight intermediate certificate authorities (CAs) run by eMudhra have private keys that anyone can calculate from the public certificates. Six of the CAs are for TLS (website) certificates and two are for code signing. Sectigo cross-signed the same eight keys, so 16 certificates are affected in total With these keys, anyone can issue a certificate for any website, or sign software, and it chains to root CAs that many systems trust.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.