Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

certkit

Internet2's certificate authority (eMudhra) is being distrusted

Oct 22, 2026 By Todd H. Gardner In CertKit
On Tuesday, October 27, Chrome will distrust an eMudhra root certificate, emSign ECC Root CA - G3. Mozilla already did. Most of the people who have to deal with it run IT at American universities. They get their certificates from InCommon, the certificate service Internet2 runs for higher education. The certificates say Internet2 on them, but since April, eMudhra, an Indian certificate authority, has issued them.
Read Post
How to Keep a Game Server Safe From Crashes and Data Loss

How to Keep a Game Server Safe From Crashes and Data Loss

Oct 22, 2026 By SecuritySenses In SecuritySenses
Two years of building, gone in one afternoon. It happens to a group somewhere every week. Usually it starts small. A plugin updates badly. The power blinks during a save. Someone types a command they shouldn't. And the world file ends up half-written and unreadable. None of those things are rare. But almost all of them are survivable, if you set things up before they happen. Here's how.
Read Post
CloudCasa

Protecting sovereign AI with CloudCasa and SUSE AI Factory

Oct 21, 2026 By CloudCasa In CloudCasa
A production AI service accumulates data that your team needs to recover: documents, embeddings, vector indexes, application settings, and conversation history. Once a retrieval-augmented generation (RAG) pipeline connects a model to your organization’s information, those dependencies become part of the service you operate. SUSE and CloudCasa by Catalogic are working together to protect that state in SUSE AI Factory.
Read Post
mend

Compromised LiteLLM 1.107.0 on PyPI Ships a Credential Stealer and Code Loader

Oct 21, 2026 By Alina Podoba In Mend
On October 21, 2026, a malicious release of litellm, the Python library and proxy for calling LLM provider APIs, was published to PyPI as version 1.107.0. All seven compiled wheels carried three extra files that install straight into the root of site-packages: a.pth hook that runs a credential stealer every time Python starts, and a sitecustomize.py that starts a background loader built to fetch and run remote Python code every hour. The package has had more than 92 million downloads over the past month.
Read Post
mend

PHP2Shell: the fix is a runtime upgrade, not a code change

Oct 21, 2026 By Alina Podoba In Mend
On October 21, 2026, PHP released 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to close two critical remote code execution flaws in the PHP runtime. Both are rated CVSS v4.0 9.2. Together they go by the name “PHP2Shell.” The flaws sit in PHP itself, not in any application built on it. A secure codebase running on an affected PHP build is still exposed. That makes this an inventory problem first and a patching problem second.
Read Post
certkit

CertKit now has 86 built-in deployment templates

Oct 21, 2026 By Todd H. Gardner In CertKit
There are lots of ways to get a certificate. Getting it onto your Cisco ISE, IBM i, or WatchGuard VPN is the hard part. We keep making that easier. Since July, CertKit has added 51 new deployment templates, more than doubling the library to 86. Each platform has a built-in deployment template, and most have a deployment guide for the setup details. Setup is just picking a certificate and setting a few variables.
Read Post
How to Pick a Secure Minecraft Server Host

How to Pick a Secure Minecraft Server Host

Oct 20, 2026 By SecuritySenses In SecuritySenses
Most people pick a host on price and RAM. Security barely comes up, right up until somebody's world gets wiped. It happens more than you'd think. Weak panel logins, open ports, no backups, admin passwords that were never changed. None of that shows up on a sales page. Alright, so before you go picking a host, there are a few things worth checking. Some stuff looks great on the website but turns out pretty useless once you've actually paid. And yeah, there are a couple of things I'd stay away from completely.
Read Post
certkit

Unable to get local issuer certificate, explained

Oct 19, 2026 By Todd H. Gardner In CertKit
Your site loads in Chrome fine. Then a deploy script, a webhook, or integration calls the same URL and gets this: Python says certificate verify failed: unable to get local issuer certificate. Node says unable to get local issuer certificate, or unable to verify the first certificate. It’s all the same problem. It’s a misconfiguration between your certificate and a trusted root. Either the server isn’t sending it, or the client doesn’t have it.
Read Post
teleport

5 Lessons from Watching an AI Agent Swarm Self-Organize

Oct 19, 2026 By Ben Arent In Teleport
This summer, we launched Identity Security for AI. That post described an upcoming wave of attacks and security challenges unique to Large Language Models (LLMs) and agentic workflows. As the traditional MITRE ATT&CK framework reached its limits, Google DeepMind published TRAIT&R, a taxonomy of rogue AI tactics and routines closely modeled after MITRE ATT&CK.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.