Cybersecurity News Briefing: October 22, 2026
Thursday, October 22, 2026 · 13 stories
Today’s briefing highlights critical flaws in Signal’s RingRTC library, weak private keys in eMudhra certificates, a supply‑chain compromise of LiteLLM, and a Plex Media Server SSRF being exploited in the wild. Additional topics include cloud‑storage visibility gaps revealed by a TiDB breach, a European Commission DSA probe of Booking.com, and observed attempts against PHP2Shell. Readers should prioritize applying all available patches and verifying package integrity, especially for Signal, Plex and LiteLLM.
Top Stories
- CriticalVulnerabilityEuropeThe Register
Signal RingRTC Library Vulnerability May Leave Microphone and Camera Active After Call Ends
A critical flaw in Signal’s open-source RingRTC calling library, assigned CVE-2026-113380 with a CVSS score of 9.3, can prevent call termination, potentially leaving audio and video streams active. The issue affects all versions prior to 2.72.0 and was disclosed after a proof-of-concept demonstrated the denial-of-service on the library’s event queue.
Why it matters: Update Signal to version 2.72.0 or later to ensure calls end properly and prevent unintended recording.
- CriticalVulnerabilityEuropeHelp Net Security
eMudhra Intermediate Certificates Found With Weak Private Keys Allowing Immediate Recovery
A security researcher discovered that eight intermediate certificates issued by eMudhra were protected by private keys weak enough to be recovered from the public certificates in under a second, effectively exposing trusted CA signing keys. The flaw was identified during a check of the Common CA Database.
Why it matters: Re-issue affected certificates and audit CA key strengths to protect the trust chain.
- HighVulnerabilityEuropeThe Register
eMudhra Explains Use of Weak Private Keys in Digital Certificates After Industry Criticism
Indian certification authority eMudhra responded to criticism that some of its issued certificates were signed with weak private keys, including a key consisting of the number “4” and other short numeric strings. The company attributed the issue to a flaw in its key generation ceremony that produced a secondary set of weak keys, which were inadvertently published to browser root stores.
Why it matters: Verify certificate authority key strength and monitor for weak-key incidents to prevent forgery.
- HighData BreachGlobalDark Reading
TiDB Breach Highlights Risks of Unverified Cloud Data Storage Practices
A breach of the TiDB service revealed that cloud providers may store sensitive customer data without clear visibility, leading to exposure when the provider is compromised. The incident underscores gaps in cloud security assumptions between providers and customers, showing how data can be accessed without either party’s explicit awareness.
Why it matters: Verify where and how cloud providers store your data to ensure proper protection.
- HighMalwareEuropeThe Register
Supply Chain Attack Compromises LiteLLM Release, Steals Cloud Credentials and Deploys RAT
Attackers altered the LiteLLM 1.107.0 release on PyPI and Docker Hub, inserting code that exfiltrates cloud and AI credentials and installs a remote-access trojan. The malicious packages were quickly quarantined, but any system that installed the version may have had secrets stolen. The latest safe version is v1.106.2, and investigators advise checking for indicator files in /tmp.
Why it matters: Verify package integrity and revert to the safe LiteLLM version to prevent credential loss.
- HighPolicy & RegulationEuropeThe Register
European Commission Launches DSA Probe into Booking.com Over Fraudulent Listings and Data Protection
The European Commission opened a Digital Services Act investigation into Booking.com to assess whether the platform adequately prevents fraudulent listings, phishing and smishing, and protects consumer data. The probe covers a platform with more than 45 million EU users and follows Booking.com’s admission of a significant rise in travel-related scams over the prior 18 months.
Why it matters: Online marketplaces must implement robust fraud detection and transparent advertising to comply with DSA requirements.
- HighVulnerabilityGlobalThe Hacker News
CISA Adds Plex Media Server SSRF Flaw to Known Exploited Vulnerabilities Catalog
CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog, including a Plex Media Server server-side request forgery identified as CVE-2026-96652 with a CVSS score of 5.3. The entry indicates the flaw is being exploited in the wild. Operators of Plex Media Server should apply available patches promptly.
Why it matters: Patch the Plex SSRF vulnerability to stop attackers from leveraging it for network access.
- MediumThreat IntelligenceNorth AmericaThe Hacker News
Amazon Detects Exploit Attempt Against Newly Disclosed PHP2Shell Flaws on MadPot Honeypot
Amazon's Threat Intelligence team observed an attempt to exploit the newly disclosed PHP2Shell vulnerabilities on its MadPot honeypot service on October 17, 2026. The exploit originated from an IP address linked to a commercial anonymization network. The attempt was logged as the flaws began seeing broader exploitation in the wild.
Why it matters: Apply available patches to PHP installations promptly to mitigate active exploitation attempts.
- InformationalAI SecurityEuropeHelp Net Security
Delinea Launches Fastpath MCP Server to Feed Governance Data to AI Assistants
Delinea announced Fastpath MCP Server, a capability that connects access-governance data to AI assistants via the Model Context Protocol. The read-only integration lets finance, IT, audit and compliance teams ask natural-language questions and receive detailed answers on access risk, reviews and audit readiness, with remediation options provided instantly.
Why it matters: AI assistants can accelerate access-risk analysis while preserving data integrity through read-only access.
- InformationalPolicy & RegulationGlobalThe Record
Democratic Lawmakers Say Russia Aims to Undermine Party Ahead of Midterms, Not Direct Election Infrastructure
Democratic legislators stated that Russia is attempting to weaken the party before upcoming midterm elections, while noting that no nation is currently undertaking a technically complex operation to compromise election infrastructure or alter votes directly. The remarks highlight concerns about foreign influence tactics.
Why it matters: Awareness of foreign influence attempts helps shape defensive political and informational strategies.
- InformationalThreat IntelligenceGlobalSecurityWeek
Rapid7 Finds High-Severity Vulnerabilities Exploited Within Three Days as Ransomware Leads Q3
Rapid7’s third-quarter analysis reports that high-severity flaws are being exploited on average within three days, while ransomware remains the dominant threat vector and AI appears in a small share of incidents. The findings highlight rapid exploitation timelines for critical bugs across the observed period.
Why it matters: Accelerate patching cycles to mitigate quickly exploited high-severity vulnerabilities.
- InformationalAI SecurityEuropeThe Register
Nvidia Unveils OpenShell Reference Architecture to Secure Corporate AI Agents
Nvidia introduced the OpenShell Reference Architecture, built on its OpenShell secure runtime, to create, operate, observe and police AI agents on Nvidia hardware. The framework defines boundaries for agent actions, credential use and policy enforcement, though a few security issues remain listed on GitHub. Implementation requires Nvidia hardware platforms.
Why it matters: Deploying OpenShell can contain AI agents within defined policy limits, reducing the risk of rogue behavior.
- InformationalPolicy & RegulationGlobalSecurityWeek
U.S. DHS Orders Removal of DeepSeek AI Products from Government Systems, Prompting Chinese Defense
The U.S. Department of Homeland Security instructed agencies to eliminate DeepSeek AI products and any third-party solutions built with DeepSeek from their IT environments following a ban, while Chinese officials defended the company’s technology. The directive aims to remove the AI from government systems.
Why it matters: Audit and purge DeepSeek components to comply with the DHS directive and reduce supply-chain risk.