SANS Stormcast Wednesday, October 28th, 2026: eMudhra CA Revocation for Windows, macOS, Linux; PHP RCE Exploited on Palo Alto PAN-OS; Microsoft Authenticator Android Token Leak; GoAhead TLS Bugs

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10154.mp3

previous

eMudhra CA Revocation for Windows, macOS, Linux; PHP RCE Exploited on Palo Alto PAN-OS; Microsoft Authenticator Android Token Leak; GoAhead TLS Bugs

00:00

iTunes

MP3 Download

RSS Feed

Google

Podbean

Amazon Echo

YouTube

Spreaker

Spotify

Discussion

Login here to join the discussion.

Podcast Transcript

 Hello and welcome to the Wednesday October 28, 2026
 edition of the SANS Internet Storm Center's Stormcast. My
 name is Johannes Ullrich, recording today from Denver,
 Colorado. Today's episode is brought to you by the SANS.edu
 Undergraduate Certificate Program in Applied Cyber
 Security. Well, first story today is an update on the
 eMudhra situation. This is the certificate with the
 famous private key of four. Actually, a couple different
 signing certificates that had very weak private keys. There
 is some progress in getting these keys or certificates
 revoked throughout some of the different ecosystems.
 Microsoft yesterday released an out-of-band patch for
 Windows 10 and 11. So definitely apply those. Also,
 some continuing progress here from macOS. macOS has already
 released an update for its operating system. In macOS,
 things are a little bit more complicated. Now, the patch
 that macOS released does actually fix any issues with
 Safari and most web browsers on macOS. Also, with their
 mail client and such. Basically, anything that uses
 sort of the normal macOS networking stack. However, a
 lot of command line utilities may still be vulnerable because
 the certificate is still listed in /etc/ssl/cert.pem.
 The Apple notice does give you some hints as to how to update
 this. If you're running Homebrew, then there's also
 possibly a separate certificate stack. And the
 last applies, I think, to all operating systems. If you're
 using Python scripts, usually you have the certifi library
 that you're loading. Well, you have to update that for each
 project individually in order to make sure that you have an
 up-to-date certificate authority file that only lists
 still trusted certificate authorities with the eMudhra
 certificate revoked. Now, you may wonder, well, why should I
 care? Because apparently, eMudhra only issued something
 like a hundred certificates. Well, the problem is with the
 private key now being known, anybody can issue a
 certificate that appears to be signed using the, well, still
 somewhat trusted certificate authority. And as a result,
 their certificate would be as valid as any other certificate
 signed by a trusted certificate authority. So
 definitely make sure that you get this updated throughout
 your systems. Linux is a little bit sort of like macOS
 in that it tends to have multiple different certificate
 authority files. Typically, there's sort of one big
 central one that's most of the time used, but also watch out
 for the sort of individual certificate authority files.
 And then, well, regarding the PHP vulnerabilities, we now
 have confirmed compromises of Palo Alto devices. Palo Alto
 has set the exploit maturity to attack, confirming that
 successful attacks have been detected as of today. Palo
 Alto devices have sort of been mentioned as one of the low
 hanging fruit here, because in particular, if you're running
 one of their appliances, they apparently don't always
 support address space layout randomization. So as a result,
 exploitation becomes a lot simpler for these devices. So
 definitely do apply the patch quickly. As we all know, these
 kind of border security devices are always at the top
 of the list of ransomware gangs to exploit. And this is
 just another way how they can potentially access them. Also,
 the Palo Alto advisory, well, read it and look for any other
 advice and mitigating configurations and such that
 you may want to apply. Well, in case you're using
 Microsoft's Authenticator application on Android, make
 sure you're running this version. There's an
 interesting write up by Enclave.ai how the application
 did allow any other application running on the
 same Android device to obtain authentication tokens, which
 of course sort of breaks one of the security assumptions
 when you're dealing with a second factor like a mobile
 device, where it's assumed that only the user can
 actually, while interacting with the device, get a token
 from the authenticator. This has been fixed and again, more
 details in the blog post by Ofek Levin from Enclave.ai. A
 couple of researchers from FoxIO have discovered a number of
 vulnerabilities in the GoAhead web server. If you're not
 familiar with GoAhead, it's one of those embedded web
 servers often found in IoT devices. The vulnerabilities
 center around TLS and how certificates and such are
 being validated, where, for example, one of the
 vulnerabilities is that certificate revocation lists
 are loaded but ignored, and a couple other sort of similar
 issues. This is probably one of those things you can't do
 much about but wait for a vendor to actually update your
 device. Well, and that's it for today. Thanks for
 listening. Thanks for liking this podcast. I'm also up for
 the SANS Difference Maker Lifetime Award this year. I'll
 add a link to the voting page in the show notes. Would, of
 course, appreciate your vote. Thanks and talk to you again
 tomorrow. Bye.