My Next Class

In this episode: updates on revoking the compromised eMudhra certificate authority certificates on Windows, macOS, Linux and Python, confirmed exploitation of the PHP vulnerabilities against Palo Alto Networks devices, a token leak in Microsoft Authenticator for Android, and TLS certificate validation flaws in the GoAhead embedded web server.

eMudhra Certificate Revocation Updates for Windows, macOS, Linux and Python
Microsoft released out-of-band updates for Windows 10 and 11 to distrust the compromised eMudhra intermediate certificate authority (CA) certificates, and Apple now blocks them in Safari, Mail and apps that use Apple's networking frameworks. Command-line tools that rely on /etc/ssl/cert.pem, Homebrew, Python's certifi package and Linux CA bundles may still trust them until updated. Because the private keys are known, anyone could issue certificates that appear valid.
https://support.microsoft.com/en-us/servicing/os/windows-11/2026/10/kb5134133-windows-11-24h2-25h2-26h2-update
https://support.microsoft.com/en-us/servicing/os/windows-10/2026/10/kb5134125-windows-10-21h2-22h2-update
https://support.apple.com/en-us/149555

PHP RCE Vulnerabilities Exploited on Palo Alto Networks PAN-OS (CVE-2026-109618, CVE-2026-109619)
Palo Alto Networks has confirmed active exploitation of the critical PHP remote code execution (RCE) flaws against PAN-OS management interfaces exposed to the internet. Some Palo Alto appliances apparently don't always support address space layout randomization (ASLR), which makes exploitation easier, so apply the hotfixes and the advisory's mitigations quickly.
https://security.paloaltonetworks.com/CVE-2026-109618

Microsoft Authenticator for Android Token Theft Flaw (CVE-2026-80097)
Ofek Levin of Enclave.ai found that any other app on the same Android device could obtain authentication tokens from Microsoft Authenticator, breaking a core assumption of using a phone as a second factor. Microsoft has fixed the flaw; versions before 6.2606.4246 are affected.
https://enclave.ai/blog/authmask-we-made-microsoft-authenticator-hand-over-tokens

GoAhead Embedded Web Server TLS Flaws (CVE-2026-115881, CVE-2026-115884)
Researchers from FoxIO found TLS certificate validation flaws in GoAhead, an embedded web server common in IoT devices, including one where certificate revocation lists (CRLs) are loaded but ignored. GoAhead 6.1.1 fixes the bugs, but most users will have to wait for their device vendor to ship an update.
https://foxio.io/blog/choose-your-backend-three-tls-bugs-in-goahead

My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

SANS Difference Maker Awards
Dr. Johannes Ullrich is up for the SANS Difference Maker Lifetime Award this year. Please vote:
https://www.sans.org/go/difference-makers-awards-2026

Login here to join the discussion.