Eclecta

The frontier, distilled We read the firehose, so you read what matters.
Monday, November 2, 2026 No. 65 · Daily Brief
Archive
Daily Brief 2026-10-22 Thursday, October 22, 2026

Thursday, October 22, 2026

eMudhra's intermediate CA keys can be derived from the public certs, PHP pre-announces two critical patches, and DeepSeek open-sources its production inference engine.

A trusted CA whose private keys fall out of its public certificates

Private keys for eight eMudhra intermediate CA certificates can be recovered directly from the public certificates, the result of broken key generation present since the certs were created in April 2025, per a disclosure page published by Dennis Jackson. The intermediates chain to roots in the Mozilla, Microsoft, Apple, and Chrome programs, so anyone who derives a single key can impersonate any website that trusts those roots. A researcher identified as “Wayne” demonstrated control by signing a message with each private key; the page ships the certs and SHA-384 signatures for verification with openssl dgst.

No Certificate Transparency entries exist for the certs, so CT-enforcing browsers (Firefox, Chrome, Edge, Safari) could not have been attacked through them; exposure of non-CT clients is described as unknown, not ruled out. Browsers revoked the intermediates between October 17 and 20 via OneCRL, CRLite, and CRLSets, and eMudhra revoked them. Clients that skip revocation checks stay exposed until packages update: patched builds include Go 1.27.3/1.26.10, Python certifi 2026.10.19, rustls-webpki 0.103.16, and the curl CA bundle dated 2026-10-20, with Node.js, Bun, and FreeBSD still pending. macOS blocks the intermediates system-wide, but the built-in /usr/bin/curl verifies against an unpatched /etc/ssl/cert.pem and keeps trusting the roots.

PHP pre-announces two critical patches, LiteLLM poisoned on PyPI

PHP maintainers told all users to prepare update windows for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each self-scored CVSS 9.2, with patches scheduled for October 21 at 14:00 UTC and the right to ship earlier if details leak or exploitation appears. No technical details accompany the heads-up. Ars Technica reports that a leaked, unverified exploit tool called PHP2Shell runs code against WordPress, Drupal, Magento, Laravel, and more, and that security firm watchTowr says it confirmed both bugs and claims they reach back to PHP 5 from 2004. Ars could not locate the original report, so the version range is a claim.

Separately, safedep.io reports that LiteLLM 1.107.0 was published to PyPI carrying a credential stealer and a backdoor. LiteLLM brokers requests to model providers and holds their API keys, so the payload targets the secrets it manages. The compromise vector, exposure window, and which versions are clean are not established in the material available. Anyone who installed that version should rotate every credential the process could reach.

Agents on both sides of the vulnerability pipeline

OpenAI published “Patch the Planet,” arguing that AI agents now find critical vulnerabilities fast enough that coordinated global disclosure, not discovery, becomes the bottleneck. The volume, severity, and false-positive figures behind the “at scale” framing are not given; the proposal is OpenAI’s position on both the threat and the remedy.

The offensive case arrived the same day. The Verge reports that security firm Norforge found a single operator using the open-source agent platform Cairn to breach more than 100 sites across four countries, with instructions Reuters puts at under 100 Chinese characters and breaches taking about 23 hours each. Victim names (John Deere, SharkNinja, Cummins) come from Reuters, not Norforge; the companies say impact was limited or contained. Counts and methodology are second-hand.

Infra: DeepSeek open-sources its serving engine, TypeScript gets a Rust port

DeepSeek released DeepInfer, the Apache-2.0 inference framework it describes as the engine behind its production serving, for DeepSeek-V4.1-Flash on NVIDIA SM100 GPUs and Huawei Ascend 950 NPUs. It ships custom kernels, MoE expert parallelism with load balancing, DSpark speculative decoding, and NVIDIA-only batch-invariant inference that reproduces identical outputs for identical inputs across batch compositions. Benchmarks are self-reported, and the release omits the KV cache system and prefill/decode disaggregation, so it is not a full stack.

Cloudflare and VoidZero announced tsrs, a Rust port of the TypeScript compiler built with the TypeScript team and incubated in the Oxc toolchain. Cloudflare says it is not a fork and that the TS team keeps control of language design; self-reported numbers claim up to 8x faster type-checking at about 70% less memory than TypeScript 7.0, with no methodology disclosed. Rust was chosen over Go to run a full toolchain in WebAssembly without dragging in a garbage collector.

What to watch today

  • PHP patches for CVE-2026-109618 and CVE-2026-109619 land October 21 at 14:00 UTC, or earlier if details leak; affected versions become clear only at release.
  • Node.js, Bun, and FreeBSD ca_root_nss updates distrusting the eMudhra intermediates are still pending.
  • Whether PyPI has pulled LiteLLM 1.107.0 and which adjacent versions are confirmed clean.
  • Mozilla’s Interop 2027 ranking vote closes, setting which browser features get a cross-vendor push next year.