Today’s vibe: “trust anchors are squishy.” When a CA chain breaks, or a signed installer loads the wrong DLL, the security model collapses into “hope your updates ran.”

Today's Top 5

1. 8 CA keys compromised: Eight eMudhra intermediate CA private keys were recoverable, triggering emergency blocks and revocations across ecosystems. The scary part is who still trusts the old chain. Source
2. NEC vendor access, files encrypted: NEC says a contractor was hit in late September, stolen legit credentials were abused, and customer environments saw unauthorized access and file encryption. The leak path included shared cloud storage. Source
3. Siemens signed app, malicious DLL: Siemens validated active exploitation of a DLL side-loading flaw in Siemens Software Center. Attackers reportedly bundle a genuine signed binary with their own DLLs, then let Windows do the rest. Source
4. FortiSIEM gRPC PoC is public: A public proof-of-concept dropped for a FortiSIEM gRPC path traversal issue that can be driven to code execution. If you expose it, you are about to meet someone new. Source
5. PHP “critical” release incoming: CERT-EU flags an upcoming PHP security release for two critical issues with limited technical detail so far. This is the part where attackers usually know more than defenders. Source

Why today matters: Three different trust layers failed in three different ways: certificate authority keys, vendor-admin access paths, and signed software loading behavior. The pattern is attackers leaning into “things you assumed were safe by design” to skip noisy initial access. If you run mature patching but weak update verification, vendor access governance, or certificate hygiene, you should be nervous.

XERJ Corpus Hub: Working the FortiSIEM CVE-2026-106173 PoC problem? An AI agent loading vuln-fix-commits can quickly find comparable historical fixes for gRPC path traversal and file-write chains, then draft a code-review checklist for similar bug patterns in your own services. Explore more at hub.xerj.org.

Alright, let’s get into the damage reports and the sharp edges.

Data Breaches

1. NEC apologizes for contractor cyberattack impacting customers: NEC says a system development and maintenance contractor was attacked in late September, stolen legitimate account credentials were abused for unauthorized access into customer environments, and some files were encrypted. NEC also confirmed leakage from cloud storage used for information sharing that included personal and system-related information. Source: NEC
2. Mimori ransomware group lists OpenText: Leak-site monitoring sources report OpenText appeared on Mimori’s victim listings on October 20, 2026. Treat this as an unverified extortion claim until OpenText or regulators confirm. Source: RansomPosts
3. Dark Project leak-site claim against Beach Eye Medical Group: Leak-site monitoring lists Beach Eye Medical Group with a claim of >200 GB stolen. No public confirmation was found in primary disclosures in the last 48 hours, so keep this in the “watch” bucket. Source: Ransomnews
4. Lockbit5 claims Ultimate Health Plans data exfiltration: A ransomware intel post reports Lockbit5 listed Ultimate Health Plans and warns of possible publication of patient and org data. Again, this is a claim pending victim confirmation. Source: QPulse

Security Research

1. Chrome and Android protections after eMudhra intermediate CA key compromise: Google says the Chrome Root Program received a report on October 17, 2026 about compromise of private keys tied to eight eMudhra subordinate CA certs, and details Chrome protections and blocking actions. This is a supply chain incident for trust stores, not just browsers. Source: Google
2. Cloudflare breakdown of the eMudhra CA incident: Cloudflare describes how it became aware of the compromise and what it means for revocation and trust-store agility. The operational lesson is “revocation only works if your fleet actually consumes it.” Source: Cloudflare
3. Siemens confirms active exploitation of CVE-2026-110936: Siemens ProductCERT says CVE-2026-110936 is under active exploitation and describes the DLL side-loading risk in Siemens Software Center. Watch for signed-binary plus malicious sidecar DLL tradecraft in your EDR telemetry. Source: Siemens
4. Horizon3 deep-dive and PoC context for FortiSIEM CVE-2026-106173: Horizon3 published a technical deep-dive into the FortiSIEM gRPC path traversal and file-write chain that can lead to RCE, plus guidance that helps defenders reproduce and validate exposure safely. Source: Horizon3
5. CERT-EU warning on upcoming critical PHP fixes: CERT-EU reports the PHP Foundation is preparing a security release for two critical PHP issues, with limited detail available so far. This is the window when exploit dev often races patch deployment. Source: CERT-EU
6. Oracle October 2026 CPU is huge, and EBS is heavy in it: Tenable’s roundup highlights Oracle’s October 20, 2026 CPU scale and where the patch volume landed, useful for prioritization if you run broad Oracle estates. Source: Tenable

Top CVEs

1. CVE-2026-110936: Siemens Software Center DLL side-loading that Siemens says is actively exploited. If users install or run bundled copies, malicious DLLs placed in searched directories can execute with the app’s privileges. Source
2. CVE-2026-106173: Fortinet FortiSIEM gRPC path traversal leading to file write and potential RCE chains, with public research and PoC context. Treat Internet-exposed FortiSIEM like an emergency until proven otherwise. Source
3. CVE-2026-101767: Oracle E-Business Suite issue called out in current coverage as an unauthenticated SQL injection risk (with practical exploitation discussion circulating alongside the October 2026 CPU). If you run EBS, validate exposure and patch fast. Source
4. CVE-2026-109618: One of two critical PHP vulnerabilities flagged ahead of an upcoming security release, with limited public technical detail at time of writing. Pre-stage change windows and update plans now. Source
5. CVE-2026-109619: The second critical PHP vulnerability flagged in the same upcoming release guidance. Your real risk is whatever is exposed to the Internet and forgotten. Source

Podcasts & Talks

1. Darknet Diaries, EP 181: “Ricky”: This one is a practical reminder that “account takeover” is often a physical-world story first and a technical story second. Worth it for security leaders who need better narratives for exec buy-in on identity hardening. Listen: Darknet Diaries
2. SANS Stormcast (Oct 21, 2026): Covers the eMudhra intermediate revocations, the critical PHP release, Oracle EBS SQLi (CVE-2026-101767), and the FortiSIEM PoC. It’s a clean “what should I care about this morning” briefing. Listen: SANS ISC

Final Words

Most coverage treats today’s stories as separate: a CA mishap, a vendor incident, a Siemens vulnerability, a Fortinet PoC. They’re the same problem. Our security assumptions still lean on brittle trust shortcuts, and attackers keep choosing the quiet path that looks “legitimate” in logs until it is too late.

This week, do three things:

• Audit your trust-store update paths (servers, containers, endpoints, embedded) for the eMudhra revocations, and verify by sampling real hosts, not by assuming patch tools ran.
• Patch or isolate Siemens Software Center where applicable and hunt for DLL side-loading patterns tied to CVE-2026-110936, especially “signed installer plus sidecar DLL” executions.
• Inventory FortiSIEM exposure, block Internet access to the gRPC service, and prioritize remediation for CVE-2026-106173 before the PoC turns into commodity scanning.

Your turn: If a compromised intermediate CA could mint a cert for your VPN, SaaS SSO, or internal portal, do you know which systems would still accept it a week later? Hit reply with your one-sentence answer, or drop a comment on the web version. I read every reply.

Know someone who still has “certificate updates” filed under “later”? Forward them this issue, because the eMudhra mess punishes procrastination. For everyone else, subscribe free at secretciso.org.

Stay vigilant, stay informed, and see you in the next edition of Secret CISO!