Security incidents tagged TLS. Newest first.
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
INCIBE-CERT coordinated disclosure of seven vulnerabilities in TPC Software's MatchPoint sports-facility management platform (INCIBE-2026-841, posted 2026-11-05). Three are critical: CVE-2026-111489 (CVSS v4 9.9) — a static credential embedded in the mobile app that returns an 'autorizado' token granting unauthenticated API access; CVE-2026-111490 (CVSS v4 9.9) — IDOR via the actingasuser HTTP header letting attackers reach personal, banking, and financial data, private messages, physical-access QR codes, and perform account takeover / balance transfers; CVE-2026-111494 (CVSS v4 9.1) — Android TrustManager accepts any TLS certificate and the app allows cleartext HTTP. Also high: local SQLi in the FCM push handler (CVE-2026-111492) and unauthenticated Images.ashx profile-photo enumeration (CVE-2026-111493). Medium: plaintext credentials in SQLite/SharedPreferences (CVE-2026-111491) and embedded APK config/keys (CVE-2026-111495). Vendor has already deployed server fixes for CVE-2026-111490 and CVE-2026-111493; INCIBE says install the latest app version for the rest. Reported by Sergi García Tárraga. No known exploitation stated in the advisory.
TPC Software MatchPointSince Nov 5, 2026
On Oct 28 2026, CDN company bunny.net said one of its infrastructure providers reported unauthorized access involving third-party server management software. One bunny.net CDN node, in Armenia, ran on a server from that provider. bunny.net stopped routing traffic through it within 20 minutes, wiped it and removed it for good. Neither bunny.net nor the provider has found evidence the node was accessed, but bunny.net can't rule it out; if it was, cached CDN content, Pull Zone configurations and TLS certificates stored on that server could have been exposed. bunny.net revoked and reissued certificates for its own b-cdn.net and bunny.run domains and on Oct 31 finished reissuing all managed custom-domain certificates with new private keys and revoked the old ones. It says no account data was on the server and no internal systems were affected.
bunny.net CDNSince Oct 28, 2026
Node2Shell (CVE-2026-111497, also written Node 2 Shell) is a Brotli decoder out-of-bounds write in Node.js that can let an attacker run code when an app decompresses attacker-controlled Brotli data: Express 5 / body-parser 2.x request bodies sent with Content-Encoding: br, Brotli responses read by fetch(), or node:zlib on untrusted input. OpenAI Codex Security (Khai Tran and Sylvie Mayer) reported it; Node.js fixed it on Oct 21 2026 in 26.12.1, 24.22.1 and 22.23.4, alongside nine other CVEs (TLS hostname/IP bypasses, DNS NUL truncation) and a CA store refresh for the eMudhra incident. On Oct 22 Imperva Red Team, which coined the name Node2Shell, ran code on the official Node.js 24.22.0 image. NVD lists CVSS 4.0 9.2 (critical); Node.js rates it High. End-of-life lines (Node.js 20, 23, 25 and older) get no fix: upgrade to 26.12.1, 24.22.1 or 22.23.4. Bun is fixed in 1.4.4. On Oct 23 Aikido started calling the wider impact HTTP2Shell: the bug sits in Google Brotli itself, so other software that decodes Brotli needs its own update. Envoy published a critical advisory (GHSA-3wvj-j6qm-62mr) for deployments with a Brotli decompressor configured, fixed in 1.40.0, 1.39.3, 1.38.6 and 1.37.8, and Istio has the fix in 1.29.9, 1.30.6 and 1.31.2. On Oct 25 Microsoft shipped fixes for .NET (8.0.33, 9.0.22, 10.0.14, 11 RC3), Visual Studio 2019/2022/2026 and PowerShell 7.4/7.5/7.6. If you can't patch yet, disable Brotli decoding of untrusted data, and restart services or rebuild images after patching. On Oct 26 PHP shipped Windows builds 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 with Brotli 1.2.1, since the bundled decoder is reachable through cURL when automatic response decompression is on.
Node.jsSince Oct 21, 2026
Eight eMudhra Global TLS intermediate CA private keys were found to be cryptographically weak / recoverable (researcher report Oct 18). Mozilla, Chrome, Apple and Microsoft blocked the intermediates; eMudhra revoked them Oct 19 and the ECC root was distrusted as a precaution. Downstream runtimes that ship their own trust stores (Go, Node.js, Electron, Python certifi, curl, etc.) needed emergency CA-bundle updates so they stop trusting the compromised chains.
eMudhra / emSign Global TLS intermediates; any client shipping Mozilla-style CA storesSince Oct 18, 2026
GoDaddy (Starfield) found that 404,607 TLS certificates carried policy information (policy OIDs, CPS URI) that didn't match its own published CP/CPS, which under the CA/Browser Forum Baseline Requirements means they must be revoked within five days. GoDaddy missed the Oct 18 deadline and says the certificates were revoked on Oct 21 2026. Nothing was hacked and no keys leaked, but sites still serving a revoked certificate can show browser warnings or become unreachable until the re-issued certificate is installed.
GoDaddy / Starfield TLS certificates (DV, OV, EV)Since Oct 14, 2026
nginx published multiple medium/major advisories fixed in 1.31.7+ and 1.30.6+, including HTTP/3 request-body injection (CVE-2026-95101), TLS session-ticket forgery (CVE-2026-97629), AIO use-after-free (CVE-2026-97205), and buffer overflows in alias/rewrite and map/regex paths. Same-day chatter bundled this with the PHP/Node/GitLab rush for anyone terminating HTTP on nginx.
nginxClosed Oct 14, 2026
Embedthis GoAhead, the embedded web server behind device-management pages on many IoT, firewall and OT products, fixed eleven advisories in 6.1.1. The critical ones: a Basic and form-auth bypass for users with BF1 (Blowfish) stored hashes where any password works (6.1.0, CVE-2026-115888), OpenSSL builds that load a CRL but never enforce it so revoked mTLS client certificates are still accepted (3.4.5 to 6.1.0, CVE-2026-115881), and Windows CGI command injection through .bat/.cmd scripts run via cmd.exe. Others include mTLS chain-depth bypass on LibreSSL legacy-verifier builds (CVE-2026-115884), httpoxy-style CGI HTTP_PROXY injection (CVE-2026-115882), CGI ISINDEX option injection (CVE-2026-115880), a 1-byte DH modulus on Mbed TLS builds that makes TLS 1.2 DHE_RSA sessions decryptable, request smuggling, and session fixation. The advisories went out Oct 12; FoxIO's Oct 26 write-up on the three TLS bugs drew wide attention. Upgrade to 6.1.1; devices only get the fix when their manufacturer ships new firmware.
Embedthis GoAhead embedded web serverSince Oct 12, 2026
Sparrow v2.5.6 has been released, removing the eMudhra root certificates and upgrading the bundled Tor to meet the client protocols now required by the Tor network. It also brings extensive screen reader and keyboard accessibility improvements. Changelog: t.co/4YVq0yJBbg
Update: Microsoft has removed seven certificates associated with the affected eMudhra hierarchies from the Microsoft Edge trust list, following their removal from the Windows trust list. We’ve updated our guidance with additional information on these protections and what customers should consider when managing trust locally. Read the latest in our blog: t.co/5WQnB0WH3D
These vulns were patched in the latest GoAhead 6.1.1, however, IoT and OT devices are rarely updated, leaving hundreds of millions of devices vulnerable. Manufacturers will need to push this update and notify clients.
Following the eMudhra certificate authority incident, the Besu, Teku and Web3Signer teams have shared notes for operators. → Besu: t.co/6j5rLcLBbd → Teku: t.co/djHIQNiHaA → Web3Signer: t.co/EzUaF4SOyi t.co/GFRZ1PUFM4
CERT-In has published Advisory on its website. Multiple Vulnerabilities in Oracle Products t.co/UVCjvG7j9L Compromise of eMudhra Intermediate CA Certificates t.co/gixbWR83Vf
Sandboxes SDK 0.12.14 is live to patch the eMudhra certificate compromise. Update your `Dockerfile` to use the new image and redeploy. t.co/QBvp8tFeFy
+23 more on the incident pages above.