Town Square
The security stories everyone is arguing about online, checked. Each day we read Hacker News, Reddit, Mastodon, Lobsters and what search shows from X, test each claim against primary sources, digest what the threads said, and tell you what we think it means for a security leader.
This is opinion, and it says so. It is not CISO Voices, which records what named security leaders say in public.
Saturday, October 24, 2026
Read the edition →eMudhra exits SSL/TLS after weak intermediate CA keys and 4 more
- ConfirmedeMudhra exits global SSL/TLS certificates after weak intermediate CA keys
Browsers blocked eight eMudhra intermediates with trivially weak keys. Chrome drops the signing root on October 27, and holders need replacements now.
- Partly confirmedAmazon says PHP2Shell was probed four days before disclosure; success is unproven
Amazon's honeypots logged an October 17 attempt. Whether any pre-patch attack worked is unknown, and the embargo fight is a sideshow.
- Not confirmed yetCalif says it hacked the iPhone, showing demos at Hexacon in Paris
The security firm showed iPhone attack demos and promised details later. Apple's response and patch status are not yet established.
- Partly confirmedCanada's Bill C-22 lawful access bill reaches the Senate amid encryption warnings
The bill's capability mandate is established. Its scope, its retention period and the secret-order mechanics are where the real uncertainty sits.
- Partly confirmedTrend Micro ZDI kernel bug reports reach public Linux mailing list before patches
Six unpatched kernel flaws, two rated CVSS 9.0 in the in-kernel SMB server, landed on the public LKML. Whether it was a mistake is unsettled.
What the verdicts mean
- Confirmed1 so far
- A primary source (the affected organization, the vendor, a regulator, a court, a CVE record) or two independent outlets with their own reporting state the core claim.
- Partly confirmed3 so far
- The core event is established; details spreading in the threads (scale, attribution, impact, motive) are not.
- Not confirmed yet1 so far
- Only the claimant, or reposts of the claimant. No primary or independent confirmation yet.
- Disputed0 so far
- A primary source or a credible party contradicts the claim.
- False0 so far
- Primary evidence shows the claim is wrong.
A verdict rests on the sources, never on how many people repeat a claim. A thread proves what was said in it, not what is true. We never name or quote the people in a thread, and a story that rests on an allegation of wrongdoing against a named person stays out.
The CISO Tribune briefing
Every verified CISO move and one piece of analysis, weekly.
Unsubscribe any time. See the privacy policy.