Skip to content
self.md

■ SIGNALS // RADAR SIGNAL

the update did not reach every verifier

Eight compromised eMudhra intermediates, Anthropic’s reachability research, and Fabric’s recovery-log redaction.

Published Read 3 min
■ [!] ON THIS PAGE ▼

self.md radar — 2026-10-21

the update did not reach every verifier

Eight compromised intermediate certificates are now a browser problem and, separately, a trust-store maintenance problem. The eMudhra incident page lists revocation dates, test hosts, and package versions; some non-browser tools are still waiting on their own bundles.

1. eight eMudhra intermediate keys were recoverable from the certificates

An incident page published on October 20 says the private keys for eight eMudhra intermediate CAs were generated incorrectly and can be recovered from the certificates themselves. Its proof package includes a signed message for each intermediate. Firefox and Chrome blocked the certificates on October 17; Apple followed on October 19 and Microsoft on October 20.

The page also lists package and trust-store updates. Node.js and Bun were still marked pending when it was published. It says certificate-transparency logs show no entries for the affected intermediates during the relevant period, so CT-enforcing browsers could not have been attacked that way. For clients outside that regime, the page says it does not know whether anyone was targeted.

reading: eMudhra Intermediate CA Compromise

2. Anthropic counted reachable code before looking for a CVE

Anthropic’s research ran Claude across 25 open-source projects and inventoried more than 17,000 configuration options. The authors report 493 issues, including 94 option combinations that silently disabled a security control.

One OpenSSH case put roughly 4,500 lines of ML-DSA-44 code before authentication even when the algorithm was not enabled. sshd parsed a supplied key before checking whether that key type was allowed; Anthropic says OpenSSH 10.5 moved the check ahead of parsing. The work is a research result, not a CVE ledger. Still, reachability and configuration order deserve inspection before a bug has a name.

reading: Using Claude to reduce the attack surface of code

3. Fabric masks credentials in recovery output

Fabric v1.4.530 changes Gin recovery output so X-API-Key, Cookie, and Proxy-Authorization are masked rather than printed in clear text. The release says the middleware covers both REST and Ollama servers, with tests for debug panic and broken-pipe dumps.

This is the path that opens when a request has already gone sideways. Authentication can work normally and still leave the request headers in a crash record. The patch narrows that particular leak; it does not turn a recovery log into a safe place for arbitrary request data.

reading: Fabric v1.4.530 release notes

left on the table

XScreenSaver’s AGENTS.md is a compact prompt-injection specimen aimed at automated contributors. Its relevant commit is from September 4, not this week. Useful to keep in view; not fresh enough for a numbered story.

  • Personal AI OS tools — the control-plane map for personal agents, receipts, memory, and tools
  • Best Claude Code plugins — choose the Claude-specific extensions worth installing, and the ones to skip
  • Best MCP servers — connect files, browsers, memory, search, and workflow tools without turning the stack into soup
voice-identity