Up Times
Delorean with MCFLY+ license plate at Hudson’s American Heritage Museum car show. The web’s certificate system (indicated by the 🔒 lock symbol in a web browser) are like license plates – issued by a governing authority and not easily duplicated. Photo by Mark Nassal.
Do you validate? Cryptography is part of everything that’s secure or claims to be. Your cell phone uses cryptography when you lock and unlock it. Its carrier-linking SIM card works cryptographically. Your computer uses cryptography when you log out/log in. Your credit card contains encrypted data.
Recently the web’s SSL/TLS certificates have gotten attention (those stand for Secure Sockets Layer/Transport Layer Security; these acronyms represent the same technological thread: TLS is the updated SSL).
TLS was created to make a certified encrypted connection between your web browser and the destination website. There was a security lapse at India’s eMudhra certificate authority (a certificate authority is the website equivalent to our Massachusetts cars’ RMV) that a programmer showed to have ridiculously weak encryption – encryption generally uses large, large prime numbers or complicated math to thwart cryptanalysis (defeating the encryption) and at least one of the public keys in this case was just a single digit and the others were two or three digits.
With this particular vulnerability, it’s possible for web traffic to have been intercepted by a criminal organization – and browsers would still be showing that legitimizing lock symbol. This insecure access was possibly a testing error – someone may have been trying out the system and forgot to disable a testing environment. No exploits were known to have happened. And while there are browser and OS patches, IoT devices almost never get issued patches and legacy systems may not have available patches, so criminal abuse remains possible.
Also earlier the same week, GoDaddy, a prominent US certificate authority, invalidated over 400,000 certificates due to what seems to have been a clerical error on its part. Their agreement as a certificate issuer requires them to be fully compliant within five days of noncompliance discovery, so there was little warning when the 400,000 affected websites needed to reestablish valid certificates. While there was no cryptographic compromise during this incident, the resulting browser warnings made affected websites less accessible.
It’s rare our dependence on encryption makes itself known. It’s mostly invisible, but it is the heart of security. And Bryley can help you deploy it to secure your systems and evaluate your systems for compliance with encryption protocols. Reach out to Bryley’s Roy Pacitto at 978.562.6077 x217 or at RPacitto@Bryley.com.
NOTES:
https://emudhra.we-have-a-problem.com/
https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/
https://cybersecuritynews.com/godaddy-revoking-tls-certificates/
Criminals get real: it was reputation all along
FBI report: the extortion attacks that don’t lock your files like the familiar ransomware
In May the FBI issued an alert (FLASH-20260526-01) about a ransomware group that carries out data theft and extortion without traditional ransomware encryption … Continue Reading >
The practice of downtime
So there’s less real downtime when an emergency strikes
Imagine a ransomware attack lands on your systems: a criminal threat is all anyone sees on their monitors, and your files are maliciously encrypted so they no longer contain anything usable.
Everyone at your operation is somewhat prepared for this event if you’ve invested in an Incident Response Plan (IRP) (because of the ubiquity of cyberattacks). An IRP first means that emergency roles have been assigned, and even non-technical people have a response sheet to follow to help your organization weather these kinds of storms … [5 min. read; audio available] Continue Reading >
Some kind of wake-up.
Web language PHP vulnerabilities
Patches were released by the volunteer PHP team
Seen that brilliant XKCD cartoon about the digital world resting on the unpaid maintenance work of a random programmer in Nebraska? It’s funny because it’s true enough. All the software we count on is dependent on others’ free work. And the PHP vulnerabilities addressed this week are similar, though PHP has an (unpaid) team of coders that maintain it.
There were two vulnerabilities brought to the public consciousness lately. These had to do with being able to give the programming language false/mal-intended information that might have overrun websites (I saw numbers that up to 70% of websites depend on PHP – WordPress does [and that’s 40% right there]).
The vulnerabilities have been known to the PHP team since 2024 and they were able to produce a patch earlier than expected. But it was Google and Open AI researchers that maybe coincidentally reported on these code vulnerabilities which are ranked 9.2/10 in terms of severity. The patches need be applied to any outward-facing machine using PHP (like a website). With AI (criminal and benign) out looking for code weaknesses, patching is more important than ever … [5 min. read] huntress.com
Fake phishing email program makes the news
Stay sharp
An aspect of Security Awareness Training is helping employees correctly assess and handle phishing emails – the ones where criminals try to get an employee to take an action that reveals credentials or for general theft.
The training version is to send harmless emails that simulate one of those phishing attacks.
So, I won’t defend the meanness of this one (it IS awful to do to employees), but coming up with ideas to trick employees is kind of the idea of these things. And nobody’s saying how many employees clicked this one sent to Knicks employees after the Knicks won the NBA championship. The Times reports the fake phishing email was like this:
Congratulations, your Employee Championship Ring is here.
(Employee name), this one is on the house. MSG is issuing a complimentary employee championship ring. The same jeweler, the same craftsmanship, personalized with your name. No cost to you.
There are two designs to choose from: Championship Gold and Garden Classic. Reserve the one you want below. … [4 min. read] nytimes.com [paywall]
Stop & Shop among supermarkets breached
Though its Dutch parent does not disclose the nature of the attack, in other cases IoT refrigerators were hacked
It wasn’t long before people on sites like Facebook and NextDoor reported that Stop & Shop’s website was down due to an unnamed security incident.
But Reuters somewhat connects dots, describing a concurrent cyber event in French, Spanish, Portuguese, Polish, German and Belgian grocery stores. In these instances internet-connected control panels that regulate temperature in refrigerators and freezers was turned up, heating and ruining the food inside. Hundreds of stores had to throw away their food. It was a costly event for the affected supermarkets.
It may serve as a cautionary tale: does your work depend on IoT (Internet of Things, or internet-connected) devices? When have you last considered their security fitness? [4 min. read] reuters.com
Can I get a little privacy?!
Google has changed its privacy agreement, no longer walling off data from certain products within its ecosystem: it can now gather and correlate more user data.
So if you use a Google product, go to Manage Your Account and invest some minutes (re-)reviewing your settings which may well have changed since you were there before.
Especially look at Security & Sign-In, Linked Apps and Data & Privacy.
Also, there’s more permissions granted at myactivity.google.com/myactivity … [5 min. read] arstechnica.com
Berklee’s president on AI
Ultimately art creates empathy and connection –Jim Lucchese
Berklee College of Music took a hard turn toward tech in 2025 naming as its president Jim Lucchese. Lucchese previously built a music distribution platform that was acquired by Spotify.
The school has long been oriented toward career musicianship; meaning the goal is not some imagined purity of the art, but that people can have music as a profession.
Lucchese empathizes with young students who saw AI as not much of a threat a couple years ago and now wonder if they should even bother competing. He answers that they should press on: ultimately art creates empathy and connection. That sounds fluffy, but there are plenty of signs to back up the fact that when we go to experience music together, perform music together, the brain synchrony — we actually connect. Do we feel that we need more empathy and a sense of connection right now? [4 min. read] bostonglobe.com [paywall]
Note: The section directly above is Bryley’s curated list of external stories. Bryley does not take credit for the content of these stories, nor does it endorse or imply an affiliation with the authors or publications in which they appear.
Get Up Times, useful tech news by New Englanders in Your In-Box
- Subscribe to Up Times, the monthly New England-centric technology newsletter.
- Up Times covers:
-
- Trends in New England tech
- Security tips you can implement now
- Updates on regional and national laws and compliancies
- IT-related developments
- Networking and cybersecurity challenges New England business managers are facing
- In continuous publication since 2000, Up Times arrives monthly in your email box.
Sign up for Up Times to have tech news and tips delivered monthly via email
