// day
Oct 18, 2026
3 new incidents, 0 with updates.
## started
- unknownclosedpartial fixclosed Oct 21, 2026
Bullhorn staffing platform taken offline for cyber incident
› Bullhorn
Recruitment software provider Bullhorn confirmed a cyber incident and temporarily disabled customer access, forcing password and API credential resets.
- criticallivepartial fixsince Oct 18, 2026
eMudhra intermediate CA private keys compromised
› eMudhra / emSign Global TLS intermediates; any client shipping Mozilla-style CA stores
Eight eMudhra Global TLS intermediate CA private keys were found to be cryptographically weak / recoverable (researcher report Oct 18). Mozilla, Chrome, Apple and Microsoft blocked the intermediates; eMudhra revoked them Oct 19 and the ECC root was distrusted as a precaution. Downstream runtimes that ship their own trust stores (Go, Node.js, Electron, Python certifi, curl, etc.) needed emergency CA-bundle updates so they stop trusting the compromised chains.
CVE-2026-111943CVE-2026-91403 - highclosedpartial fixclosed Oct 20, 2026
TeamUpdraft / UpdraftCentral keys stolen; WordPress sites backdoored
› UpdraftPlus / UpdraftCentral (WordPress)
UK plugin maker TeamUpdraft said attackers breached its website, stole UpdraftCentral connection keys, and used them to backdoor WordPress sites running UpdraftPlus/UpdraftCentral.
