[digicert]

November 7, 2026

• DigiCert's exposed internal system sat open for over 16 months. A February 2025 migration moved an archive off a VPN-protected network and onto the public internet, where it inherited the customer-facing self-registration flow; outsiders created non-MFA accounts and, via a permissions flaw, browsed archived records. DigiCert spotted the rogue accounts on 18 June 2026 and dismissed them, a researcher escalated on 21 June, access was closed on 2 July, and only on 19 October did it confirm records were read between 27 June and 2 July. Exposed data includes names, business contact details, and in some cases passports, driver's licences and utility bills; CA systems were unaffected (The Register, The Record) (earlier coverage). · Breaches & Incidents

in SSHole Exploitation Lands Within Hours of Disclosure

November 6, 2026

• A migration error exposed a DigiCert internal business system to the internet. Unauthorized access reached archived customer contact information and, for some affected accounts, identity documents including passports, driver’s licenses and utility bills. The reporting provides no affected-customer count. BleepingComputer · Cloud, Identity & Incident Response

in ARTEX Operator Consoles Expose Near-Autonomous Cybercrime