appndo
News

October 21, 2026

Wednesday

  1. Hacker News, Simon Willison, CloudflareTech

    Eight eMudhra intermediate CA keys generated with 8 bits of entropy can be brute-forced instantly

    Chrome and Mozilla blocked eight compromised eMudhra intermediate certificates after a security researcher reported them on October 17. All eight keys consisted of 47 zero bytes followed by one byte, allowing anyone to brute-force them from the public certificates in at most 255 steps. Tools like curl, Python, Node, Go, Java, and git trust local CA bundles without checking revocation or CT by default.

    Why it mattersBecause runtimes like Node, Python, Go, and curl ignore revocation and Certificate Transparency by default, you must update server and container CA stores so forged certificates cannot intercept API traffic.

    Read at scotthelme.co.ukRead at simonwillison.netRead at blog.cloudflare.com
  2. TechCrunchAI

    Anthropic drafts federal AI safety bill to block models posing catastrophic risk

    Anthropic has circulated a draft AI safety bill for Congress that could block the distribution of AI models in specific scenarios. Those scenarios require a foreseeable, imminent risk of more than 50 deaths or over $1 billion in property damage. Under Anthropic's draft bill, evaluators finding an imminent catastrophic risk have 72 hours to alert the Commerce Department, which must ask a Washington, D.C., judge to halt the model's release.

    Why it mattersBy tying federal release blocks to court orders and billion-dollar or mass-casualty thresholds, this framework targets frontier model launches rather than everyday apps built on AI APIs.

    Read at techcrunch.com