Nonprofit certificate authority providing free, automated TLS certificates used to encrypt web traffic across much of the internet.
GitLab patched CVE-2026-97229, an integer overflow in its CI/CD regex compiler that lets unauthenticated users run code on self-managed servers. Separately, Let's Encrypt's 64-day production certificates start February 10, 2027, so renewal automation needs a test run first.
Reality
Let's Encrypt will issue certificates valid for 64 days by default from February 10, 2027, down from 90, Help Net Security reported. Staging opens October 14, 2026, 119 days earlier, and 45-day defaults follow in 2028.
Perspective Coverage
4 publishersReality
Attackers who hijacked the operators of three country-code domains obtained HTTPS certificates for Google domains, Google disclosed. The company says the issuing CAs did nothing wrong, so its defence came after issuance, and it cannot promise it found every affected domain.
Perspective Coverage
8 publishersReality
GoodBarber now serves on-device web content in its iOS apps from https://secure.internal, through a WKWebsiteDataStore proxy API added in iOS 17. A fixed name gives the company's token issuer one origin to allowlist, where the old loopback server needed a wildcard that matched any port on the phone.
Reality
Russian banks moved to a state-run CA in August after GlobalSign mass-revoked its Russian customers' TLS certificates under May's US Treasury sanctions. Their customers now carry the problem, since Western browsers typically do not trust state-run CAs.
Reality
Cloudflare has agreed to buy a GlobalSign root and applied to four browser root programs to become a public certificate authority. It has not issued a certificate yet, and its post-quantum certificates are aimed at Chrome's quantum-resistant root store in early 2027.
Reality
Cloudflare plans to become a public certificate authority and issue post-quantum Merkle Tree Certificates from early 2027. Sites it fronts will manage both kinds from one system, so the planning work falls on old devices that will never add a new root.
Reality
A guide rebuilding browser OIDC login off ingress-nginx keeps its Gateway and HTTPRoute objects intact and hands the 401-to-302 step to two Traefik middlewares. Swap the controller and that half gets rewritten.
Reality
The ingress-to-pod hop needs one nginx annotation and a pod that can serve TLS; the database hop needs one client flag. Pod-to-pod is the hop the dev.to inventory can only close with a mesh, and that is where the money goes.
Reality
Two tracked clusters hit Mexican, Ecuadorian and Brazilian targets with living-off-the-land tradecraft, numbered batch scripts and shared SOCKS5 relays. The AI tooling they left running is the part defenders can query for.
Reality
The hijacker forged Hetzner as the origin so origin validation passed, held the prefix from Friday night into Sunday morning, and Softaculous has no logs of any of it because none of the diverted traffic reached its servers.
Perspective Coverage
6 publishersReality
The dangerous nginx bugs are the ones that emit no runtime signal at all, so the only artefact carrying the evidence is the config text itself. Stapling with no resolver in scope is the cleanest case of the class.
Reality
A publicly trusted certificate issued for your domain and hosted elsewhere leaves one trace you can read for free: the Certificate Transparency entry the issuing CA had to create.
Reality
Hubs Community Edition's bundled scripts archive the Postgres dump and the Reticulum file store. Everything between a bare host and a serving room is a rebuild you perform by hand.
Reality