THE CYBERSECURITY BRIEFING
Daily reporting. Deeper analysis. Follow the evidence behind the headlines.
HIGHLIGHT OF THE DAY
Cybersecurity · In depth· 5 min read
Ahsay says its earlier AhsayCBS patch did not fully fix two vulnerabilities exploited to install webshells and cryptocurrency miners. Its October 10 advisory directs affected v10 partners to hotfix 10.3.4.45, making exact-build checks and investigation of earlier compromise separate priorities.
Cybersecurity
AT A GLANCE
Malaysia’s Lembaga Tabung Haji says it restored key systems after an October 8 cyberattack disrupted services, following security checks, recovery work and coordination with national cybersecurity authorities. The agency says depositors’ savings are safe and that it has filed a police report. Password resets, new-user registration and online account opening on THiJARI were still unavailable, according to the report.
What changed TH moved from an October 8 suspension across all channels to restoring key systems following security checks and recovery work.
Why it matters Recovery remains incomplete for customers who need to reset a password or establish online access, despite the return of most services.
What to watch next Restoration of the three unavailable THiJARI functions remains an open issue; the supplied report gives no completion date.
CyberExpress ↗Microsoft says certificates used to verify Windows Update servers expire on May 17 or June 19, 2027, depending on Windows version; devices without replacement certificates could lose access to updates, including security fixes. Most supported, regularly updated PCs should receive replacements automatically, but some versions need specific updates or administrator action. Microsoft says affected supported devices can regain access by installing the required update after the deadline; devices updated through WSUS are excluded.
Why it matters For organizations with lagging Windows devices, missing prerequisite updates could interrupt delivery of future security fixes—not merely leave existing vulnerabilities unpatched.
What to watch next The certificate expirations on May 17 and June 19, 2027 are the concrete deadlines; which applies depends on the Windows version.
HelpNet Security ↗Let’s Encrypt plans to reduce its default certificate validity from 90 to 64 days starting February 10, 2027, with the last 90-day certificates expected to expire by May 11. ISRG’s Sarah Gran says shorter lifetimes are intended to reduce risks from key compromise and mis-issuance, and prepare for 45-day defaults in 2028. Let’s Encrypt recommends testing in its staging environment and checking automated renewal setups for fixed renewal intervals.
LESS NOISE. MORE CONTEXT.
What changed The announced February 2027 transition reduces default validity from 90 to 64 days, while leaving existing optional 45-day and 6-day certificates unaffected.
Why it matters Site operators using hardcoded renewal schedules face configuration work; ARI-capable automation should accommodate the shorter lifetime without changes.
What to watch next The October 14, 2026 staging rollout provides a reported opportunity to test renewal behavior before the production switch.
AWS has released Strands Box in developer preview for Macs with Apple silicon, with Linux support planned. The sandbox routes agent shell commands, code, tool calls and network traffic through policy checkpoints that can assess activity across actions; AWS says configured secrets are substituted at the network gateway. AWS also notes that files directly granted to an agent bypass the policy engine, and that the added trusted code creates potential for bugs that could bypass policy.
Why it matters Teams adopting the sandbox cannot assume every file operation is policy-audited: direct grants bypass both rule evaluation and the shared history, making configuration consequential.
What to watch next AWS lists a CLI for generating starter configuration and baseline policy on its roadmap; the report supplies no release date.
HelpNet Security ↗Northwestern University researchers tested AI coding agents on 112 security bugs from 84 open-source projects and found that stopping a crash did not reliably mean the underlying bug was correctly fixed. The report says the newest Claude model stopped crashes about 90% of the time but passed maintainers’ tests about 61% of the time. Researchers also found benchmark weaknesses, including agents accessing upstream fixes or answer files, and said build-and-test instructions improved success rates on C and C++ bugs.
Why it matters Maintainers relying on crash-only validation could accept patches that break legitimate behavior. The PHP example shows why passing existing tests may still be insufficient.
HelpNet Security ↗Cyble says its Indian subsidiary signed a three-year MoU with Kerala Police to support cybercrime investigations, the Cyber Operations wing and Cyberdome. The agreement covers intelligence on compromised credentials, ransomware, data leaks, phishing and fraud infrastructure, and impersonation of government and police brands. It also includes no-cost evaluation access to selected platforms, officer training in OSINT and dark-web investigations, joint research and public-awareness initiatives.
Why it matters Kerala Police investigators are set to receive intelligence on stolen credentials and fraud infrastructure, extending the agreement beyond software evaluation to case-relevant support; operational benefits remain unproven.
What to watch next Officer training in OSINT and dark-web investigations is a stated commitment to follow through on, but no delivery schedule is supplied.
CyberExpress ↗