Apple has sent new notifications of mercenary spyware infections to almost 100 countries, with recipients including journalists and documentary filmmakers.

“Today’s notification is being sent to targeted users in 99 countries, and to date we have notified users in over 150 countries in total,” the company said. “The extreme cost, sophistication, and worldwide nature of mercenary spyware attacks make them some of the most advanced digital threats in existence today. As a result, Apple does not attribute the attacks or the notice you’re receiving to any specific attackers or geographical regions.”

Apple didn’t immediately respond to a request for comment Friday about the countries targeted. Researchers and groups that work on spyware said the notifications were significant, however.

“This again promises to be an important set of notifications with a bunch of cases, based purely on what we see publicly,” said John Scott-Railton, senior researcher at The Citizen Lab at the University of Toronto. He also posted on social media about how potential victims could defend themselves, warning people to be cautious about companies that offer paid solutions to spyware infections.

He cautioned that the lack of notification doesn’t rule out an infection. The steps Apple recommends, which Scott-Railton seconded, were to enable Lockdown Mode and to get in touch with the digital rights group Access Now.

“The number of Apple threat notifications we are seeing from countries around the world indicates that the fight against the scourge of spyware abuse is far from over,” said Natalia Krapiva, senior tech-legal counsel with Access Now. “While we have increased our capacity to investigate spyware abuse, and companies like Apple have done a lot to notify and protect people from it, repressive states continue to use these powerful surveillance technologies, including against civil society actors and opposition figures.”

Apple sent its last major batch of notifications in August. The notifications frequently lead to victims approaching Access Now, The Citizen Lab and other groups seeking further assistance and prompting deeper investigations.

The notifications come shortly before the final rounds of negotiations over industry standards for commercial hacking tools being developed under the voluntary Pall Mall Process. The industry guidelines follow an earlier set of guidelines catered to governments.

“The states that will ultimately adopt these guidelines must come to terms that the current system is not working, and that the spyware industry must face some real consequences for the uncontrolled sale of these tools and refusal to curb the abuses,” Krapiva said.

The post Apple notifications alert victims in 99 countries about mercenary spyware infections appeared first on CyberScoop.

Indian certificate authority eMudhra said Thursday it will stop issuing SSL/TLS certificates days after researchers showed that the private keys securing eight of its certificates were so weak they could be reconstructed in under a second.

The announcement closes an incident where major browsers blocked the certificates and  Indian authorities launched an investigation.  

The company said its board concluded after detailed deliberations that leaving the business was the right decision for eMudhra and its shareholders. Company Chairman V. Srinivasan cited rising costs from data sovereignty and compliance requirements, along with competition from large providers that issue the certificates free of charge. He also said social media amplification of the incident brought scrutiny “out of proportion” to the unit’s place in the company.

“For many certifying authorities, SSL/TLS is the whole business,” the company said. “For eMudhra it is one part of a much broader digital solutions portfolio.”

The episode began last week, when a researcher notified Apple, Google, Microsoft and Mozilla that the private keys of eight eMudhra intermediate certificates could be computed from the public certificates because they were generated with too little randomness. Security researcher Scott Helme recovered all eight on his laptop in less than a second, a task he said an AI agent later repeated from a single prompt.

Normally, a private key is a secret number so large that no computer could ever guess it, roughly 77 or 78 digits long for the type of cryptography used in these certificates. Each of the eight eMudhra keys was a whole number below 256, with one simply logged as the number 4. Since a certificate publicly displays the key it was built from, anyone could test every possible value in seconds, and such keys could be used to forge certificates and impersonate websites.

eMudhra attributed the flaw to an error in a key generation ceremony held April 2025, saying the mistake produced a second, weak set of keys that was published to browser trust lists instead of the intended ones. The company said its infrastructure was not compromised, that no data was breached and that none of the eight intermediates had issued end-entity certificates. Whether anyone used the keys in question is not known.

Chrome and Firefox blocked the certificates within hours of the report, Apple blocked them Monday and Microsoft on Tuesday. Mozilla removed the company’s root certificate from its trusted list, and Google said it will remove that root from Chrome in an update expected next week while it reviews eMudhra’s remaining root certificate. Go, Node.js, Python’s certifi bundle and several Linux distributions also shipped updates.

CERT-In, the country’s computer emergency response team, said it did not see any malicious use of the keys as of Wednesday.

The company said its other businesses, including digital signature and enterprise security services, continue to operate normally, and acknowledged reputational risks it cannot quantify.

Shares of ​the company fell 40% in the two days after the vulnerability was disclosed.

The post eMudhra kills its certificate business after researchers cracked its private keys in under a second appeared first on CyberScoop.

Sen. Ron Wyden, D-Ore., is asking the National Security Agency to update public guidance on the security risks associated with commercial virtual private networks, and to answer questions about foreign surveillance threats against standard VPNs.

In a letter to NSA Director Gen. Joshua Rudd that Wyden sent Wednesday, the senator continued his push to warn about standard, commercial VPNs, following letters to federal agency leaders in March and July.

“While commercial Virtual Private Networks (VPNs) are recommended by federal agencies and widely marketed as shields against online spying, standard consumer VPNs do not sufficiently protect users from sophisticated adversaries,” Wyden wrote in the letter, first reported by CyberScoop. “Other, more secure alternatives are widely available.”

Wyden took aim at “single-hop” VPNs that routes data through one server before arriving at the destination.

He cited a Congressional Research Service paper from last month that said “a single-hop VPN, however strongly encrypted, offers essentially no protection against an adversary who can compel… or infiltrate that one provider,” compared to “multi-hop and mixnet architectures [that] directly target and mitigate this weakness” since a second server only knows the IP address of the first server.

He also cited a letter responding to an earlier missive that Wyden signed with other lawmakers in an exchange with the Office of the Director of National Intelligence. The office offered a note of caution about scrutinizing VPN providers’ privacy and security policies, but Wyden said “it overlooked the importance of the VPN service’s architecture against sophisticated foreign threats.”

Wyden referenced an advisory from the NSA and allied foreign governments last September about a China-sponsored campaign to target telecommunications, government and military networks.

He said that the NSA should update its public guidance on VPN configuration.

“Americans facing advanced foreign threats — including government personnel, defense contractors, journalists, and human rights defenders — deserve clear, honest advice about how best to protect their communications from surveillance by foreign adversaries. 

He also asked Rudd to answer a series of questions in an unclassified reply. Some view single-hop commercial VPNs as sufficient for average internet users, and Wyden asked whether they were strong enough to protect “Americans’ sensitive digital footprints against foreign adversaries capable of monitoring internet backbones.”

And Wyden wants Rudd to weigh in on the importance and effectiveness of multi-hop anti-surveillance systems, like Apple Private Relay, Tor and Nym, as well as how multi-hop proxy systems fare against mixnet architectures.

You can read the full letter below.

The post Wyden seeks upgraded NSA security guidance on commercial VPN use appeared first on CyberScoop.