Inside · A2Mistral's Voxtral 3 bundles transcription, speech and a voice-agent SDK Inside · A3Blackwall quadruples its valuation to $2.2B by taming bot and agent traffic Inside · A4France had more exposed supermarket fridge controllers than the rest of the world combined
Today’s forecastTrust stores under a hard frost, with eight intermediate certificates freezing over by noon. Clouds over Anthropic's balance sheet, and a 10% chance your Tor exit is reading along.

The Daily Archit

“All the tech that’s fit to print”Late City Edition
Vol. I · No. 4 Tuesday, October 20, 2026 Price: one HTTP request
The Newsstand · all editions
WEB PKI

Private keys for eight eMudhra intermediate CAs can be recovered from their own certificates

Browsers and Microsoft have blocked the certificates, but clients that ship their own CA bundles are still exposed.

By the Daily Archit news desk emudhra.we-have-a-problem.com

eMudhra generated the keys for eight intermediate CAs so badly that anyone can derive them from the published certificates. A researcher proved it by signing test messages with each key. Firefox and Chrome blocked the intermediates on 17 October and Microsoft followed on the 20th. curl, Electron apps and other tools that don't enforce CT need updated bundles.

Full story at emudhra.we-have-a-problem.com →
Image via Cloudflare
TOOLCHAINS

Cloudflare and VoidZero port the TypeScript compiler to Rust

tsrs, incubated in the Oxc project, aims to be a faithful port rather than a fork. On the same number of workers, Cloudflare says it type-checks up to 8x faster than TypeScript 7.0 and uses about 70% less memory. Rust lets it compile to WebAssembly without bundling a garbage collector, so it can run in browsers and Workers.

Cloudflare
Image via kaba.cx
PRIVACY

One in ten Tor exit relays was hijacked to intercept SSH sessions

A researcher scanned about 3,000 exits and found 333 sending SSH connections to 12 interception servers. The servers had been compromised since August with the Ebury backdoor, which steals passwords and watches commands as they are typed. The Tor Project flagged the relays as BadExit within days. Nobody knows how the attackers got in.

kaba.cx
BREACH CLAIM

Extortion group says it took 10.6 TB from TiDB maker PingCAP, including plaintext API keys

FulcrumSec says it spent two months copying data from PingCAP's clouds using service-account keys it found in the company's own repositories. It claims 115,308 console API keys stored in plaintext, 20.6 million customer SQL statements and 413 private repos. The claims are unverified. TiDB Cloud users should rotate their keys anyway.

FulcrumSec (attacker claim)

From the Newsstand see every edition →

The Daily Archit No. 9 · Sunday, October 25, 2026 OPEN-WEIGHT MODELS Moonshot's Kimi K3.1 Pro pulls an open-weight model to within a point of the frontier OpenAI takes frontier model training off the live internetAnthropic hands Agent Skills to the Linux Foundation's Agentic AI FoundationBrotli decoder bug grows from Node2Shell into HTTP2Shell, reaching Python, Bun, Envoy and curl The Daily Archit No. 8 · Saturday, October 24, 2026 LANGUAGES C++26 fails its ISO ballot, leaving a finished standard in limbo Mozilla pulls trust from an eMudhra root as the CA blames social media for missed deadlinesSam Altman says defenders can no longer patch their way out of AI-found bugsAsked to pick midterm candidates, Grok goes Republican and GPT goes Democrat The Daily Archit No. 7 · Friday, October 23, 2026 AI & MEDICINE Microsoft's diagnostic agent beats generalist doctors in a peer-reviewed Science study Go hard-codes distrust of a set of compromised intermediate certificatesCanada's lawful-access bill would let a minister order backdoors into messaging servicesGermany's AfD confirms a 281 GB leak of internal email after its host was hacked The Daily Archit No. 6 · Thursday, October 22, 2026 SUPPLY CHAIN Poisoned LiteLLM release on PyPI stole the keys to the AI stack Railway tells every user to rotate secrets after an attacker reached stored environment variablesAnthropic and Theorem prove 239 fuzz targets crash-free, down to the compiled binaryeMudhra quits the global TLS certificate business after its CA keys proved trivially weak