TrustList daily digest · News

Thursday, 22 October 2026

News: the stories TrustList published on this day, each in a line of our own. Open a story for the whole piece and its sources.

News12

1News
Studio breach may have exposed every account's API keys and form data
The Japanese no-code site builder says an attacker reached its cloud environment on 30 September and 1 October and read the key that decrypts stored secrets. Japan's Digital Agency says its own site was affected.
2News
Railway says an attacker reached customer secrets; rotate them all
The hosting platform paused all deployments after finding access to stored environment variables, some decrypted. It links the attack to a campaign against AI inference providers and tells every user to roll keys.
3News
Arc browser stops working on 22 December; new accounts closed now
The Browser Company is retiring Arc to focus its security work on Dia. AI features on mobile go on 23 November, and Arc accounts are deactivated at the end with personal data deleted within 30 days.
4News
GoDaddy misses deadline to revoke 404,607 mis-profiled TLS certificates
The certificates are technically sound but did not match the policy GoDaddy published for its Starfield and GoDaddy hierarchies. Industry rules allowed five days; by 19 October 227,422 had been revoked.
5HR News
BambooHR went offline for six hours to patch PHP, halting payroll work
The HR platform pulled its US, Canadian and Irish services as a precaution against the critical PHP flaws on 21 October and came back after patching, saying the outage interrupted payroll.
6News
Quad9 will withdraw its DNS service from France on 24 November
A Paris court ordered the Swiss non-profit resolver to block sports piracy domains for beIN, cutting the penalty to €1,000 a day. Quad9 says it cannot block by country and will stop serving users in France.
7News
Google Ads will pull landing-page images into new PMax ads by default
From 4 December, new Performance Max campaigns are opted in to image extraction even where an account has dynamic images switched off. Advertisers who do not want it must opt out per campaign.
8HR News
UK employers face a duty to stop third-party harassment from 30 October
The government's updated Employment Rights Act timetable confirms the harassment and trade union measures for 30 October, with six-month unfair dismissal protection and uncapped awards following on 1 January 2027.
9News
eMudhra quits the global TLS certificate business after its CA key leak
The Bengaluru-listed trust company says its board chose to withdraw a week after eight intermediate keys were exposed. Its G1 RSA roots keep serving customers until they are moved to partners at no cost.
10Business news
Opaque Systems winds down as its confidential AI team joins Anthropic
The Berkeley RISELab spin-out is closing its business; its open-source agent trust projects carry on at AgenTrust and its summit moves to the Linux Foundation. Customers need a migration plan.
11News
91APP database attack spreads to brands as Taiwan opens an inspection
The Taiwanese e-commerce platform says data was taken from its Commerce Cloud database; brands using it report scam emails quoting real orders, and Taiwan's Digital Industry Administration has inspected the company.
12News
Onamae Desktop Cloud shuts all servers after intrusion on 26,739
GMO Internet's Windows desktop cloud found malicious programs on customer servers on 20 October and is stopping every plan with no restart date. Customers are told to change stored credentials.

TrustList Weekly

The week in software and IT, in one email

The news that matters to buyers, new rankings and our own research. Every Thursday, free, and easy to leave.