Hackers obtain counterfeit TLS certificates for Google and other large services

Ars Technica@mastodon.social · 2026-10-07 03:23

Compromise of 3 domain registries allows hackers to walk off with unauthorized certs. https://arstechnica.com/security/2026/10/hackers-obtain-counterfeit-tls-certificates-for-google-and-other-large-services/?utm_brand=arstechnica&utm_social-type=owned&utm_source=mastodon&utm_medium=social

Hackers obtain counterfeit TLS certificates for Google and other large services

Compromise of 3 domain registries allows hackers to walk off with unauthorized certs.

arstechnica.com

View original 0 Likes 0 Boosts

Comments (1)

sean watters@mastodon.social 2026-10-07 12:31 edited

@arstechnica how is the CA the "weak link" here? AFAIK all of the ACME challenge types assume the owner of a domain is the only one who can modify their own DNS records.