What you need to know

Eight trivial keys broke a link in the web’s trust chain

Indian certificate authority eMudhra issued eight intermediate certificates whose P-384 private keys were tiny integers: 4, 56, 66, 115, 155, 156, 230, and 237. Real keys carry about 384 bits of randomness, up to roughly 116 digits. Because the public keys sit inside the certificates, anyone could recover the private keys almost instantly. One researcher reportedly did it in under a second.

Anyone holding the keys could forge HTTPS certificates for any domain, including banks, government portals, and email providers. An attacker who could also intercept traffic, through malicious Wi-Fi, DNS manipulation, an internet provider, or state filtering, could then read or alter it behind a legitimate-looking padlock.

Browsers closed the gap within days

Chrome received the report Oct. 17 and blocked the six TLS intermediates that evening. Mozilla completed an emergency OneCRL block in under three hours. Apple acted Oct. 19 and Microsoft Oct. 20, and eMudhra has revoked the certificates. Browsers push distrust lists centrally, without patches or restarts, so users of current mainstream browsers are largely protected.

The exposure now sits outside the browser

Servers, corporate appliances, industrial and embedded systems, containers, command-line tools, and older operating systems often run on static trust bundles and skip revocation checks. They keep accepting the compromised chains until someone replaces the bundle.

Cross-signing makes the fix harder

The same compromised public keys appear in certificates cross-signed by Sectigo, so blocking certificates by serial number is not enough. Defenders must reject the key itself, or every trust path that validates it, whichever chain it appears in.

The cleanup will outlast the emergency

eMudhra says the failure is limited to intermediates created in an April 2025 key-generation ceremony and does not touch its root keys or other intermediates. It is still investigating the cause. Chrome found no TLS certificates chaining to the affected intermediates in Certificate Transparency logs before the block. Those logs do not cover every connection or non-browser client, so they cannot rule out misuse.

The most likely outcome is that browser risk stays contained while a long tail of unpatched systems remains exposed. Closing it depends on thousands of vendors and administrators updating trust stores, rebuilding applications, and finding systems that have gone years without security updates.

Birthplace of civilization

Iran fails to choke Gulf crude, but raises the price of moving it

Middle East crude flows averaged more than 24 million barrels a day (about 3.8 million cubic meters) in the week through Oct. 18, above the prewar 23.3 million (3.7 million cubic meters), Kpler estimates. Producers have built an export system around the war rather than waiting for Hormuz to reopen. The figures track crude leaving the region, not higher production.

Hormuz itself has not normalized. Flows through the strait, including offshore transfers in the Gulf of Oman, run near 14 million barrels a day (2.2 million cubic meters), about 82% of prewar levels.

Kuwait, Qatar, and Iraq run a dark shuttle

These exporters have no pipeline bypass and must transit Hormuz. Tankers load inside the Gulf, often switch off their tracking transponders, hug protected routes along the Omani coast, and transfer cargoes to other ships in the Gulf of Oman. High margins keep ships and crews in the trade despite the danger.

Attacks surge even as volumes recover

About 30 attacks on ships have been reported in October, one of the war’s most violent stretches at sea. On Oct. 16, a rocket-propelled grenade fired from a small boat struck the Tanzania-flagged tanker Loyalty, carrying about 2 million barrels (318,000 cubic meters) of Iraqi crude, according to maritime security firm Vanguard. Attribution is incomplete because many ships sail untracked, but Iran retains real sea-denial capacity.

CENTCOM says U.S. and partner forces “clearly control” the strait. That is a U.S. claim, not an established fact.

Iran’s own exports are gone

Iranian seaborne crude exports fell to zero in the second week of September and stayed there into early October under the U.S. maritime blockade and sanctions. Tehran can impose costs on its neighbors and the world economy, but it has not stopped them from restoring most of their exports.

Cost, not volume, is now the pressure point

The workaround that requires flexibility & adaptation

The recovery is real but fragile. Global inventories are thin and refined-fuel markets remain tight. A single successful hit on a pipeline, transfer point, or tanker cluster could disrupt the improvised system that now carries Gulf supply. The most likely path is continued flows at high and rising cost, not a full closure.

____________________

Libya’s east swings behind Turkey’s maritime claim

Libya’s House of Representatives unanimously ratified the disputed 2019 Libya-Turkey maritime-boundary memorandum in Benghazi on Oct. 20 and repealed its 2020 decision to cut ties with Ankara. The eastern parliament, aligned with military commander Khalifa Haftar, now matches the Tripoli authorities that signed the deal. Turkey can claim backing across Libya’s political divide, removing the main internal obstacle to the agreement.

The vote is political, not operational. It does not settle competing claims or authorize drilling.

Greece and the EU reject the deal outright

The memorandum overlaps with Greek and Cypriot claims, chiefly by discounting Crete, which sits between the Libyan and Turkish coasts. Athens called the deal illegal, null, and void, briefed allies, and pledged all appropriate measures to protect its sovereign rights.

Energy and grid projects sit in the disputed zone

Washington weighs Libyan unity against NATO friction

The U.S. has not commented on the vote. Secretary of State Marco Rubio recently pledged strong support for the Great Sea Interconnector and diplomacy to clear obstacles. Massad Boulos, the president’s senior advisor for Arab and African affairs, prioritizes unifying Libya’s institutions, holding national elections, and expanding U.S. energy business there.

Boulos called Turkey an important partner for a unified Libya after meeting Turkish Foreign Minister Hakan Fidan in September. Ankara’s ties to both Tripoli and Benghazi make it less likely to spoil a settlement. The same convergence deepens Turkey’s rift with Greece, Cyprus, and the EU, and could invite Turkish security or military arrangements in eastern Libya.

The test is what Ankara builds on the vote

Watch for seismic surveys, exploration licenses, Turkey-Libya security agreements, or moves against Greek-backed projects. Any of these would turn a paper claim into a direct confrontation with Athens and Brussels.

____________________

Britain treats the Fairford plot as Iranian state espionage

U.K. counter-terrorism police have re-arrested two men under the National Security Act 2023 on suspicion of assisting a foreign intelligence service, naming Iran as the state involved. The case moves from terrorism and explosives law to hostile-state activity. Neither man has been charged.

A base tied to U.S. strikes on Iran drew the scrutiny

RAF Fairford in Gloucestershire hosts U.S. Air Force aircraft, including long-range bombers, used in operations connected to the war with Iran. On Sept. 27, police arrested five men over suspicious activity nearby, declared a major incident, and evacuated homes while military bomb specialists searched three vans. They found no improvised explosive devices but recovered gasoline.

London points to the IRGC

Counter Terrorism Policing calls Iranian state involvement “highly likely.” Prime Minister Andy Burnham has said the activity was likely coordinated in Iran and almost certainly directed by the Islamic Revolutionary Guard Corps. Tehran denies involvement.

Charges would mark a wider U.K.-Iran confrontation

The re-arrests do not show what the plan was, whether an attack was imminent, or whether prosecutors will bring charges. The legal shift places the case within Britain’s broadening campaign against Iranian state-linked activity on its soil and raises concern that Iran may test, surveil, or target sites linked to U.S. military operations.

____________________

Iraq Begins Closing Border Crossings With Iran

Iraq has closed the Sheeb border crossing with Iran in Maysan province to passengers, vehicles, and freight until further notice. Prime Minister Ali al-Zaidi ordered the closure, and more crossings could shut gradually in the coming days, a government source told Al Jazeera. Baghdad has named no specific threat, reopening date, or public timetable.

Drone attacks on Saudi Arabia drive the security push

Sheeb closed temporarily last month during an investigation into drone attacks on Saudi Arabia, reportedly launched from the Iraq-Iran border area. The new closure suggests Baghdad is moving from case-by-case inquiry to broader border control.

Precaution for now, disruption if it drags on

The closure looks like a security measure, perhaps under U.S. pressure, not a break in Iraqi-Iranian relations. A prolonged or wider shutdown would disrupt cross-border trade and travel during a period of high regional tension.

Britain revives North Sea gas with Jackdaw approval

The U.K. government approved the Jackdaw gas field in the North Sea, ending a legal and political fight over one of Britain’s most advanced offshore projects. Labour shows it will reauthorize fossil fuel projects that clear the revised climate-assessment process.

The court’s climate test now applies in practice

A January 2025 Court of Session ruling voided the original Jackdaw and Rosebank consents because their environmental assessments ignored emissions from burning the extracted fuel. Both companies had to reapply with these downstream, or Scope 3, emissions included. Jackdaw is the first project approved under the new standard.

London pitches security, critics see little price relief

Ministers frame the approval as an energy-security step amid high prices and pair it with a £2 billion (about $2.7 billion) Energy Wealth Fund to channel future North Sea revenue into the low-carbon transition. Critics say one new field will barely move consumer prices, which international markets set, and clashes with Britain’s climate commitments.

Rosebank is the real test

Rosebank, a much larger oil project west of Shetland, lost its consent on the same grounds, and the government says its decision will take longer. Approving Jackdaw, a nearly finished gas field, was the easier call. Rosebank will show whether Labour applies the same logic to a major new oil development.

____________________

Kim Jong-un kinda resurfaces, kinda deflating death rumors

Online claims that North Korean leader Kim Jong-un suffered a brain hemorrhage, died in Beijing, and was succeeded by his sister Kim Yo-jong have no credible support. North Korean state media showed Kim visiting a clothing and footwear exhibition in Pyongyang on Oct. 19 with his wife, Ri Sol-ju, and daughter, Kim Ju-ae. The images cannot be independently dated, but they contradict claims that he is dead or incapacitated in China.

The health question stays live

South Korean intelligence assesses Kim at heightened cardiovascular risk from his weight and lifestyle, though it sees no sign of serious current illness. His daughter’s growing visibility at official events fuels speculation that she is being groomed as successor.

Expect more false alarms

North Korea’s secrecy makes outside assessment difficult and leaves room for unverified claims to spread. Similar death reports in 2020 collapsed when Kim reappeared. Until Pyongyang’s leadership changes in a verifiable way, his public appearances remain the most reliable indicator.

Sign up link: https://www.center-of-gravity.info

Inside Track: https://www.center-of-gravity.info/upgrade