# CA Published articles for CA. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Your Router Trusts Its Validator. But Who's Watching the Validator? DevFeed: [Your Router Trusts Its Validator. But Who's Watching the Validator?]() Original publisher: [Read original article]() Author: Ritesh Mukherjee Published: 2026-11-09T10:59:54Z Content type: opinion Language: en Sources: [Cyber Newsroom](), [RIPE Labs]() Topics: [observability](), [Access Control](), [known exploitable vulnerabilities](), [Open Source]() Tags: [academic-research](), [account](), [aspa](), [attack](), [attack-surface](), [authentication](), [bgp](), [bgp-routing](), [bug](), [ca](), [cache](), [crash](), [credentials](), [crl](), [infrastructure](), [open-source](), [policy](), [registries](), [repository](), [router](), [rov](), [rpki](), [tools]() ### AI overview RPKI fail-open behavior protects reachability, but an upstream break can quietly change routes from Valid to NotFound without alerting operators. The article traces the chain from CA account through repository, validator, RTR session, and router policy, citing credential compromise, missing or deleted ROAs, validator crashes, and router policy inconsistencies. It presents RAVEN's `raven rtr monitor` as an independent RTR client that tracks cache payload changes and sync timing against an adaptive baseline, distinguishes full resyncs from incremental updates, and streams route validation changes. The tool can surface unusual VRP movement and route transitions, but it does not yet detect a cache that answers while its serial stops advancing, alert on RPKI-driven changes, compare caches, inspect router policy, or repair problems. It supports TCP and TLS, not RTR over SSH. ### Source excerpt ROV turned your validator into a forwarding policy source. The registries have strengthened their side of the RPKI, but the chain from repository to router runs on your infrastructure. When that chain breaks, it often breaks silently. ## The intensional model in disguise DevFeed: [The intensional model in disguise]() Original publisher: [Read original article]() Published: 2026-11-06T18:00:00Z Content type: article Language: en Sources: [Farid Zakaria's Blog]() Topics: [CI/CD]() Tags: [actions](), [bazel](), [behavior](), [binaries](), [build](), [building](), [builds](), [c](), [ca](), [cache](), [cat](), [cc](), [change](), [changes](), [clang](), [command](), [model](), [nix](), [prototype](), [store]() ### AI overview The article argues that Nix content-addressed derivations and Bazel/buck2 action caching implement the same intensional build model: outputs are identified by content, and actions key off command lines and input content digests. In its C example, changing a comment makes the compile action run, but leaves the object file unchanged, so Bazel and buck2 reuse the link action's cached result. Nix defaults to an extensional model, where recipe and upstream input changes propagate through store paths and trigger downstream rebuilds; enabling content-addressed derivations lets it avoid rebuilding the unchanged link output. Bazel and buck2 use the intensional model by default and offer no input-addressed mode, while Nix supports both. The excerpt identifies early cutoff as the resulting optimization and says its granularity helps explain why people use Bazel and buck2 for large builds until Nix dynamic derivations stabilize. ### Source excerpt Despite how different they look on the surface, Nix, Bazel and buck2 are remarkably similar under the hood. Don't believe me? I built a prototype in one store, two frontends to prove it. Turns out though that the similarities are even deeper than I realized. ## Maestro CLI 2.12.1: templated appIds resolve on Android taps DevFeed: [Maestro CLI 2.12.1: templated appIds resolve on Android taps]() Original publisher: [Read original article]() Author: Maestro Team Published: 2026-11-03T12:31:00Z Content type: release Language: en Sources: [Mobile]() Topics: [Android](), [Android Testing]() Tags: [android](), [ca](), [certificates](), [cli](), [element](), [emudhra](), [intermediate](), [maestro](), [okhttp](), [security]() ### AI overview Maestro CLI 2.12.1 fixes Android flows that pass a templated `appId` through `--env`: `tapOn` and `openLink` now resolve the package name before handing it to the driver. This restores screen-settle behavior for element taps, makes `waitToSettleTimeoutMs` apply when a window update is detected, and gives `openLink` with `autoVerify: true` the correct appId; no flow changes are needed. The CLI's OkHttp connections also reject eight eMudhra intermediate CAs revoked in October, independently of the JDK trust store. Update the JDK separately to cover other CLI connections, including `maestro download-samples`; verify the CLI's JDK with the vendor's check tool because version numbers and early-build coverage vary. ### Source excerpt Maestro CLI 2.12.1 resolves templated appIds before element taps and openLink on Android, and rejects eight revoked eMudhra intermediate CA certificates. ## Python 3.15 Ships and Other Python News for November 2026 DevFeed: [Python 3.15 Ships and Other Python News for November 2026]() Original publisher: [Read original article]() Author: Martin Breuss Published: 2026-11-02T14:00:00Z Content type: news Language: en Sources: [Real Python]() Topics: [Python](), [pip](), [Pytest](), [Claude](), [AI Chat]() Tags: [2-0-0](), [2015](), [2022](), [2026](), [22](), [64-bit](), [about](), [account](), [anthropic](), [ca](), [keys](), [news](), [none](), [november-2026](), [operators](), [python](), [python-3-15](), [releases](), [security](), [temperature]() ### AI overview Python 3.15 shipped October 9 with unpacking in comprehensions and Tachyon, a low-overhead sampling profiler that can attach to running processes. Python 3.16's first alpha followed, while draft PEPs propose `?.` and `??` operators that remain under debate. A security flaw in eight eMudhra intermediate certificate keys prompted layered fixes: update Python, `pip` and `certifi` in each environment, and `uv` on each machine; newer Python releases also block the compromised keys during TLS verification. The article also highlights breaking ecosystem changes: Polars 2.0's streaming engine may change row order, and Anthropic's new API rejects sampling parameters such as `temperature`. It includes upgrade guidance and notes Python 3.10's end of security support. ### Source excerpt Python 3.15 ships, 3.16 eyes None-aware operators, eight broken CA keys trigger security releases, and Anthropic drops temperature. ## Improved LCL Equivalences and Curve Decoding Alphabet Sizes DevFeed: [Improved LCL Equivalences and Curve Decoding Alphabet Sizes]() Original publisher: [Read original article]() Author: Rohan Goyal, Venkatesan Guruswami, Yihang Sun, Mary Wootters Published: 2026-10-30T04:00:00Z Content type: article Language: en Sources: [arXiv: Cryptography and Security]() Topics: [Decoding](), [polynomials]() Tags: [2025](), [2026](), [alphabet](), [ca](), [code](), [coding](), [construction](), [cs-cr](), [cs-it](), [decoding](), [delta](), [design](), [guarantees](), [linear](), [linear-codes](), [list](), [local](), [matching](), [math-it](), [probabilistic](), [properties](), [property](), [proximity]() ### AI overview The work strengthens the local equivalence guarantees for LCL properties: it improves the probabilistic guarantees for random Reed-Solomon codes and extends equivalence with random linear codes to each known subspace design construction, including folded Reed-Solomon codes. It then uses these results with rank-sensitive counting to exponentially improve alphabet-size requirements for curve decoding while matching the best known parameters (a,b). For constant degree ℓ, the bounds match the best known for list decoding and improve those for proximity gaps, correlated agreement, and mutual correlated agreement. The abstract does not provide the specific bounds. ### Source excerpt arXiv:2610.38862v1 Announce Type: cross Abstract: Local Coordinate-wise Linear (LCL) properties, introduced by Levi, Mosheiff, and Shagrithaya (2025), capture coding-theoretic properties such as list decoding and list recovery. They showed that every LCL property has the same rate threshold for random linear codes (RLC) and random Reed--Solomon codes (RRS). Brakensiek, Chen, Dhar, and Zhang (2025) extended this to random additive codes. Thus any property of all subspace design codes holds for RLCs and RRS at the same rate. In this work, we improve the probabilistic guarantees in the RRS local equivalence theorem and extend the equivalence to all known subspace design constructions individually. Each such construction, including folded Reed--Solomon codes, has the same LCL threshold as RLC and RRS codes. We apply these results to alphabet-size bounds for curve decoding. Curve decoding, introduced by Goyal and Guruswami (2025) and Carmon et al. (2026), is a row-span-constrained LCL property implying proximity gaps (PG), correlated agreement (CA), and mutual correlated agreement (MCA), relevant to IOPs and SNARKs. Informally, a rate-$R$ code $C \subset \mathbb{F}^n$ is $(\ell,\delta,a,b)$-curve decodable if any degree-$\ell$ curve $u:\mathbb{F}\to\mathbb{F}^n$ that is $\delta$-close to $C$ on at least $a$ points has at least $b\leq a$ nearby codewords lying on a degree-$\ell$ curve in $C$. Goyal and Guruswami (2025) and Goyal, Guruswami, Sun, and Wootters (2026) established curve decodability for RLC and RRS codes at radius $\delta$ approaching $1-R$, but with large alphabets in $\ell$ and $\eta:=1-R-\delta$. Using our improved LCL equivalence and rank-sensitive counting inspired by Goyal and Guruswami (2026), we exponentially improve alphabet requirements while matching the best known values of $(a,b)$. For $\ell=O(1)$, our alphabet-size bounds match the best known for list decoding, and improves results for PG, CA, and MCA. ## Blog: Falco 0.45.2: security updates and a look back at 0.45.1 DevFeed: [Blog: Falco 0.45.2: security updates and a look back at 0.45.1]() Original publisher: [Read original article]() Published: 2026-10-30T00:00:00Z Content type: release Language: en Sources: [Falco]() Topics: [Falco](), [Security](), [container images](), [Prometheus]() Tags: [announcement](), [blog](), [buster](), [ca](), [certificate](), [certificates](), [change](), [changes](), [clients](), [community](), [compatibility](), [compromise](), [container](), [crash](), [custom](), [debian](), [falco](), [release](), [security](), [security-updates](), [updates]() ### AI overview Falco 0.45.2 updates CA trust stores in its Wolfi and Debian images and driver-loader images to address the eMudhra intermediate CA compromise; DEB/RPM users and deployments with custom CA bundles must update those separately. It also includes Falcoctl 0.14.3, container plugin 0.7.6, and OpenSSL 3.5.9 LTS. OpenSSL's default TLS security level is now 2, requiring RSA, DSA, and DH keys of at least 2048 bits and elliptic-curve keys of at least 224 bits; weaker legacy HTTPS endpoints may fail to connect. The release includes 0.45.1 reliability fixes for a Prometheus scrape race, file output recovery with keep_alive (the failed alert is not replayed), reloads when watched files disappear, and package installation on hosts without modern eBPF support. Separately deployed Falcosidekick needs its own update to 2.35.1 for trust and Go security updates. Helm chart 9.2.2 defaults to Falco 0.45.2 and related component versions; review explicit image or plugin version pins. ### Source excerpt Hey Falco community, Falco 0.45.2 is available! This patch brings certificate trust updates and newer security dependencies, alongside the reliability fixes delivered in 0.45.1. Since we did not publish a separate announcement for 0.45.1, let's catch up on both releases here. If you are running 0.45.0 or 0.45.1, we recommend upgrading to 0.45.2. And if you are heading to KubeCon in Salt Lake City, we would love to meet you there! The main focus of 0.45.2 is the response to the eMudhra intermediate CA compromise. Clients that still trust the affected certificate chains can accept certificates used to impersonate HTTPS services. Updating the trust stores used by those clients is part of addressing that risk. We refreshed the CA trust stores in both the default Wolfi and Debian Falco images, along with the driver-loader images. The Buster driver loader remains available, with its trust store corrected as well. The release also bundles Falcoctl 0.14.3 and the container plugin 0.7.6, incorporating upstream Go security updates. See the packaging changes for details. For installations using DEB or RPM packages, please apply your distribution's CA certificate updates too. If your deployment supplies a custom CA bundle, make sure that bundle is updated as well. We also updated the bundled OpenSSL to 3.5.9 LTS. There is a compatibility change to keep in mind: its default TLS security level is now 2. RSA, DSA, and DH keys must be at least 2048 bits, and elliptic-curve keys at least 224 bits. Check legacy HTTPS endpoints before upgrading, since weaker keys or parameters can cause TLS connections to fail. The OpenSSL update includes the details. The fixes from 0.45.1 are included too. They address several problems that can interrupt a running Falco deployment or make upgrades harder: Prometheus metrics: fixed a race that could crash Falco when a metrics scrape overlapped with event processing. Details. File output: with keep_alive: true, Falco now reports a failed write and atte ## Java News Roundup: JDK 28 Schedule, Oracle CPUs, eMudhra Certs, Apache POI, WildFly, Azul, BellSoft DevFeed: [Java News Roundup: JDK 28 Schedule, Oracle CPUs, eMudhra Certs, Apache POI, WildFly, Azul, BellSoft]() Original publisher: [Read original article]() Author: Michael Redlich Published: 2026-10-26T14:35:00Z Content type: news Language: en Sources: [InfoQ]() Topics: [Java](), [openjdk](), [open liberty](), [Jakarta EE](), [enterprise certificate authority certificates](), [Quarkus]() Tags: [2026](), [apache](), [apache-poi](), [architecture-design](), [azul](), [bellsoft](), [beta](), [breach](), [ca](), [certificates](), [cpus](), [critical](), [development](), [emudhra](), [features](), [highlighting](), [java](), [java-news-roundup-oct19-2026](), [jboss-wildfly](), [jdk](), [jdk-28](), [jobrunr](), [micronaut](), [news](), [open-jdk](), [open-liberty](), [oracle](), [schedule](), [security-vulnerabilities]() ### AI overview The roundup reports an October 2026 eMudhra certificate authority breach alongside Java updates and framework releases. Mozilla says eight intermediate CA private keys were compromised, potentially enabling website or service impersonation; major trust stores blocked the affected certificates, and Azul shipped an out-of-cycle Zulu update because Java does not check certificate revocation by default. Oracle and BellSoft also issued CPU updates, with BellSoft additionally listing PSU releases. JDK 28 build 21 is available, and a proposed schedule targets general availability on March 9, 2027, pending review. WildFly 42 adds virtual-thread support for Jakarta Concurrency and configurable principal transformation. Apache POI 6.0 requires JDK 17 and uses cached formula values by default. Open Liberty's beta adds workload identity and JWK rotation for generated JWTs, configurable quiesce timeout, and a preview HTTP transport. Micronaut 5.2.3 resolves 10 CVEs; JobRunr 9.0.2 includes fixes and two features. ### Source excerpt This week's Java roundup for October 19th, 2026, features news highlighting: the proposed release schedule for JDK 28; the eMudhra Intermediate CA certificates breach; the October 2026 Critical Patch Update; Azul and BellSoft CPUs; GA releases of WildFly 42 and Apache POI 6.0; the beta release of Open Liberty 26.0.0.11; and maintenance releases of Micronaut and JobRunr. By Michael Redlich ## Python 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18 are out DevFeed: [Python 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18 are out]() Original publisher: [Read original article]() Author: Anne Barela Published: 2026-10-26T14:16:55Z Content type: news Language: en Sources: [Adafruit Industries]() Topics: [Python](), [releases](), [pip]() Tags: [blog](), [ca](), [emudhra](), [intermediate](), [keys](), [module](), [pip](), [python](), [python-3-13](), [python-3-15](), [releases](), [security](), [ssl]() ### AI overview Python issued expedited security releases for versions 3.15 through 3.11 to address compromised eMudhra intermediate CA keys. The ssl module now blocks those keys as a last-resort safeguard. The announcement says normal pip use, including upgrading pip, remains safe from attacks using the compromised keys even before pip is updated. Versions 3.15.2 and 3.14.10 have binary installers; 3.13.18, 3.12.16, and 3.11.18 are source-only security releases. The release team recommends upgrading users of affected versions. ### Source excerpt Hugo van Kemenade announced expedited security releases of Python on the Python Insider blog, covering 3.15, 3.14, 3.13, 3.12 and 3.11. The releases address the compromised eMudhra intermediate CA keys. Those keys are now blocked by the ssl module as a last resort against their use. Normal uses of pip, including upgrading pip itself, are [...] ## CVE-2026-115693 - Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney DevFeed: [CVE-2026-115693 - Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney]() Original publisher: [Read original article]() Author: cvefeed.io Published: 2026-10-26T13:49:29Z Content type: news Language: en Sources: [Latest High/Critical Vulnerabilitiy Feed]() Topics: [trust](), [certificates](), [SSL]() Tags: [2026](), [anchor](), [benoitc](), [ca](), [callback](), [certificate](), [certificate-authority](), [critical](), [custom](), [cve](), [cve-2026-115693](), [hackney](), [otp](), [pinned](), [ssl](), [store](), [trust](), [validation](), [vulnerability]() ### AI overview In hackney versions 1.24.0 through before 4.9.0, setting `cacerts` or `cacertfile` did not reliably restrict TLS trust to a pinned private CA. hackney's `partial_chain` callback could select a certificate chaining to a bundled certifi root as the trust anchor, and OTP honored that callback over the configured trust store. As a result, an on-path attacker could impersonate a server pinned to a private CA if they had a publicly trusted certificate for the pinned hostname; hostname verification still applies. ### Source excerpt CVE ID :CVE-2026-115693 Published : Oct. 26, 2026, 1:49 p.m. | 14 minutes ago Description :Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds {partial_chain, fun hackney_ssl:partial_chain/1} to every verify_peer configuration. The callback returns any certificate in the peer chain whose public key matches a root in the bundled certifi store as the trust anchor, and OTP honours that callback over the configured cacerts. hackney_ssl:merge_ssl_opts/3 kept the callback when the caller replaced the trust store with cacerts or cacertfile in ssl_options, so a connection pinned to a private CA still accepted any chain that carried a publicly trusted root. The hostname check still applies, so the attacker needs a publicly trusted certificate for the pinned hostname. This issue affects hackney: from 1.24.0 before 4.9.0. Severity: 9.1 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more... ## Python 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18 are out DevFeed: [Python 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18 are out]() Original publisher: [Read original article]() Author: Hugo van Kemenade Published: 2026-10-26T00:00:00Z Content type: release Language: en Sources: [Python Insider]() Topics: [releases](), [Python](), [pip]() Tags: [2-9-0](), [all](), [attacks](), [based](), [ca](), [changelog](), [cleanup](), [condition](), [consider](), [content](), [contributions](), [cookies](), [cve](), [emudhra](), [intermediate](), [keys](), [python](), [python-3-15](), [releases](), [security]() ### AI overview Five expedited Python security releases block compromised eMudhra intermediate CA keys in the `ssl` module; the source says normal `pip` use, including upgrading `pip`, is safe from attacks based on those keys even before `pip` is updated. All five releases also reject destination-replacing links in `tarfile.tar_filter` and cookies with negative versions in `http.cookiejar`. Python 3.13.18, 3.12.16 and 3.11.18 additionally update bundled Expat, change default handling of `mimetypes.knownfiles` on Windows, and fix a header refolding edge case; 3.13.18 and 3.12.16 also fix a `TemporaryDirectory` cleanup race. Binary installers are available for 3.15.2 and 3.14.10; the other three are source-only. The release notice recommends upgrading affected versions. ### Source excerpt Five expedited security releases to distrust the compromised eMudhra intermediate CA keys. ## CA shutdown puts Java, containers, and security appliances in the certificate crosshairs DevFeed: [CA shutdown puts Java, containers, and security appliances in the certificate crosshairs]() Original publisher: [Read original article]() Author: Gyana Swain Published: 2026-10-23T10:44:57Z Content type: news Language: en Sources: [InfoWorld]() Topics: [enterprise certificate authority certificates](), [certificates](), [Security](), [Certificate Transparency]() Tags: [appliances](), [browser-security](), [browser-security-java-security-software-development](), [ca](), [certificate](), [certificate-authorities](), [certificate-authority](), [certificates](), [compromise](), [containers](), [data-sovereignty](), [java](), [language-en](), [pki](), [private-keys](), [sectigo](), [security](), [services](), [shutdown](), [software-development](), [ssl-tls](), [storytype-news](), [trust]() ### AI overview After private keys for eight intermediate CAs were compromised, eMudhra is exiting the global SSL/TLS certificate business and offering free Sectigo replacements. It says its G1 roots and certificate revocation/status services will remain supported during the transition; CertiNext users can request replacements in their accounts, while others can contact support. Analysts caution that relying on G1 as a bridge should have a firm end date and migration plan, and recommend inventorying CA chains, cross-signing, revocation, and browser trust. Replacing website certificates may not fix separate trust stores in Java, containers, appliances, mutual TLS, and other systems. Azul says Java does not check revocation by default; its updated Azul Zulu and Prime builds block the affected certificates. Google said Chrome Root Store removal of the signing root was expected October 27, and warned operators with chains to that root to install new TLS certificates. ### Source excerpt A certificate authority's decision to abandon the global SSL/TLS market is exposing a weakness many organizations rarely examine: their dependence on complex PKI trust chains. Following the compromise of private keys behind eight of its intermediate certificate authorities, eMudhra is exiting the global SSL/TLS certificate business and is offering customers Sectigo-issued replacements. However, analysts warn that enterprises may discover they have only limited visibility into the certificate hierarchies underpinning critical services. The company's board decided "to voluntarily withdraw from the global SSL/TLS certificate business," eMudhra said in a press note. It added that data sovereignty and compliance requirements had increased the business's complexity and cost. "The level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS's place in our business," eMudhra Chairman V Srinivasan said in the announcement. The company said it will contact affected customers to replace certificates free of cost. It also said it will keep revocation and certificate status services running until every issued certificate has expired or been replaced. Sectigo offered as an alternative In the customer update, eMudhra said it is making Sectigo-issued certificates available to all its customers. "Our G1 root certificates remain active and continue to be fully supported," the company said in the update. The October 22 release said the G1 RSA roots "will continue to serve customers until this transition is complete." eMudhra said it would provide replacement certificates free of charge through its partners and continue operating revocation and certificate-status services until all certificates it issued had expired or been replaced. CertiNext users can request Sectigo certificates through their accounts; other customers can contact eMudhra support, the statement added. Niyati Daftary, principal analyst at Gartner, said organization ## eMudhra quits global TLS certificate market after compromise of CA signing keys DevFeed: [eMudhra quits global TLS certificate market after compromise of CA signing keys]() Original publisher: [Read original article]() Author: Gyana Swain Published: 2026-10-23T10:27:24Z Content type: news Language: en Sources: [Computerworld]() Topics: [certificates](), [TLS (Transport Layer Security)](), [Certificate Transparency](), [enterprise certificate authority certificates](), [trust](), [digital sovereignty]() Tags: [browser-security](), [browser-security-browsers-security](), [browsers](), [ca](), [certificate](), [certificate-authorities](), [certificates](), [compliance](), [compromise](), [cost](), [critical](), [customer](), [data-sovereignty](), [digital-trust](), [edition-us](), [emudhra](), [g1](), [gartner](), [global](), [incident](), [keys](), [language-en](), [organizations](), [private-keys](), [security](), [storytype-news](), [tls]() ### AI overview eMudhra is exiting the global SSL/TLS certificate business after private keys for eight intermediate CAs were compromised. It offers customers free Sectigo-issued replacement certificates and says it will maintain revocation and certificate-status services until its issued certificates expire or are replaced. CertiNext users can request replacements in their accounts; other customers can contact support. eMudhra says its G1 RSA roots remain active during the transition, but analysts describe them as a possible bridge and urge migration of critical services to an independent, trusted CA. Google said removal of the affected emSign root from Chrome's trust store was expected October 27; sites chaining to it must replace certificates to avoid breakage. Separate fixes may be needed in Java and other systems with their own trust stores: Azul updated its JDK builds to block the eight certificates, while Java does not check revocation by default. The excerpt characterizes residual risk as limited and targeted, and notes that some organizations may not know where certificate trust decisions occur. ### Source excerpt Indian digital trust company eMudhra has announced that it is exiting the global SSL/TLS certificate business and is offering customers certificates issued by Sectigo as an alternative, following the compromise of private keys behind eight of its intermediate certificate authorities. The company's board decided "to voluntarily withdraw from the global SSL/TLS certificate business," eMudhra said in a press note. It added that data sovereignty and compliance requirements had increased the business's complexity and cost. "The level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS's place in our business," eMudhra Chairman V Srinivasan said in the announcement. The company said it will contact affected customers to replace certificates free of cost. It also said it will keep revocation and certificate status services running until every issued certificate has expired or been replaced. Sectigo offered as an alternative In the customer update, eMudhra said it is making Sectigo-issued certificates available to all its customers. "Our G1 root certificates remain active and continue to be fully supported," the company said in the update. The October 22 release said the G1 RSA roots "will continue to serve customers until this transition is complete." eMudhra said it would provide replacement certificates free of charge through its partners and continue operating revocation and certificate-status services until all certificates it issued had expired or been replaced. CertiNext users can request Sectigo certificates through their accounts; other customers can contact eMudhra support, the statement added. Niyati Daftary, principal analyst at Gartner, said organizations should view the G1 roots "as a possible bridge, not automatically as the final destination." "With the company exiting global SSL/TLS and its remaining roots still subject to browser scrutiny, the prudent course is to move critical services to an indepen ## POI Recommendation with LLM-Augmented Multi-Graph Learning and Contrastive Alignment DevFeed: [POI Recommendation with LLM-Augmented Multi-Graph Learning and Contrastive Alignment]() Original publisher: [Read original article]() Author: Burak Tamer, Wolfram H\\"opken, Zehui Wang, Thomas Bayer Published: 2026-10-23T04:00:00Z Content type: article Language: en Sources: [arXiv: Machine Learning]() Topics: [recommendation systems](), [Neural Network](), [Embeddings](), [Representation learning](), [Large Language Model]() Tags: [ablation](), [about](), [abstract](), [aggregate](), [alignment](), [all](), [arxiv](), [based](), [better](), [business](), [ca](), [can](), [cold-start-problem](), [cross](), [cs-ir](), [cs-lg](), [dataset](), [graph](), [learning](), [llm](), [recommendation](), [with]() ### AI overview LLM-MGCL adds semantic and geographic item graphs to a LightGCN backbone to address sparse interaction data in point-of-interest recommendation. It builds the semantic graph from sentence embeddings of LLM-generated photo summaries and keywords, and the geographic graph from Haversine distances between businesses. Embeddings are propagated over all three graphs, fused additively, then aligned with bidirectional InfoNCE contrastive learning. On the Yelp Multimodal Recommendation Dataset, it improves Recall@20 by 48.5% and NDCG@20 by 59.0% over LightGCN, but trails SGL slightly in aggregate. It has the highest recall for cold and warm items, while SGL performs better for popular items. Ablations identify cross-view contrastive alignment as the main driver of aggregate gains. ### Source excerpt arXiv:2608.16407v2 Announce Type: replace-cross Abstract: Point-of-interest (POI) recommendation models based on graph neural networks achieve strong performance by propagating collaborative signals over user-item interactions, yet they struggle with the cold-start problem, where items with few or no interactions are not represented. In this paper, we propose LLM-augmented Multi-Graph Contrastive Learning (LLM-MGCL), a multi-graph neural network that uses semantic and spatial information about items to extend the LightGCN backbone with two auxiliary item-item graphs: a semantic graph constructed from sentence embeddings of LLM-generated photo summaries and keywords, and a geographic graph derived from Haversine distances between business locations. Item embeddings are propagated over all three graphs in parallel, fused additively, and aligned across views through a bidirectional InfoNCE contrastive objective that connects behavioral, semantic, and spatial representations of the same items. Experiments on the Yelp Multimodal Recommendation Dataset show that LLM-MGCL outperforms classical collaborative filtering, matrix factorization, and non-contrastive graph neural network baselines. It improves Recall@20 by 48.5% and NDCG@20 by 59.0% over LightGCN, while trailing the strongest contrastive baseline, Self-supervised Graph Learning (SGL), slightly in aggregate. A popularity-stratified evaluation shows that LLM-MGCL achieves the highest recall on cold and warm items, whereas SGL remains better on popular items. An ablation study reveals that the cross-view contrastive alignment (CA) is the primary driver of the aggregate gains. Our results suggest that externally grounded, LLM-derived item knowledge can partially compensate for missing collaborative signal and mitigate the item cold-start problem in POI recommendation. ## New Release: Tails 7.15.1 DevFeed: [New Release: Tails 7.15.1]() Original publisher: [Read original article]() Author: tails Published: 2026-10-23T00:00:00Z Content type: release Language: en Sources: [Tor Project]() Topics: [releases](), [Release notes](), [certificates](), [tor]() Tags: [2026](), [applications](), [attack](), [automatic](), [blocks](), [browser](), [ca](), [certificate](), [certificate-authorities](), [certificate-authority](), [certificates](), [changes](), [cve](), [debian](), [download](), [emergency](), [emudhra](), [release](), [releases](), [tails](), [tails-7]() ### AI overview Tails 7.15.1 is an emergency release that blocks compromised eMudhra certificates. It updates Tor Browser to 15.0.26, which fixes CVE-2026-113470, and updates certificate authorities used by other applications through Debian's `ca-certificates` package. The release says a compromised intermediate certificate could let an attacker impersonate websites over HTTPS; it identifies Tor exit nodes, their internet service providers, or governments as potential attackers. Onion sites are not vulnerable, and the release says it is unaware of exit nodes using the attack so far. Automatic upgrades are available from Tails 7.0 or later. Installing on a new USB stick instead of upgrading erases its Persistent Storage. ### Source excerpt This release is an emergency release to remove a compromised certificate authority. Changes and updates Update Tor Browser to 15.0.26, which fixes CVE-2026-113470. On October 17, Mozilla blocked the certificates of eMudhra, a certificate authority that had its intermediate certificates compromised. Tor Browser 15.0.26 now blocks all eMudhra certificates as well. Using one of the compromised intermediate certificates, an attacker could impersonate any website, even if the connection is secured with HTTPS. This attack could be performed by a Tor exit node, the Internet service provider of an exit node, or a government. Onion sites are not vulnerable. We are not aware of this attack being used by exit nodes so far. Update the certificate authorities to block all eMudhra certificates in other applications. In addition to Tor Browser , other applications rely on the certificate authorities included in Tails with the ca-certificates Debian package to secure their connections. Get Tails 7.15.1 To upgrade your Tails USB stick and keep your Persistent Storage Automatic upgrades are available from Tails 7.0 or later to 7.15.1. If you cannot do an automatic upgrade or if Tails fails to start after an automatic upgrade, please try to do a manual upgrade. To install Tails 7.15.1 on a new USB stick Follow our installation instructions. The Persistent Storage on the USB stick will be lost if you install instead of upgrading. To download only If you don't need installation or upgrade instructions, you can download Tails 7.15.1 directly: For USB sticks (USB image) For DVDs and virtual machines (ISO image) Support and feedback For support and feedback, visit the Support section on the Tails website. tails releases ## EMudhra Intermediate CA Certificates Compromised DevFeed: [EMudhra Intermediate CA Certificates Compromised]() Original publisher: [Read original article]() Author: Unit 42 Published: 2026-10-22T17:15:32Z Content type: article Language: en Sources: [Unit 42]() Topics: [certificates](), [Cryptography](), [TLS (Transport Layer Security)](), [interception](), [network security](), [Secrets Management](), [Threat monitoring](), [Security](), [Certificate Transparency](), [principle of ephemerality]() Tags: [000](), [acme](), [actions](), [adversary](), [all](), [allows](), [also](), [analysis](), [ca](), [certificates](), [compromise](), [cryptographic](), [emudhra](), [high-profile-threats](), [interception](), [intermediate](), [keys](), [malware](), [mitm](), [pki](), [private](), [private-keys](), [risk](), [tls](), [unit-42]() ### AI overview Eight eMudhra intermediate CA private keys were compromised after a certificate-generation defect produced insufficient randomness, potentially allowing attackers to derive the keys, issue unauthorized TLS certificates, and intercept or impersonate traffic. eMudhra revoked the eight certificates, and browser and OS vendors moved to revoke or distrust the intermediates. The guidance calls for identifying certificates and trust anchors tied to the affected CAs, reissuing affected certificates through another trusted CA, updating trust stores, and enforcing CRL and OCSP checks. It also recommends reviewing network, authentication, and identity logs for signs of interception or session replay, monitoring Certificate Transparency logs, restricting issuers with CAA records, and hardening automated certificate lifecycle management. Palo Alto Networks describes its Next-Gen Trust Security solution as supporting lifecycle management and emergency response; the text does not establish that it prevents this specific compromise. ### Source excerpt Eight compromised eMudhra intermediate CA private keys risk unauthorized TLS signing and MitM interception. Read our analysis and containment guide. The post EMudhra Intermediate CA Certificates Compromised appeared first on Unit 42. ## October 2026 Security Updates #3 for XCP-ng 8.3 LTS DevFeed: [October 2026 Security Updates #3 for XCP-ng 8.3 LTS]() Original publisher: [Read original article]() Author: David Morel Published: 2026-10-22T16:12:50Z Content type: release Language: en Sources: [XCP-ng]() Topics: [Security](), [releases]() Tags: [2026](), [ca](), [certificates](), [compromise](), [emudhra](), [intermediate](), [keys](), [lts](), [man-in-the-middle](), [mozilla](), [october](), [october-2026](), [package](), [private-keys](), [security](), [security-updates](), [store](), [traffic](), [trust](), [update](), [updates]() ### AI overview XCP-ng 8.3's updated `ca-certificates` package removes two eMudhra intermediate certificates from the trust store after their private keys were reported compromised. The previous package version trusted them; an attacker positioned for a man-in-the-middle attack could use the certificates to impersonate websites and read or modify traffic. The update is `ca-certificates-2021.2.50-73.2.xcpng8.3`, replacing `ca-certificates-2021.2.50-73.1.xcpng8.3`; the notice recommends installing it as soon as your schedule permits. ### Source excerpt New security and maintenance updates are available for XCP-ng 8.3 LTS. This updates the ca-certificates package to remove comprised CA intermediate. ## eMudhra CA compromise: eight private keys, and one of them is 4 DevFeed: [eMudhra CA compromise: eight private keys, and one of them is 4]() Original publisher: [Read original article]() Author: Jorian Woltjer Published: 2026-10-22T11:53:00Z Content type: article Language: en Sources: [Aikido Security's Blog]() Topics: [Secrets Management](), [enterprise certificate authority certificates](), [Security Attacks](), [Cryptography](), [Container Image Building]() Tags: [alpine](), [apple](), [browsers](), [ca](), [certificate-transparency](), [chrome](), [ci](), [compromise](), [container](), [container-images](), [containers](), [curl](), [emudhra](), [emudhra-ca-compromise](), [how-to](), [keys](), [private](), [private-keys](), [threats](), [vulnerabilities]() ### AI overview The article reports that eight eMudhra intermediate CA private keys were recoverable from their public certificates, each requiring at most 256 guesses; one key was 4. Browser and platform vendors blocked the certificates through revocation updates, but many command-line clients, servers, containers, runtimes and IoT devices may still trust them because they do not check revocation or carry stale CA bundles. The article says forged certificates require an attacker to be on the network path, and clients enforcing certificate transparency could not have been targeted; it does not establish whether attackers used the keys. Recommended steps are to update OS and browser software, install the distribution- and runtime-specific CA updates, rebuild images and restart services, and test affected clients for SSL failure. Bundled trust stores and built-in macOS command-line tools may need separate fixes. Aikido says its image checks flag affected bundled and system certificate stores separately. ### Source excerpt Eight eMudhra CA keys could be guessed in at most 256 tries, and one is just the number 4. Who is affected, why curl lagged browsers, and how to fix it. Category: Vulnerabilities & Threats ## Compromised eMudhra intermediate certificates DevFeed: [Compromised eMudhra intermediate certificates]() Original publisher: [Read original article]() Author: Cisco Talos Published: 2026-10-21T20:43:29Z Content type: news Language: en Sources: [Cisco Talos Blog]() Topics: [certificates](), [enterprise certificate authority certificates](), [Secrets Management](), [Certificate Transparency](), [Virtual Private Network](), [CI/CD]() Tags: [2025](), [2026](), [ca](), [certificate-authority](), [certificate-revocation](), [certificate-transparency](), [certificates](), [chrome](), [ci-cd](), [cisco](), [cisco-talos](), [cisco-talos-network-intrusion-prevention](), [cisco-talos-web-filtering](), [cloud-native-ecosystem](), [container](), [cve](), [docker](), [embedded-systems](), [emudhra](), [enterprise-infrastructure](), [entropy](), [intermediate](), [threat-advisory]() ### AI overview A flaw in eMudhra's April 30, 2025 key-generation process produced weak P-384 keys that were used in eight intermediate CA certificates: six for TLS and two for code signing. An attacker with a compromised private key could issue fraudulent certificates, potentially enabling server impersonation and traffic interception where clients still trust the key and protections do not block it. Chrome, Mozilla, Apple, and Microsoft have blocked affected certificates; eMudhra revoked them and stopped issuing under its G3 root. Because some applications use separate or embedded trust stores and may ignore revocation, the source recommends updating TLS-using software and trust stores as vendor fixes become available. Go versions 1.27.3 and 1.26.10 filter chains containing the affected SPKI hashes. Talos reported no related malicious incidents observed as of October 21, 2026. ### Source excerpt Cisco Talos is aware of eight intermediate certificates belonging to the intermediate certificate authority, eMudhra. ## eMudhra Intermediate CA Compromise DevFeed: [eMudhra Intermediate CA Compromise]() Original publisher: [Read original article]() Author: Chris Swan Published: 2026-10-21T17:30:00Z Content type: news Language: en Sources: [InfoQ]() Topics: [Security Attacks](), [Cryptography](), [Secrets Management]() Tags: [algorithms](), [architecture-design](), [auth](), [breach](), [browsers](), [ca](), [certificates](), [client](), [devops](), [ecc](), [emudhra](), [emudhra-ca-compromise](), [entropy](), [exposed](), [forge](), [intermediate](), [keys](), [mtls](), [news](), [private](), [private-keys](), [root](), [security](), [security-incident](), [software](), [systems](), [web]() ### AI overview Eight eMudhra intermediate CA private keys were compromised after appearing to be generated with very low entropy: each consisted of zeros except for a final byte. The text reports no evidence of an eMudhra breach. The certificates covered TLS and code signing; browsers used targeted revocation blocklists, while many other systems lack intermediate-CA filtering, prompting projects to remove the emSign ECC Root CA - G3 and disrupting legitimate certificates chained to it. Updated root stores reduce exposure, but updates take time to propagate and unpatched or end-of-life systems remain vulnerable. Forged certificates could enable site impersonation and, where WebPKI roots are trusted for client authentication, mTLS access. The article also notes that CAA checks can be bypassed by forgers and that certificate transparency could help detect forged certificates, though broader adoption is limited. ### Source excerpt Private keys for eight eMudhra intermediate CA certificates have been compromised, allowing attackers to forge certificates for any site. The keys were revealed due to low entropy, not through a known breach. Browsers blocked them using revocation lists, but other software had to remove the emSign ECC G3 root. Unpatched systems remain exposed to forged certificates, including client auth and mTLS. By Chris Swan ## Check if eMudhra CA Is Still Trusted in Your Runtime DevFeed: [Check if eMudhra CA Is Still Trusted in Your Runtime]() Original publisher: [Read original article]() Author: SitePoint Team Published: 2026-10-21T15:41:41Z Content type: tutorial Language: en Sources: [SitePoint]() Topics: [trust](), [Test automation](), [Node.js]() Tags: [2](), [2026](), [3](), [all](), [alpine](), [audit](), [ca](), [cas](), [conf](), [emudhra](), [intermediate](), [programming](), [reading](), [runtime](), [runtimes](), [store](), [test](), [trust](), [update](), [using](), [web-security](), [zip]() ### AI overview The text reports that eight eMudhra intermediate CA private keys were recoverable from their public certificates, enabling forged TLS certificates to be accepted by clients that still trust the chains. It says major browsers have blocked the intermediates, while many non-browser clients lack active revocation checks and may remain exposed. Test each outbound-TLS runtime against the incident's per-intermediate endpoints, checking both eMudhra and Sectigo cross-signed paths; a successful connection indicates trust, while a certificate verification error indicates rejection. Confirm failures are not caused by network or DNS problems. The text also recommends verifying the supplied chains.zip hash, checking chains offline against system and bundled CA stores, updating relevant CA packages and language bundles, rebuilding containers and CI images, and automating checks. Store behavior varies: Python urllib uses system roots while requests commonly uses certifi; Node.js depends on build configuration; Go uses system roots; Rust depends on rustls/webpki-roots versus native-tls. It notes macOS system tools may need separate attention from Homebrew tools. ### Source excerpt Audit runtimes for the eight compromised eMudhra intermediate CAs using the official per-chain test endpoints and chains.zip, then update every trust store. Continue reading Check if eMudhra CA Is Still Trusted in Your Runtime on SitePoint. ## eMudhra security blunder left trusted CA signing keys exposed to anyone DevFeed: [eMudhra security blunder left trusted CA signing keys exposed to anyone]() Original publisher: [Read original article]() Author: Sinisa Markovic Published: 2026-10-21T14:11:24Z Content type: news Language: en Sources: [Help Net Security]() Topics: [certificates](), [Security](), [TLS (Transport Layer Security)](), [Cryptography](), [enterprise certificate authority certificates]() Tags: [apple](), [ca](), [certificates](), [emudhra](), [exposed](), [google](), [mozilla](), [news](), [private-keys](), [security](), [signing]() ### AI overview Eight eMudhra intermediate certificates had private keys with values below 256, recoverable from the public certificates in under a second. A faulty script created weaker duplicate keys during an April 2025 key ceremony, and staff selected them because their labels resembled the correctly generated keys. The certificates included six for TLS and two for code signing; Sectigo cross-signed all eight. Browsers blocked them, eMudhra revoked them, and Mozilla removed trust in the signing root; Google said it would do the same while reviewing eMudhra's remaining CA certificate. eMudhra said only one intermediate entered production and none issued customer certificates, but estimated about 30,000 customer certificates need replacement. The report says it is unknown whether the keys were recovered or used before disclosure. Apps, servers, and devices without reliable revocation updates may still trust affected certificates; the cited advice is to update browsers and operating systems and for administrators to update certificate lists. ### Source excerpt Eight intermediate certificates issued by Indian certificate authority eMudhra were secured with private keys so weak that anyone could recover them from the public certificates in under a second. On its website, the company highlights that it has issued more than 60 million digital certificates. A security researcher known as Wayne discovered the flaw on October 17 while running a check against the Common CA Database (CCADB). To prove the keys were compromised, he signed ... More -> The post eMudhra security blunder left trusted CA signing keys exposed to anyone appeared first on Help Net Security. ## Browsers Block eMudhra Intermediate CAs Over Recoverable Private Keys DevFeed: [Browsers Block eMudhra Intermediate CAs Over Recoverable Private Keys]() Original publisher: [Read original article]() Author: Ionut Arghire Published: 2026-10-21T11:22:05Z Content type: news Language: en Sources: [SecurityWeek]() Topics: [private key](), [Cryptography](), [Secrets Management]() Tags: [block](), [browsers](), [ca](), [certificate](), [certificate-authority](), [certificates](), [emudhra](), [intermediate](), [private-keys](), [risk-management]() ### AI overview Eight eMudhra intermediate CA certificates issued in April 2025 were compromised after a key-generation script produced weak keys that were mistakenly used in certificate signing requests. Mozilla and Google blocked them on October 17, Apple on October 19, and Microsoft on October 20; eMudhra revoked them, Sectigo took revocation steps, and Cloudflare patched its services. Mozilla's Dennis Jackson said the keys could be recovered near instantly using the baby-step giant-step discrete log algorithm, and published a tool to check whether clients still trust the certificates. CT logs show no apparent evidence of malicious use before revocation, but not all clients enforce CT, and some may need software updates to remove trust. eMudhra said it was investigating process and code flaws and planned to reverify its key ceremonies. ### Source excerpt The private keys associated with eight certificates were compromised, and root programs and trust stores are blocking them. The post Browsers Block eMudhra Intermediate CAs Over Recoverable Private Keys appeared first on SecurityWeek. ## Manifold-Informed Neural Networks for Low-Label ECG Electrolyte Inference DevFeed: [Manifold-Informed Neural Networks for Low-Label ECG Electrolyte Inference]() Original publisher: [Read original article]() Author: Juntang Wang, Hao Wu, Yihan Wang, Dongmian Zou, Shixin Xu Published: 2026-10-21T04:00:00Z Content type: article Language: en Sources: [arXiv: Machine Learning]() Topics: [Artificial Intelligence](), [Neural Network](), [Deep learning](), [graph theory]() Tags: [abstract](), [arxiv](), [best](), [branch](), [but](), [ca](), [class](), [classification](), [cs-lg](), [data](), [ecg](), [energy](), [feature](), [features](), [form](), [foundation](), [foundation-models](), [inference](), [networks](), [neural](), [neural-networks]() ### AI overview MINN replaces the known-physics residual used by physics-informed neural networks with a learned-source Poisson residual on a k-nearest-neighbor graph in latent space. Its source uses input features and auxiliary metadata to relax the homogeneous smoothness prior; gated Feature-wise Linear Modulation also fuses metadata into predictions. In three-class electrolyte classification from 12-lead MIMIC-IV-ECG signals, MINN achieved potassium Macro-F1 of 0.61 versus 0.55 for the best of twelve baselines, with reported gains for calcium and magnesium and a 31% relative improvement at 1% labeled data. Six ablations attribute the gain to the inhomogeneous Poisson formulation rather than graph smoothing alone. ### Source excerpt arXiv:2610.28322v1 Announce Type: new Abstract: Physics-informed neural networks (PINNs) supervise on the residual of a known differential operator. Many high-stakes inference problems admit no such operator: clinical signals, behavioral measurements, materials properties. We introduce the Manifold-Informed Neural Network (MINN), a PINN-parallel paradigm that replaces the physics operator residual with a manifold operator residual: a discrete Poisson equation $\mathbf{L}_G \mathbf{H} = s_\phi(\mathbf{x}, \mathbf{m})$ on a $k$-nearest-neighbor graph in the learned latent space, with a learned, task-aware source. The construction is a structural parallel to PINNs (squared operator residual plus label data, in place of operator residual plus boundary data); the $s{=}0$ limit recovers the homogeneous Laplace equation $\mathbf{L}_G\mathbf{H}=\mathbf{0}$ (classical manifold regularization solves the same equation but minimizes the Dirichlet energy $\operatorname{tr}(\mathbf{H}^\top\mathbf{L}_G\mathbf{H})$, a different penalty form). The source $s_\phi$ takes input features and auxiliary metadata directly, breaking the homogeneous smoothness prior that limits classical Laplacian penalties; gated Feature-wise Linear Modulation separately fuses metadata into the prediction branch. We evaluate MINN on three-class classification of potassium, calcium, and magnesium from 12-lead ECGs in MIMIC-IV-ECG, against twelve baselines spanning supervised and tabular methods, ECG foundation models, and manifold/graph approaches. MINN attains the highest K$^+$ Macro-F1 of 0.61 (best baseline 0.55), with consistent gains on Ca$^{2+}$ and Mg$^{2+}$ and a 31% relative improvement at 1% labeled data. Six targeted ablations show that the inhomogeneous Poisson formulation, not graph smoothing alone, drives the gain. ## TxnQA: Benchmarking Analytical Reasoning and Evidence Grounding over Transaction Event Sequences DevFeed: [TxnQA: Benchmarking Analytical Reasoning and Evidence Grounding over Transaction Event Sequences]() Original publisher: [Read original article]() Author: Rabimba Karanjai, Yiming Bian, Yun-Shiuan Chuang, Jenna L. Ballard, Zijie Pan, Shivani Shekhar, Yixi Li, Yirou Ge, Avinash Thangali, Richard Williamson, Linsey Pang, Prakhar Mehrotra Published: 2026-10-21T04:00:00Z Content type: article Language: en Sources: [arXiv: Machine Learning]() Topics: [Artificial Intelligence](), [llm-reasoning](), [Temporal data](), [Ground truth / benchmark quality]() Tags: [abstract](), [aggregation](), [arithmetic](), [arxiv](), [benchmark](), [benchmarking](), [benchmarks](), [bottlenecks](), [but](), [ca](), [compliance](), [conditional](), [content](), [cs-ai](), [cs-cl](), [cs-lg](), [data](), [event](), [grounding](), [over](), [reasoning](), [sequences](), [transaction]() ### AI overview TxnQA evaluates analytical question answering over transaction event sequences with 27 task families, 81 templates, and a five-scenario fraud-risk suite using synthetic, privacy-mitigated data and programmatically computed answers. Its metrics separate format-following rate, conditional content accuracy, and end-to-end correctness. In the reported evaluation, LoRA adaptation improved schema compliance but did not remove arithmetic bottlenecks: Gemma-4-31B-IT and Qwen3-8B reached E2E scores of 0.867 and 0.816, while the evaluated MoE checkpoints scored 0.632-0.713. On 500 fraud cases, verdict accuracy often exceeded 80%, but accuracy requiring both the verdict and exact evidence attribution was at most about 23%, pointing to evidence grounding as a distinct challenge. ### Source excerpt arXiv:2610.27256v1 Announce Type: cross Abstract: Analyzing merchant transaction histories requires dynamic temporal filtering, entity resolution, and aggregation over irregular event streams--operations poorly captured by static tabular or time-series forecasting benchmarks. We introduce TxnQA, an analytical QA benchmark comprising 27 task families (81 templates) alongside a 5-scenario fraud-risk reasoning suite that evaluates both verdicts and supporting evidence over synthetic, privacy-mitigated transaction data. Ground-truth answers are computed programmatically, and model performance is decomposed into format-following rate (FFR), conditional content accuracy (CA), and end-to-end correctness (E2E). Evaluating prompted proprietary baselines and six LoRA-adapted open-weight models shows that adaptation reliably enforces output schemas but leaves arithmetic bottlenecks: Gemma-4-31B-IT and Qwen3-8B attain E2E scores of 0.867 and 0.816, whereas evaluated MoE checkpoints reach only 0.632-0.713. Furthermore, on the 500-instance fraud suite, verdict accuracy frequently exceeds 80%, yet joint accuracy (requiring exact evidence attribution) collapses to at most ~23%. These findings identify schema compliance, semantic calculation, and evidence attribution as three distinct bottlenecks in transaction-sequence QA. [Next page]()