Let's Encrypt will issue certificates valid for 64 days by default from February 10, 2027, down from 90, Help Net Security reported. Staging opens October 14, 2026, 119 days earlier, and 45-day defaults follow in 2028.
Perspective Coverage
3 publishers
- Builder
- Builder 20%
- Operator
- Operator 50%
- Investor
- Investor 30%
Reality
- Evidence85
- Adoption
- Insufficient
- Hype gap−5
- Incentives30
- Confidence82
Attackers who hijacked the operators of three country-code domains obtained HTTPS certificates for Google domains, Google disclosed. The company says the issuing CAs did nothing wrong, so its defence came after issuance, and it cannot promise it found every affected domain.
Perspective Coverage
8 publishers
- Builder
- Builder 24%
- Operator
- Operator 69%
- Investor
- Investor 7%
Reality
- Evidence70
- Adoption
- Insufficient
- Hype gap+15
- Incentives40
- Confidence68
buildOne report1 publisher GoodBarber now serves on-device web content in its iOS apps from https://secure.internal, through a WKWebsiteDataStore proxy API added in iOS 17. A fixed name gives the company's token issuer one origin to allowlist, where the old loopback server needed a wildcard that matched any port on the phone.
Reality
- Evidence55
- Adoption20
- Hype gap0
- Incentives30
- Confidence55
Russian banks moved to a state-run CA in August after GlobalSign mass-revoked its Russian customers' TLS certificates under May's US Treasury sanctions. Their customers now carry the problem, since Western browsers typically do not trust state-run CAs.
Reality
- Evidence35
- Adoption
- Insufficient
- Hype gap+10
- Incentives
- Insufficient
- Confidence35
buildConfirmed2 publishers Cloudflare has agreed to buy a GlobalSign root and applied to four browser root programs to become a public certificate authority. It has not issued a certificate yet, and its post-quantum certificates are aimed at Chrome's quantum-resistant root store in early 2027.
Reality
- Evidence55
- Adoption5
- Hype gap+20
- Incentives72
- Confidence60
Cloudflare plans to become a public certificate authority and issue post-quantum Merkle Tree Certificates from early 2027. Sites it fronts will manage both kinds from one system, so the planning work falls on old devices that will never add a new root.
Reality
- Evidence45
- Adoption5
- Hype gap+20
- Incentives55
- Confidence42
buildOne report1 publisher A guide rebuilding browser OIDC login off ingress-nginx keeps its Gateway and HTTPRoute objects intact and hands the 401-to-302 step to two Traefik middlewares. Swap the controller and that half gets rewritten.
Reality
- Evidence58
- Adoption15
- Hype gap−5
- Incentives20
- Confidence55
buildOne report1 publisher The ingress-to-pod hop needs one nginx annotation and a pod that can serve TLS; the database hop needs one client flag. Pod-to-pod is the hop the dev.to inventory can only close with a mesh, and that is where the money goes.
Reality
- Evidence52
- Adoption
- Insufficient
- Hype gap+15
- Incentives28
- Confidence55
Two tracked clusters hit Mexican, Ecuadorian and Brazilian targets with living-off-the-land tradecraft, numbered batch scripts and shared SOCKS5 relays. The AI tooling they left running is the part defenders can query for.
Reality
- Evidence66
- Adoption52
- Hype gap+18
- Incentives70
- Confidence57
The hijacker forged Hetzner as the origin so origin validation passed, held the prefix from Friday night into Sunday morning, and Softaculous has no logs of any of it because none of the diverted traffic reached its servers.
Perspective Coverage
6 publishers
- Builder
- Builder 31%
- Operator
- Operator 54%
- Investor
- Investor 15%
Reality
- Evidence80
- Adoption45
- Hype gap−15
- Incentives60
- Confidence72
buildOne report1 publisher The dangerous nginx bugs are the ones that emit no runtime signal at all, so the only artefact carrying the evidence is the config text itself. Stapling with no resolver in scope is the cleanest case of the class.
Reality
- Evidence70
- Adoption20
- Hype gap+8
- Incentives52
- Confidence62
buildOne report1 publisher A publicly trusted certificate issued for your domain and hosted elsewhere leaves one trace you can read for free: the Certificate Transparency entry the issuing CA had to create.
Reality
- Evidence58
- Adoption
- Insufficient
- Hype gap+12
- Incentives55
- Confidence52
buildOne report1 publisher Hubs Community Edition's bundled scripts archive the Postgres dump and the Reticulum file store. Everything between a bare host and a serving room is a rebuild you perform by hand.
Reality
- Evidence30
- Adoption
- Insufficient
- Hype gap+5
- Incentives60
- Confidence38