This week's Saturday Security Story is a reminder that even a trusted name in digital certificates can trip over the basics. DigiCert says a server migration left an internal business system exposed to the internet, and attackers walked right in. No zero-day, no nation-state wizardry. Just an overlooked system, loose permissions, and a problem nobody realized was serious until months later. The lock was fine. Somebody left the side door open. Highlights: - A server migration exposed an internal DigiCert business system to the internet - Attackers exploited a registration and access control flaw to reach archived customer records - Exposed data included names and contact details, and in some cases driver's licenses and passports - Unauthorized access happened between June 27th and July 2nd, 2026 - DigiCert didn't confirm customer data had been accessed until October 19th - The company says its certificate infrastructure and certificate issuance systems were never compromised - The takeaway: the biggest security failures often aren't sophisticated attacks, but overlooked systems and bad permissions Read more: The Register: https://www.theregister.com/security/2026/11/06/digicert-admits-16-month-security-lapse-exposed-customer-information/5308097 teiss: https://www.teiss.co.uk/news/digicert-discloses-breach-after-server-migration-error-exposed-customer-data-and-id-documents-18424 That's your Saturday Security Story for the week ending November 7th. I'm Peter. You know what to do. Like, sub and share, and stay secure out there.
