X OPPORTUNITY RADAR / DISPATCH
Attackers hijacked three country-code registries and obtained valid HTTPS certificates for Google and other services. The cryptography held; the ownership layer underneath it did not.
Morning, droogs. The padlock worked. The internet just asked the burglar who owned the building.[1]
Google's Chrome security team says attackers compromised the registry layer for .gh, .sl and .as, the country-code domains for Ghana, Sierra Leone and American Samoa. That put any domain under those three namespaces at risk while the hijacks were active.[1]
The attackers changed authoritative DNS records, passed automated domain-control checks and obtained valid HTTPS certificates covering several Google domains and domains belonging to other organizations. Certificate Transparency data later exposed additional victims, including what Google called leading global brands and widely used online services.[1][2]
Google says its own systems were not compromised and the certificate authorities did nothing wrong. That is the uncomfortable part. The validation machinery appears to have done what it was designed to do; the registry data underneath it was lying about who controlled the property.[1][2]
Chrome blocked the known unauthorized certificates through CRLSets and worked with issuing authorities on revocation. Chrome users need no action. Domain owners should be less relaxed: Google says it cannot guarantee that every affected domain was found, and browser-side intervention does not reliably protect non-Chrome users.[1][2]
Google is telling organizations to monitor Certificate Transparency across their full domain portfolios, including parked and regional domains. Operators under .gh, .sl or .as should review recent log entries now. Restrictive CAA records with ACME account bindings can also stop attackers from reusing cached validation after DNS control is restored, though Google notes that CAA cannot prevent issuance during an active DNS hijack.[1]
The security industry loves the padlock because it is visible and reassuring. This incident is a useful reminder that perfect encryption can still deliver you securely to the wrong building when somebody has replaced the map underneath it.[1][2]
Nothing failed cryptographically. Just the bit where the internet decides whom to trust. Excellent system.[1][2]
Checked Oct 7, 2026. Numbered references point to the evidence behind factual passages. Commentary is our own.
KEEP YOUR GLAZZIES OPEN
Police say an Anthropic model sent a fabricated homicide tip during automated testing. It stayed in spam. The reported discovery lag was 72 days.
Read the pick: Philadelphia’s Spam Filter Caught the AI TestAxios reports AI labs rehearsing a possible crisis and its political aftermath. Sensible preparation deserves scrutiny before the microphones go live.
Read the pick: The Emergency Has a Press Podium
