InfoSecBulletin Cybersecurity for mankind
Security researchers found that three unauthorized TLS certificates were issued in May 2025 for 1.1.1.1, the public DNS service operated by Cloudflare.
Improperly issued certificates by the Fina RDC 2020 authority could let attackers intercept and decrypt DNS queries, revealing users’ browsing habits.
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
Contract and server dispute brought down Bangladesh’s digital payment
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
However, if a malicious or unauthorized party holds a valid certificate, they can impersonate the domain and carry out what is known as an “adversary-in-the-middle” attack.
Fina RDC 2020 certificates were automatically trusted on Windows and Microsoft Edge because they are linked to the Fina Root CA.
The root certificate belongs to Microsoft’s Root Certificate Program. Major browsers like Google Chrome and Mozilla Firefox, along with Apple’s Safari, do not trust Fina. Therefore, only users of Windows and Edge were at risk.
Cloudflare confirmed that it did not request or authorize the issuance of these certificates. “Upon seeing the report on the certificate-transparency email list, we immediately kicked off an investigation and reached out to Fina, Microsoft, and Fina’s TSP supervisory body,” said a Cloudflare spokesperson.
“These parties can mitigate the issue by revoking the trust in Fina or revoking the mis-issued certificates. We also want to reassure users that our WARP VPN service was not affected.”
Microsoft indicated it has already “engaged the certificate authority to request immediate action” and plans to block the rogue certificates by adding them to its disallowed certificate list.
The company did not explain how the certificates evaded detection for four months, despite their creation in May.
This situation shows a serious flaw in the internet’s certificate system, where the failure of one certificate authority can affect the trust that millions depend upon.
Hacker accessed Brazil’s Real-Time Payment System: Attempted grabing $130M
