Certificate renewal · Announced testing date; production change scheduled
Test 64-day Let's Encrypt certificates from October 14
Announced October 7, 2026. Sources checked October 12, 2026.
The new notice brings a concrete test date for the previously announced 64-day default. New production issuance and renewals switch on February 10, with authorization reuse reduced to 10 days. Existing valid certificates will not be revoked as part of the transition.
Who it affects. Let's Encrypt subscribers using the default classic profile. The opt-in 45-day and six-day profiles are separate. This issuer schedule does not set private-PKI policy or the industry-wide maximum for public TLS certificates.
What remains uncertain. Your ACME client's renewal behavior still needs checking. Let's Encrypt recommends ARI, or renewal around two-thirds through the certificate's actual lifetime when ARI is unavailable. A validity period is not a recommended wait between renewals.
One next step. Have the certificate owner schedule a staging test from October 14 covering renewal timing and the deployment handoff. Keep staging certificates in test systems; they are not publicly trusted.
Publishing authentication · In effect
Plan the first use of new npm publishing trust
Announced October 2, 2026. Sources checked October 12, 2026.
npm now limits how long a newly configured trust relationship can remain unused. After 48 hours without a successful publish, it can no longer authorize publishing. This reduces exposure when a repository or project name changes ownership.
Who it affects. Maintainers setting up npm trusted publishing with supported hosted CI providers. The deadline belongs to an unvalidated configuration, not to every npm token or to a configuration already validated by a successful publish. Other valid configurations on a package remain usable.
What remains uncertain. The announcement does not establish your configuration's status. Changing the repository or project identity requires new trust; ordinary edits do not restart the window. Check npm's settings before relying on a configuration created in advance.
One next step. Have the release owner create the configuration when an intended release is ready, complete its first successful publish within 48 hours, and record validation. If it expired, follow npm's documented delete-and-recreate process.
Credential exposure · Confirmed advisory; fix available
Review password handling in AWS PowerShell automation
Announced October 9, 2026. Sources checked October 12, 2026.
AWS's advisory describes unredacted IAM user console passwords appearing in local output under certain conditions. People with access to the resulting logs or command history could recover them. The fixed 5.0.306 release dates to September 24; the disclosure is new this week.
Who it affects. AWS Tools for PowerShell V5 before 5.0.306. The repository advisory lists AWS.Tools.IdentityManagement, AWSPowerShell and AWSPowerShell.NetCore. AWS's interim workaround is to avoid -WhatIf and -Confirm on cmdlets with sensitive arguments in affected versions.
What remains uncertain. The advisory does not establish that your passwords were recorded or accessed. Updating the tool does not by itself resolve any disclosure in previously retained output; that requires an environment-specific assessment.
One next step. Ask the automation owner to check affected versions and password-handling jobs, coordinate the upgrade, and have the security owner assess retained output for exposure under the team's incident process. Do not copy passwords into tracking records.
Related
Where to go next
Integration credentials: GitHub tokens, npm tags, and Loom