NIST Releases Final IR 8547 Establishing Definitive Post-Quantum Cryptography Transition Timeline and Deprecation Schedules

quantumcomputingreport.com Oct 28, 2026

NIST Releases Final IR 8547 Establishing Definitive Post-Quantum Cryptography Transition Timeline and Deprecation Schedules

Curated by Shubham · TechCapsules · Oct 28, 2026

AI-summarised brief · reviewed before publication

The National Institute of Standards and Technology released NIST IR 8547, a definitive roadmap for migrating federal and commercial systems from classical public‑key cryptography to post‑quantum cryptography (PQC). Authored by senior members of the Computer Security Division, the document translates Executive Order 14412 and OMB Memorandum M‑26‑15 into binding deadlines: all high‑value federal assets must adopt PQC for key establishment by 31 December 2030 and for digital signatures by 31 December 2031. Classical algorithms are slated for deprecation after 2030 and a total ban after 2035. The roadmap endorses hybrid schemes in FIPS 140 validations, updates SP 800‑56C and SP 800‑227, and triggers enterprise‑level tooling, exemplified by IBM’s new “Quantum Safe” suite, to automate compliance and manage cryptographic inventories.

💡 Why It Matters

· By fixing hard dates for PQC adoption, NIST forces organizations to confront “harvest‑now, decrypt‑later” threats before quantum computers become capable of breaking today’s encryption.

Read full article on quantumcomputingreport.com

“This is a serious incident” – Kingdom Come: Deliverance developer Warhorse suffers…

Warhorse Studios, the Czech developer behind Kingdom Come: Deliverance, announced on Thursday that it has been hit by a “serious” cyberattack. The studio released a statement at 11 a.m. GMT apologizing to players and confirming that it has engaged cybersecurity specialists to contain the breach and assess its full impact. CEO Martin Frývaldský told a Czech news outlet that the priority is to secure systems, protect employees, partners and the community, and allocate all necessary resources to the response. Warhorse, which is developing a high‑profile open‑world Middle‑Earth RPG based on Tolkien’s works and a new Kingdom Come adventure—presumed to be a sequel—has not provided further updates since the initial notice.

💡 The attack threatens the development timeline of two highly anticipated titles, potentially delaying releases that could shape the studio’s future market position.

thehackernews.com · Oct 27

GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption

The GoAhead embedded web server’s TLS implementation failed to enforce certificate revocation when using the OpenSSL backend with mutual‑TLS. Although a revocation list could be loaded, the server never enabled checking, allowing revoked client certificates to authenticate successfully. The flaw affects builds that require client certificates, a trusted CA bundle, issuer checking, and a configured revocation list; Mbed TLS builds are unaffected. GoAhead 6.1.1, released to manufacturers on August 2 2026 and publicly on October 12, patches the issue. Discovered by Sébastien Féry of FoxIO, the vulnerability is tracked as CVE‑2026‑115881 with a vendor‑assigned severity of 9.1. Fix deployment depends on each device maker updating firmware, and no exploitation has been reported. Routers, printers and controllers could remain exposed until updates arrive firmware.

💡 Hundreds of millions of network‑critical devices could stay insecure for months, giving attackers a stealthy path to hijack management interfaces.

thequantuminsider.com · Oct 27

Guest Post: The Next Threat to Encryption May Not Need a Quantum…

Researchers warn that advances in artificial intelligence could make previously theoretical attacks on public‑key cryptography practical, threatening online payment systems. OpenAI announced on 26 October 2026 that its AI disproved the Exponential Time Hypothesis, a long‑standing conjecture about the inherent difficulty of certain computational problems, suggesting new algorithms may avoid exponential growth. While the breakthrough does not instantly break encryption, it shows that mathematical methods, not only quantum computers, might weaken asymmetric schemes. Earlier in July 2026, Anthropic‑assisted researchers demonstrated a faster attack on the signature scheme HAWK, recovering a secret key in a test version after about 60 hours of AI compute. The episode underscores concerns that AI‑driven research could accelerate the discovery of vulnerabilities in both classical and post‑quantum cryptographic protocols.

💡 If AI can routinely uncover shortcuts in hard mathematical problems, the timeline for breaking today’s encryption could shrink dramatically, forcing a rapid shift to newer, AI‑resistant schemes.

thehackernews.com · Oct 27

Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth…

Ukraine’s CERT-UA warned that attackers exploited Dahua IP cameras by brute‑forcing predictable serial numbers and leveraging weak passwords or firmware flaws (CVE‑2021‑33044/45). The attacks used the Easy4IP P2P platform, allowing remote access to video streams, device configuration, and creation of third‑party accounts. Over 14,500 cameras were compromised, with nearly 2,000 infected devices receiving a persistent backdoor account that survives password changes and factory resets. The incident mirrors broader campaigns targeting Ukrainian and European surveillance equipment.

💡 The breach exposes a widespread vulnerability in consumer‑grade security cameras, enabling covert surveillance and data exfiltration on a national scale. It underscores the urgent need for manufacturers to secure default credentials and update firmware to protect critical infrastructure.

thehackernews.com · Oct 27

CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution

The U.S. Cybersecurity and Infrastructure Security Agency confirmed that two recently patched PHP2Shell vulnerabilities, each rated 9.2 on CVSS, are actively exploited, adding them to its Known Exploited Vulnerabilities catalog. Detection lead Adel Karimi reported successful remote code execution on honeypots on October 24, 2026, producing an 800 KiB cookie dump and a function address used in the payload. PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 were patched on October 21, 2026, with federal agencies given until October 29 to update. The flaws affect over 32.5 million PHP services worldwide, prompting advisories from vendors and governments.

💡 The confirmed exploitation underscores the urgency for immediate patching across the vast PHP ecosystem, where millions of sites remain vulnerable. Rapid response is critical to prevent widespread compromise and data loss.

gamesradar.com · Oct 27

Sony reportedly investigating as PS5 users report hackers posing as children being…

Sony is investigating a security flaw affecting PlayStation 5 users, where hackers add unauthorized “child” accounts to PlayStation Network profiles. The exploit bypasses passwords and two‑factor authentication, allowing attackers to view personal data and make purchases with linked payment methods. Affected users report difficulty removing these child accounts, as Sony’s family‑management system only permits removal of adult members. The issue has been reported mainly in Japan but is not limited to that region. Sony urges users to review family settings and enable two‑factor authentication.

💡 The breach exposes a critical gap in Sony’s account protection, enabling unauthorized financial activity and data access. It underscores the need for robust family‑account controls to prevent similar exploits.