Security Now Examines Code-Signing Certificate Changes and MongoBleed

Summary

Steve Gibson questions shorter code-signing certificate lifetimes, reviews Python package index authentication improvements, and discusses a reported MongoDB information-disclosure exploit.

Key points

• Gibson says the maximum lifetime for newly issued code-signing certificates will fall from 39 to 15 months on March 1, 2026.
• He questions the security benefit of shorter lifetimes and argues that more frequent renewal could increase costs and encourage reliance on cloud signing providers.
• The discussion contrasts locally held hardware signing keys with cloud services that retain customers’ private keys and authenticate signing requests.
• The Python package index reported adding email confirmation for logins using TOTP, a phishable two-factor authentication method.
• The transcript describes a reported MongoDB exploit that can expose secrets and urges operators to patch internet-facing assets.