Update your 'secure' file transfer software.

To ruin your day a new vulnerability has been found in a type of file transfer software that will allow someone to retrieve your private key just by checking your 60 public signatures. Those signatures can be obtained from a compromised computer, or simply by reading your signed Git commit. The latter does not require any special access, just patience and time.

The vulnerability applies to a number of programs including PuTTY, Filezilla, WinSCP, TortoiseGit and TortoiseSVN for sure, and others are potentially vulnerable as well. You can check the exact version as well as the official CVE on Bleeping Computer., or just update because there's a good chance you don't have the latest version. The flaw comes from the fact that these programs generate a temporary unique cryptographic number during connection, which is biased enough to spread your private key with enough instances.

Seeing as how these programs aren't used by your average user, but by sysadmins and people moving sensitive data, that's pretty bad. Here's hoping tomorrow doesn't bring anything worse!