Do Son TWCA announces emergency TWCA certificate revocation after researchers discovered non-compliant serial number entropy across ten intermediate CAs.
tls
Canonical fixes LXD vulnerability CVE-2026-112816 (CVSS 10) in LXD and MicroCloud, letting attackers impersonate trusted TLS clients. Update now.
FoxIO releases details and proof-of-concept code for three GoAhead TLS vulnerabilities, including a CVSS 9.1 revoked-certificate bypass. Patch to 6.1.1.
The emSign CA certificate was pulled from certifi. A new Python security release updates pip to block MITM risks. Upgrade pip and uv now.
Oracle Java security alert CVE-2026-91403 (CVSS 9.1) distrusts compromised eMudhra intermediate certificates in Java SE and GraalVM. Update now.
The Node.js security release fixes 10 flaws, including a Brotli remote code execution bug, CVE-2026-111497. Update to 26.12.1, 24.22.1 or 22.23.4.
Two critical RabbitMQ flaws allow authentication bypass. One forges TLS client certs; the other tricks OAuth2 JWKS to accept any JWT.
A widespread OpenSSL error handling flaw makes apt fail HTTPS in FIPS mode. A stale error queue entry gets misread as fatal. Audit your code.
Developers patched six severe wolfSSL security vulnerabilities, including an X.509 trust-chain bypass. Update embedded systems to protect against exploits.
A Haskell TLS vulnerability (CVE-2026-9648) lets attackers bypass X.509 NameConstraints to impersonate domains. Update crypton-x509-validation to 1.9.1.
May 13 Deadline: Let’s Encrypt launches 45-day certs, freezes mTLS, and moves to Gen Y intermediates. Is your automation ready for the triple-threat update?
Juju hits a perfect 10.0 CVSS score (CVE-2026-4370). A TLS flaw on port 17666 lets attackers hijack clusters. Update to 3.6.20 or 4.0.5 now!
Node.js releases critical updates for 20.x to 25.x, fixing high-severity flaws like the __proto__ header crash and TLS errors. Update to v25.8.2 now.
High-severity Rancher CLI flaw (CVE-2025-67601) exposes credentials via MitM attacks when using --skip-verify. Update or use -cacert immediately.
Log4j’s Security Blind Spot: New TLS Flaw Lets Attackers Intercept Sensitive Logs Despite Encryption
Log4j’s Security Blind Spot: New TLS Flaw Lets Attackers Intercept Sensitive Logs Despite Encryption
A new Log4j flaw (CVE-2025-68161) breaks TLS hostname verification, allowing Man-in-the-Middle attacks on log data. Upgrade to v2.25.3 now.
Microsoft revealed "Whisper Leak," a side-channel attack that infers AI chat topics from encrypted traffic (TLS) using packet size/timing patterns. High accuracy risk.
A UAF flaw in the Linux kernel TLS subsystem allows a low-privileged user to gain RCE by exploiting memory corruption during asynchronous decryption.
Citing competition and rising costs, the popular Certificate Authority Buypass has announced it will stop issuing TLS/SSL certificates in October 2025.
wolfSSL 5.8.2 patches four vulnerabilities, including a critical Apple trust store bypass (CVE-2025-7395) and predictable randomness after fork(), impacting secure communications.
Apache HTTP Server 2.4.64 patches 8 vulnerabilities, including HTTP Response Splitting, SSRF, DoS, and TLS desync attacks. Upgrade immediately!
The Opossum Attack is a new desynchronization flaw exploiting implicit/opportunistic TLS in protocols like HTTP, allowing MitM to compromise encrypted connections. Over 3M servers affected.
Hitachi Energy warns of 5 flaws in MicroSCADA X SYS600 (v10.0-10.6), including remote DoS, data leaks, and TLS MITM, risking power system control.