Project
OpenSSL is an open-source toolkit implementing TLS/SSL and general-purpose cryptography, providing the libssl/libcrypto libraries and a command-line tool.
Cohere signed a letter of intent on Oct. 15 to buy Prague-based Aisle, an AI security startup with about 50 staff. Cohere's stated reason is a sovereign platform for customers.
Perspective Coverage
5 publishersReality
Receive Segment Coalescing on Windows Server breaks about half of connections that carry X25519MLKEM768 in the ClientHello, BookMyHost reports. Phones hit it first and web server logs stay clean, but the evidence is one NIC and driver pair.
Reality
cert-manager v1.21.2 renewed a same-key CA with a truncated SHA-256 Subject Key Identifier where v1.18.6 had issued a SHA-1 one. In a lab run, OpenSSL 3.0.13 verified a pre-renewal leaf only while the old CA stayed in the trust store.
Reality
Anthropic's Claude flagged more than 29,000 candidate open source vulnerabilities in six months, and upstream projects have patched 516 of them. Maintainers praise the reports, but each fix still ships only as fast as the project that tests and releases it.
Reality
Anthropic expects more than 90% of the unreviewed vulnerability reports its new OSS Scanner sends to open source maintainers to be real. Opt-in projects get findings faster and take on the work of catching the errors, such as wrong severity ratings.
Perspective Coverage
6 publishersReality
Django 6.1 raised its default PBKDF2 iteration count from 1.2M to 1.5M, adding about 50 to 90ms of CPU per login in a dev.to benchmark. The same tests show each stored hash rewritten on its owner's next login, including hashes deliberately set stronger than the new default.
Reality
TECH VEDA counts 36 actionable device CVEs across 14 non-kernel packages in September, two of them Chromium V8 bugs on CISA's exploited list. How many apply to a given fleet depends on each image's SBOM and on which scorer a team trusts.
Reality
Python shipped 3.10.22 as the final release of the 3.10 series, with eight CVE fixes and no security updates after it. Any flaw reported from here on stays open on 3.10, so teams still running it have to move to a series that is still patched.
Reality
OpenSSL patched 14 flaws, led by CVE-2026-84782, a CVSS 8.2 DTLS handshake bug that lets an unauthenticated remote peer pull fragments of heap memory. Only software that speaks DTLS is exposed, so VPN, VoIP and IoT products go first in the patch queue.
Perspective Coverage
4 publishersReality
Public certificate authorities have capped TLS certificates at 200 days since 15 March 2026, falling to 47 days in March 2029. Renewal at that pace has to run unattended, and its failures show up only in the certificate a visitor's browser receives.
Reality
The 18.6 notes say a dump and restore is not required, then hand over three security entries that change defaults. Old pgcrypto messages stop decrypting by design, and third-party logical decoding plugins stop loading.
Reality
The five options that decide which private key opens a client certificate lived in a struct libcurl's connection-reuse check never reads, so two handles sharing a pool could share one authenticated connection. Commit 7541ae5 moves them.
Reality
Linux distributions backport security fixes without moving the version number, so an unauthenticated scan can only report that a host might be vulnerable. The figures in one dev.to post put the median time to patch at 32 days.
Reality
A dev.to write-up walks through a 37-finding scan on a still-supported enterprise Linux box and shows why only the vendor advisory for that exact package on that exact minor release can settle it.
Reality
Microsoft rated 114 of the 973 Critical, but 284 score 8.0 or higher and two Important-severity Windows bugs are already under attack. One 9.1 advisory in the same cycle came from outside Microsoft.
Reality
A WordPress plugin author implemented Web Push against VAPID and ES256 in a few hundred lines of PHP with OpenSSL. The crypto took an afternoon; the week went to a missing 0x04 byte, a wrong JWT audience and DER-encoded signatures.
Reality
Upgrading a Node 26 binary also upgrades the TLS library, the bundled HTTP client and the package manager. The 26.8.2 changelog names OpenSSL 3.5.8, undici 8.10.2 and npm 11.19.1 among its dependency commits.
Reality
The LTS patch also carries OpenSSL 3.5.8, six semver-minor additions including a faster net.BlockList, and three FIPS entries filed under one pull request, so the regression run costs more than a version bump usually does.
Reality
A developer dumped the ClientHello that openssl sends and found the requested hostname in plain ASCII inside the server_name extension. A listener holding no private key read it back off the wire, TLS 1.3 included.
Reality
His case against inventory-first discovery is mechanically sound and commercially interested. The essay never says how much smaller a use-based scope would be, which is the figure a budget actually needs.
Reality