Juju hits a perfect 10.0 CVSS score (CVE-2026-4370). A TLS flaw on port 17666 lets attackers hijack clusters. Update to 3.6.20 or 4.0.5 now!

The Apache Log4j 2 ecosystem is facing a fresh wave of security concerns as four new vulnerabilities have been disclosed, highlighting critical flaws in how the library handles data sanitization a…

wolfSSL (CVE-2026-5194) faces a critical 9.3 CVSS flaw in ECDSA certificate validation. Attackers can bypass security and spoof trusted hosts. Audit today!

The OpenSSL Project has inaugurated a seminal update that profoundly reshapes both its internal architecture and its repertoire

Wireshark has undergone a monumental security refinement, with developers remediating over forty vulnerabilities. A subset of these defects

May 13 Deadline: Let’s Encrypt launches 45-day certs, freezes mTLS, and moves to Gen Y intermediates. Is your automation ready for the triple-threat update?

A Haskell TLS vulnerability (CVE-2026-9648) lets attackers bypass X.509 NameConstraints to impersonate domains. Update crypton-x509-validation to 1.9.1.

Four undici vulnerabilities (CVE-2026-6734, CVE-2026-9697) affect the Node.js HTTP client, which sees 133M weekly downloads. Update undici now.

TL;DR Developers patched six high-severity wolfSSL security vulnerabilities in the embedded SSL library. These flaws include an X.509 trust-chain bypass and dangerous heap buffer overflows. Admini…

TL;DR A Debian maintainer flagged a widespread OpenSSL error handling problem across the open-source ecosystem. It surfaced when apt failed HTTPS repository access on FIPS-only systems, then trace…

TL;DR RabbitMQ has patched two critical flaws that allow authentication bypass. One breaks TLS client-certificate checks. The other lets a network attacker forge OAuth2 token validation. Team Rabb…

TL;DR The Erlang/OTP team fixed five security flaws across the runtime and its TLS stack. The most serious lets a network attacker bypass server certificate checks entirely. The rest can crash a B…

TL;DR: Apache disclosed two Apache HttpClient TLS vulnerabilities in its HttpComponents Client library this month. The more severe, CVE-2026-71290, carries a CVSS score of 9.1 and lets an attacker…

Modern financial, banking, fintech, healthcare, and enterprise applications increasingly depend on APIs to exchange sensitive information…

TL;DR wolfSSL shipped version 5.9.4 on September 25, 2026, fixing 10 wolfSSL vulnerabilities. Three are rated High, and each lets a malicious peer bypass TLS authentication or forge certificates i…

Attackers Seize Three Country-Code Domains Google’s security team has reported a recent wave of registry hijacks. Attackers took over three top-level domains: .gh for Ghana, .sl for Sierra L…

TL;DR On October 21, 2026, the Node.js project shipped versions 22.23.4, 24.22.1 and 26.12.1 to fix 10 vulnerabilities. This Node.js security release patches four high-severity flaws, including a …

TL;DR Oracle has issued an out-of-band Oracle Java security alert for CVE-2026-91403, rated CVSS 9.1. The update distrusts intermediate CA certificates tied to the eMudhra compromise in Java SE an…

A security incident involving eMudhra intermediate certificates has forced the removal of the emSign CA certificate from popular trust bundles such as certifi. In response, the Python team pushed …

eMudhra will leave the global SSL/TLS certificate market after eight intermediate CA private keys were found easily guessable, prompting browser distrust actions.