A Stalled DTLS Handshake Could Make OpenSSL Send Heap Memory in Plaintext
OpenSSL fixed a high-severity DTLS flaw that can expose heap memory in plaintext. The condition is narrow, but every branch analysed in the advisory is affected.
Rob Nidschelm
Tech tinkerer who spends too much time with home labs and Docker stacks. Into AI, Roman & Medieval history, and all things sci-fi. Avid traveller, reader and writer, with a passion for good food.
Google Cloud Fixed Three Workflow Flaws That Could Reach Its Own Systems
Google’s three September disclosures concerned provider-side fixes already applied in June. A dated update also covers later SubWorkflow and AuthConfig notices and the separate changes to workflow identities.
NeedyMantis Is Hiding Behind Poedit, curl, Vim and TightVNC
Microsoft found NeedyMantis hiding beside legitimate software in targeted intrusions. The real hunt starts before the backdoor appears.
Researchers Read a Linux Root Hash With Spectre Defences Still On
Branch Target Reuse recovered a Linux root hash on Intel test systems, exposing a local JIT weakness that Linux updates now target.
Securing the Alert Box Is No Longer Enough Under the FCC’s New Cyber Rules
The FCC's EAS cybersecurity rule reaches beyond alert encoders to studio transmitter links and remotely managed equipment in the programming path. Three targeted controls apply from 29 September.
A Real ChatGPT Page Led Users Into a Fake Verification Trap
An attacker-built Custom GPT used a real ChatGPT page to lead people to a fake check on Google Sites. The practical boundary is the instruction to run code outside the browser.
DIVD’s Intrusion Trail Did Not Settle the Damage
Preserve the sequence, verify the installed build and keep preliminary exposure findings separate from confirmed losses.
Test MCP Trust
An installation record is not an acceptance test. Check what the running application does, and keep the evidence usable for the next shift.
DC’s Public Health Reports Carried Hidden Data on Nearly 400,000 People
A public summary can still carry private records. DC's Medicaid agency says two website reports contained hidden beneficiary information potentially reachable between 2023 and July 2026.
A Nexus Upgrade Can Corrupt the Configuration a Reboot Will Not Restore
Cisco warns that specific Nexus 3000 and 9000 NX-OS upgrade and downgrade paths can corrupt switch configuration. Check the exact release pair before maintenance because a normal reload or rollback will not repair the damage.