A Stalled DTLS Handshake Could Make OpenSSL Send Heap Memory in Plaintext
OpenSSL fixed a high-severity DTLS flaw that can expose heap memory in plaintext. The condition is narrow, but every branch analysed in the advisory is affected.
Rob Nidschelm
Tech tinkerer who spends too much time with home labs and Docker stacks. Into AI, Roman & Medieval history, and all things sci-fi. Avid traveller, reader and writer, with a passion for good food.
Google Cloud Fixed Three Workflow Flaws That Could Reach Its Own Systems
Google disclosed three Application Integration flaws on 28 September. Its managed service was patched in June, and customers have no update to install. The questions now concern trust boundaries and what customer-side logs can show.
NeedyMantis Is Hiding Behind Poedit, curl, Vim and TightVNC
Microsoft found NeedyMantis hiding beside legitimate software in targeted intrusions. The real hunt starts before the backdoor appears.
Researchers Read a Linux Root Hash With Spectre Defences Still On
Branch Target Reuse recovered a Linux root hash on Intel test systems, exposing a local JIT weakness that Linux updates now target.
Securing the Alert Box Is No Longer Enough Under the FCC’s New Cyber Rules
The FCC's EAS cybersecurity rule reaches beyond alert encoders to studio transmitter links and remotely managed equipment in the programming path. Three targeted controls apply from 29 September.
A Real ChatGPT Page Led Users Into a Fake Verification Trap
An attacker-built Custom GPT used a real ChatGPT page to lead people to a fake check on Google Sites. The practical boundary is the instruction to run code outside the browser.
DIVD Says Its Intruder’s AI Agent Left a Trail Investigators Could Follow
An intruder's automated decisions left DIVD investigators useful clues. That does not establish how much damage was done.
A Patched MCP Client Can Still Send Its Secret to the Wrong Server
A fixed MCP Python SDK release is only part of the repair for unattended OAuth clients. Pin the issuer, rebind saved registrations and assess possible credential exposure.
DC’s Public Health Reports Carried Hidden Data on Nearly 400,000 People
A public summary can still carry private records. DC's Medicaid agency says two website reports contained hidden beneficiary information potentially reachable between 2023 and July 2026.
A Nexus Upgrade Can Corrupt the Configuration a Reboot Will Not Restore
Cisco warns that specific Nexus 3000 and 9000 NX-OS upgrade and downgrade paths can corrupt switch configuration. Check the exact release pair before maintenance because a normal reload or rollback will not repair the damage.