News

PostQuantum.com cites the ML-KEM key-recovery result in a piece on crypto-agility.

Four more OpenSSL CVEs: three in QUIC, one in the CMP client. Fixed in 4.0.3, 3.6.5, 3.5.9 and 3.4.8.

libspdm advisory DMTF-2026-0004: certificate chain validation did not check CA name and path-length constraints.

wolfSSL 5.9.4 credits two more of my reports: XMSS and LMS fixes, and sniffer and OCSP stapling fixes.

Preprint One Unverified Coordinate Is Enough on IACR ePrint: a general fault model for the ML-KEM rejection check.

Jinnuo Li uses a method similar to the one in ePrint 2026/1682 to recover Amoeba-576 keys in China’s next-generation cryptography competition.

Markku-Juhani O. Saarinen’s cryptanalysis tracker ngcc.dev describes the Amoeba flaw as a plaintext-checking primitive of the type developed in ePrint 2026/1682.

Mallory covers the pqc_kyber and cosmian_kyber key-recovery advisories.

Mallory runs a threat-intelligence story on the wolfSSL ML-KEM flaws, citing the preprint.

shattered.io covers the August OpenSSL bulletin in French, naming the CMS heap overflow I reported.

Cybersecurity News, GBHackers, Cyberpress and Open Source For You cover the August OpenSSL release, including the CMS heap overflow I reported.

Two Moderate OpenSSL CVEs: a heap overflow in CMS key unwrapping and an invalid pointer dereference in the CMP server.

PostQuantum.com covers the wolfSSL ML-KEM key-recovery finding.

Preprint Incomplete Ciphertext Comparison in ML-KEM on IACR ePrint: from an IND-CCA2 break in wolfSSL to key recovery.

CVE-2026-54876: client-side memory leak in OpenSSL OCSP response checking.

ImageMagick advisory: memory leak on invalid CLI options, fixed in 7.1.2-27.

wolfSSL CVE-2026-10097 (High): AVX2 ML-KEM-1024 decapsulation skipped the last 32 ciphertext bytes, enabling key recovery. The ARM64 NEON counterpart, CVE-2026-6330, was found independently by Nicholas Carlini of Anthropic and published the same day.

Three ImageMagick CVEs: SF3 encoder over-write, wand parser leak, NULL dereference in distort. Fixed in 7.1.2-25.

First three OpenSSL CVEs, in CMS password-based decryption and CRMF EncryptedValue handling.

Ten ImageMagick advisories in four days: encoders, distort, fx, the distributed pixel cache and an AES-CTR nonce reuse.

GraphicsMagick fixes a heap write overflow in DescribeImage, crediting my bug report and proposed solution.