OpenSSL merges five low-severity fixes ahead of December releases
Fixes are in the public GitHub repository; packaged releases are scheduled for December 1, 2026.
Stories per day · 30 days
2 RSS
Relateddenial-of-service2http32qpack2quic-go2wireshark2aes-gcm-siv1classic-mceliece1cms1frodokem1ikev21ml-kem1openssl1post-quantum1
9 stories, newest first · one card per story
Stories tagged #quic
Study compares eight ways to carry large PQC KEMs in IKEv2
Across 126,500 handshakes, no design fully offsets key size, and Classic McEliece fails under hard loss.
QPACK flaws let one HTTP/3 connection exhaust server memory
Seven of ten tested stacks were vulnerable; quic-go, quiche, lsquic and Wireshark had fixes as of October 20, 2026.
QPACK flaws can crash HTTP/3 servers via memory amplification
FoxIO released PoCs; quic-go, quiche, lsquic, and Wireshark are patched, while Bun, h3, and aioquic were not.
USN-8861-1: OpenSSL vulnerabilities
Ubuntu patches two OpenSSL QUIC denial-of-service flaws that can exhaust CPU or memory.
USN-8847-1: OpenSSL vulnerabilities
Ubuntu warned of OpenSSL flaws that could cause denial of service or a timing side-channel leak.
Operation QUICSILVER Targets Myanmar Government and IT with QUICAgent Backdoor
Seqrite Labs details Operation QUICSILVER, a China-nexus espionage campaign targeting Myanmar government and IT with graduation-invite lures deploying QUICAgent backdoor.
4
DragonForce Hackers Abuse Microsoft Teams Relays to Hide Backdoor.Turn C2 Traffic
Symantec and Carbon Black found DragonForce-linked hackers using Backdoor.Turn, a Go RAT tunneling C2 through Microsoft Teams TURN relays via QUIC.
2
Microsoft Patch Tuesday for August 2026 Fixed a Zero
Microsoft's August 2026 Patch Tuesday fixes 398 CVEs, including an actively exploited WinSock zero-day CVE-2026-68820 and wormable DNS RCE CVE-2026-62878.