OpenSSL Patch to Plug Severe Security Holes
Summary: The OpenSSL project said it planned to release new versions of its code on Thursday, March 19, to fix a number of security weaknesses, including some rated "high" severity, with no advance details shared beyond major operating system vendors. OpenSSL is used by thousands of companies to encrypt communications, including Facebook, Google, Yahoo and broadly across U.S. federal government networks, and the update was partly the product of a post-Heartbleed funding spike that gave the foundation four full-time maintainers.
Why it matters: Security updates to open-source code like OpenSSL hand cybercriminals a road map to where the fixed vulnerabilities lie, which is why the project's founding partner Steve Marquess described a "pretty brutal policy of no [advance] disclosure" - even support contract holders get no notice. The fixes come from a team of four full-time people maintaining software that encrypts traffic for Web giants and federal networks alike.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026