Threat Source Newsletter (April 1, 2021)

Summary: Cisco Talos reported that OpenSSL disclosed and patched a denial-of-service vulnerability that could let an attacker trigger a null pointer dereference and crash a targeted server with a specially crafted request, and also fixed a separate flaw that could stop apps from detecting and rejecting unsigned TLS certificates. Talos also noted Cisco patched multiple Jabber vulnerabilities affecting mobile, MacOS and Windows versions that could allow arbitrary code execution with elevated privileges, sensitive information access, traffic interception or denial of service, requiring the attacker to authenticate to an XMPP server and send XMPP messages to the target.
Why it matters: OpenSSL is described as one of the most popular software libraries on the internet, so a crash-the-server flaw in it reaches far beyond any single vendor's patch cycle. For Jabber, an attacker needs only one of the disclosed vulnerabilities plus valid XMPP credentials to potentially execute code with elevated privileges on the underlying operating system.

Read the original at Cisco Talos ↗

Topics: Supply Chain & AppSec
Related: Kitesurf is now open source Cyber Risks · Nov 13, 2026
Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026
ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026