RC4 in TLS is Broken: Now What? | Qualys
Summary: Researchers Nadhem AlFardan, Dan Bernstein, Kenny Paterson, Bertram Poettering and Jacob Schuldt announced new weaknesses in RC4 and new methods to exploit them, after RC4 usage had grown to roughly 50% of all TLS traffic as a workaround for the BEAST attack disclosed in 2011. The attack is not yet practical because it requires access to millions and possibly billions of copies of the same data encrypted under different keys, which would mean instrumenting a browser to make that many connections while a man in the middle records the traffic.
What you should know: Security teams are caught between two bad options: disabling RC4 reintroduces exposure to BEAST, which Qualys measured as affecting 18% of unique connections to SSL Labs, while keeping RC4 relies on an attack that researchers have a strong incentive to improve.
Read the original at Qualys Blog ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026