Node.js Patches 16 Bugs, Including One That Can Leak TLS Private Keys From Memory
Node.js has shipped fixes for 16 security vulnerabilities across its 22.x, 24.x, and 26.x release lines, seven of them rated high severity. The most serious, a use-after-free triggered...
Three TLS Flaws in Widely Embedded GoAhead Web Server Undermine Certificate Trust on Millions of Devices
Researchers have disclosed three flaws in GoAhead, a lightweight web server embedded in routers, printers, industrial controllers, and networking gear from vendors including Palo Alto Networks, Siemens, and...
HollowByte: How 11 Bytes Can Quietly Starve an OpenSSL Server to Death
A newly disclosed OpenSSL weakness, dubbed HollowByte, lets an unauthenticated attacker trigger a slow, memory-fragmenting denial-of-service condition using a payload as small as 11 bytes. Because it was...
Let’s Encrypt Halts All Certificate Issuance After Cross-Signed Root Certificate Incident
Let's Encrypt temporarily suspended all certificate issuance on May 8, 2026, after engineers identified a critical issue with a cross-signed certificate linking its Generation X root to its...