We’re Tracking the Future of Security

Category: World

  • Cloudflare Announces Public Certificate Authority for Post-Quantum TLS

    Cloudflare Announces Public Certificate Authority for Post-Quantum TLS

    Cloudflare has announced plans to operate a public certificate authority capable of issuing both conventional and post-quantum digital certificates. The company says the service is intended to help website operators prepare public key infrastructure for future cryptographic threats without waiting for a separate migration project.

    The program targets the certificate layer

    Post-quantum TLS requires more than changing the key exchange used during a connection. Certificate signatures, issuance workflows, validation software and hardware security modules also need compatible algorithms and operational controls. Cloudflare said its authority will support standards-based certificates as browser and ecosystem requirements mature.

    The company already uses post-quantum key agreement on parts of its network, but a public certificate authority introduces a different trust role. Certificate issuance requires audited identity validation, key protection, revocation services, public logging and browser-root program acceptance.

    Deployment must follow ecosystem readiness

    Organizations should inventory certificate lifetimes, automation dependencies, TLS inspection devices and embedded clients before adopting new signature schemes. Larger keys and signatures can affect constrained devices and network paths. Hybrid testing and rollback plans remain essential while standards and client support evolve. SectechMedia follows related controls in its cybersecurity coverage.

    Sources

  • OpenSSL Patches High-Severity DTLS Flaw That Can Expose Server Memory

    OpenSSL Patches High-Severity DTLS Flaw That Can Expose Server Memory

    The OpenSSL project has fixed a high-severity vulnerability in its Datagram Transport Layer Security implementation that can disclose portions of server memory. CVE-2026-84782 affects applications using DTLS listening functionality and may expose data before a peer has been authenticated.

    An invalid cookie could trigger an oversized response

    According to the project advisory, a server processing a malformed ClientHello with an invalid cookie could calculate the length of its HelloVerifyRequest incorrectly. The resulting message could include uninitialized heap memory and transmit it without encryption. OpenSSL said the issue primarily affects DTLS servers built around BIO_s_datagram and DTLSv1_listen.

    The project released corrected versions across supported branches, including OpenSSL 3.0.22, 3.3.7, 3.4.5, 3.5.5 and 3.6.1. Distribution advisories from Ubuntu and Debian provide package-level guidance for affected systems.

    Operators need an application-level inventory

    Teams should identify services that actually use DTLS server-listening functions, not assume every installed OpenSSL package has the same exposure. Internet-facing gateways, communications systems and embedded services deserve priority. After upgrading, operators should restart dependent processes and verify the loaded library version. SectechMedia follows related risks in its cybersecurity coverage.

    Sources

  • Microsoft Says Star Blizzard Used Fake Event Invitations to Deliver CosmicPulse Backdoor

    Microsoft Says Star Blizzard Used Fake Event Invitations to Deliver CosmicPulse Backdoor

    Microsoft Threat Intelligence says the Russia-linked actor Star Blizzard has refined its phishing and malware delivery operations with a technique the company calls RedFlick. The group used fake invitations and follow-up correspondence to persuade selected targets to open password-protected archives that ultimately installed a backdoor named CosmicPulse.

    The campaign blended social engineering with scheduled execution

    Microsoft identified at least 13 larger campaigns during 2026, in addition to more narrowly targeted activity. The emails impersonated recognized organizations and event hosts, while compromised WordPress and cPanel webmail accounts helped make messages appear more credible. The archive password was presented separately, encouraging recipients to treat the file as protected material.

    After execution, RedFlick used scheduled tasks to establish persistence and launch CosmicPulse. Microsoft said the activity focused heavily on organizations and individuals connected to Ukraine, policy research and international affairs.

    Defenders should investigate the conversation, not only the attachment

    Security teams should review multi-message exchanges, unusual password-protected archives and new scheduled tasks together. Compromised third-party mailboxes can defeat simple sender-reputation checks, so identity telemetry and endpoint evidence remain essential. SectechMedia tracks related campaigns in its cybersecurity coverage.

    Sources

  • ANSSI Finds Stolen Passwords and Monitoring Gaps Behind French Tax Data Theft

    ANSSI Finds Stolen Passwords and Monitoring Gaps Behind French Tax Data Theft

    France’s national cybersecurity agency ANSSI has published its investigation into cyberattacks affecting the country’s tax administration, the DGFiP. The agency found that attackers used legitimate staff credentials and exploited weaknesses in authentication, network architecture and monitoring to reach sensitive systems and remove data.

    Valid accounts reduced the attacker’s visibility

    ANSSI traced unauthorized activity between May and August 2026 across the tax portal and a separate land-registry environment. Credentials had been exposed after use on unmanaged personal devices, while some access portals lacked strong authentication. Sensitive applications were also reachable through government network paths without sufficient segmentation.

    The report says neither DGFiP monitoring nor ANSSI’s network sensors detected the two data-exfiltration waves. One portal used by the attacker was not monitored, application logs were unavailable to ANSSI and suspicious signals were not correlated across systems.

    Session control and application telemetry are central

    The case shows why password resets must revoke active sessions across every connected portal. Public-sector operators should combine phishing-resistant authentication, application-level logging, data-volume alerts and segmentation between agencies. Retrospective searches should also connect identity, application and network evidence across administrative boundaries. SectechMedia follows related controls in its cyber-physical security coverage.

    Sources