#Cryptography
All CosmicBytez Labs articles tagged #Cryptography, across news, security advisories, how-to guides, and projects.
- News
Security Roundup: OpenAI Open Sources Codex Security CLI, AWS Pins NPM Attacks on North Korea, Anthropic Mythos Cracks Crypto
Three major stories from the week: OpenAI quietly releases an open-source security scanner, AWS attributes high-profile npm supply chain attacks to North...
- Security
CVE-2026-16235: Perl Crypt::Password Generates Predictable Salts, Enabling Password Hash Cracking
Crypt::Password versions through 0.28 for Perl use the non-cryptographic rand() function to generate password salts, making all generated hashes...
- Security
CVE-2026-61500: Rejetto HFS Session Cookie Key Derived from Math.random()
Rejetto HFS 3.0.0–3.2.0 derives its session-cookie signing key from JavaScript's non-cryptographic Math.random(), and leaks generator outputs to...
- Security
CVE-2026-47831: Weak RNG in BOSH Windows Stemcell Builder Enables Remote Password Prediction
A cryptographically weak random number generator in the GenerateRandomPassword function of bosh-windows-stemcell-builder allows remote attackers to...
- Security
CVE-2026-50208: TLS Bypass and Hard-Coded DES Keys Enable MITM Attacks
A critical CVSS 9.4 vulnerability disables TLS certificate validation via TrustAllCerts routines and combines this with hard-coded DES symmetric encryption…
- News
Apple Open-Sources Quantum-Resistant Encryption Code
Apple has open-sourced its implementations of two NIST-standardized quantum-secure algorithms — ML-KEM and ML-DSA — including formal verification tooling that.
- Security
CVE-2026-31986: Apache OFBiz Hard-Coded Cryptographic Key
Apache OFBiz versions before 24.09.06 contain a hard-coded cryptographic key vulnerability (CVSS 9.1) that allows attackers to forge authentication tokens...
- Security
CVE-2026-28815: swift-crypto X-Wing HPKE Out-of-Bounds Read
A crafted short X-Wing HPKE encapsulated key can trigger an out-of-bounds read in the C decapsulation path of Apple's swift-crypto library, potentially...
- Security
CVE-2025-15618: Perl Payment Module Uses Insecure
Business::OnlinePayment::StoredTransaction through version 0.01 for Perl generates its secret key using an MD5 hash of a single rand() call — a...
- News
Google Slashes Quantum Resource Requirements for Breaking
Google researchers have demonstrated that breaking the elliptic curve cryptography underpinning Bitcoin and Ethereum requires 20x fewer qubits than...
- Newsletter
Mar 31 Digest: Axios npm RAT, Claude Code Source Leaked
The Axios npm library was weaponized to deliver a cross-platform RAT; Anthropic accidentally leaked Claude Code's CLI source in an npm package; Google...
- Security
CVE-2026-4599: jsrsasign Private Key Recovery via DSA Nonce
A critical flaw in jsrsasign versions 7.0.0 through 11.1.0 allows attackers to recover DSA private keys by exploiting biased nonce generation in the...
- News
Google Begins Post-Quantum Cryptography Rollout Across
Google activates ML-KEM post-quantum key encapsulation by default in Chrome 134 and announces migration timeline for all Google Cloud TLS connections.