#TLS
All CosmicBytez Labs articles tagged #TLS, across news, security advisories, how-to guides, and projects.
- News
Let's Encrypt Cuts Default Certificate Validity to 64 Days Ahead of 45-Day Switch
Let's Encrypt issues 64-day certificates by default from Feb. 10, 2027, with 45-day certs following in 2028 under CA/Browser Forum rules.
- Security
CVE-2026-105221: gist RubyGem Disables TLS Certificate Validation, Exposing GitHub OAuth Tokens
The gist RubyGem before 6.1.0 sets VERIFY_NONE on every HTTPS connection, letting on-path attackers intercept GitHub API traffic and steal OAuth tokens.
- News
High-Severity Vulnerabilities Patched in OpenSSL, WolfSSL
OpenSSL fixed 14 flaws including a high-severity DTLS heap leak; WolfSSL 5.9.4 patched 11 bugs, three enabling TLS certificate-forgery attacks.
- Security
Apache HttpComponents TLS Hostname Verification Bypass
Apache HttpComponents Client 5.4+ async mode ignores HostnameVerificationPolicy#BUILTIN, enabling MITM attacks against TLS connections in affected applications.
- Project
Step-CA: Build a Private Certificate Authority for Your Homelab
Stop accepting self-signed certificate warnings. Deploy Smallstep's step-ca as a fully automated internal PKI — complete with ACME support, Traefik...
- Security
CVE-2026-48144: Apache Thrift c_glib TLS Certificate Host Mismatch (CVSS 9.1)
A critical TLS hostname verification flaw in Apache Thrift's c_glib bindings allows network-positioned attackers to conduct man-in-the-middle attacks...
- News
HollowByte: 11-Byte Payload Triggers Memory Bloat DoS on OpenSSL Servers
A newly disclosed vulnerability dubbed HollowByte allows unauthenticated attackers to cause a denial-of-service condition on OpenSSL servers by sending a...
- Security
CVE-2026-53434: Critical Apache Tomcat CRL Configuration Flaw (CVSS 9.1)
A critical vulnerability in Apache Tomcat's FFM/Panama TLS connector silently ignores invalid or malformed CRL configurations, causing the server to...
- Security
CVE-2026-9648: X.509 NameConstraints Bypass in crypton-x509-validation
A critical flaw in the Haskell crypton-x509-validation library allows TLS clients to accept certificates whose Subject Alternative Names fall outside a...
- Security
CVE-2026-50208: TLS Bypass and Hard-Coded DES Keys Enable MITM Attacks
A critical CVSS 9.4 vulnerability disables TLS certificate validation via TrustAllCerts routines and combines this with hard-coded DES symmetric encryption…
- Project
Building a Production-Ready Reverse Proxy with Traefik v3
Deploy Traefik v3 as a Docker-native reverse proxy with automatic Let's Encrypt TLS, label-based routing, and security middleware — no more port juggling...
- Security
CVE-2026-35560: Amazon Athena ODBC Driver Fails Certificate
Improper certificate validation in Amazon Athena ODBC driver versions prior to 2.1.0.0 allows man-in-the-middle attackers to intercept authentication...
- Security
Juju Dqlite Cluster TLS Auth Bypass — Unauthenticated
A CVSS 10.0 critical vulnerability in Juju versions 3.2.0–3.6.18 and 4.0–4.0.3 allows unauthenticated attackers to connect directly to the internal Dqlite...
- News
Google Begins Post-Quantum Cryptography Rollout Across
Google activates ML-KEM post-quantum key encapsulation by default in Chrome 134 and announces migration timeline for all Google Cloud TLS connections.
- Security
NGINX TLS Vulnerability Enables Man-in-the-Middle Attacks
CVE-2026-1642 affects NGINX OSS and Plus when proxying to upstream TLS servers, allowing attackers to inject plaintext data into responses.