Loading story…
Lightship Security, an accredited cryptographic security test laboratory and part of Applus+ Laboratories, together with the OpenSSL Corporation, has announced the submission of OpenSSL version 3.5.4 to the Cryptographic Module Validation Program (CMVP) for FIPS 140-3 validation. This submission signifies that the OpenSSL 3.5.4 codebase is complete and that all cryptographic algorithms included in the module have successfully passed both NIST testing and independent laboratory review. The FIPS 140-3 validation is a critical compliance requirement for cryptographic modules used in government and regulated industries, ensuring that the cryptographic implementations meet stringent security standards. The final step remaining in the process is the CMVP’s review and the issuance of the official FIPS 140-3 certificate. OpenSSL 3.5, which was released in April 2025, introduced support for post-quantum cryptographic (PQC) algorithms such as ML-KEM, ML-DSA, and SLH-DSA, aligning with NIST’s ongoing PQC standardization efforts. The submission of version 3.5.4 for FIPS validation is particularly significant as it represents the first move toward a FIPS-validated, PQC-ready cryptographic module, which is essential for organizations preparing for the advent of quantum computing threats. The OpenSSL 3.5.4 FIPS Object Module is designed to be open-source and standards-compliant, making it suitable for deployment across a wide range of government and industry applications. Once the FIPS 140-3 certification is granted, organizations will be able to deploy OpenSSL 3.5.4 in environments that require validated cryptographic solutions, thereby enhancing their security posture and compliance. The collaboration between Lightship Security and the OpenSSL Corporation underscores a commitment to maintaining validated, standards-based cryptography in one of the world’s most widely used open-source libraries. OpenSSL is foundational to internet infrastructure, embedded systems, and enterprise applications, making this validation effort highly impactful. The successful completion of NIST and independent laboratory testing demonstrates the robustness and reliability of the cryptographic algorithms implemented in OpenSSL 3.5.4. The FIPS 140-3 validation process is rigorous, involving detailed technical scrutiny and compliance checks, which OpenSSL 3.5.4 has now largely completed. The announcement has been recognized as a significant milestone in the ongoing effort to provide secure, compliant, and future-proof cryptographic solutions. Organizations across sectors are expected to benefit from the availability of a FIPS-validated, PQC-ready OpenSSL module. The move also supports broader industry and governmental initiatives to prepare for quantum-resistant cryptography. The final certification, once issued, will enable widespread adoption of OpenSSL 3.5.4 in regulated environments. This development is expected to influence cryptographic best practices and compliance strategies globally. The partnership between Lightship Security and the OpenSSL Corporation is anticipated to continue driving innovation and assurance in open-source cryptography.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
Lightship Security and the OpenSSL Corporation submitted OpenSSL 3.5.4 for FIPS 140-3 validation. Multiple references report the same submission as the key development in the story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcehackread.com
Open sourcesecuritysenses.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OpenSSL maintainers released urgent security updates to address three newly discovered vulnerabilities affecting all supported versions of the widely used SSL/TLS library. The vulnerabilities, tracked as CVE-2025-9230, CVE-2025-9231, and CVE-2025-9232, pose risks including key recovery, remote code execution, and denial-of-service attacks. One of the flaws, CVE-2025-9230, involves an out-of-bounds read and write in the CMS decryption process with password-based encryption (PWRI), which could lead to application crashes or memory corruption, potentially allowing attackers to execute arbitrary code. Although the use of PWRI is rare, the consequences of successful exploitation could be severe, prompting OpenSSL to rate the flaw as moderate in severity. FIPS modules are not affected by this vulnerability. Another vulnerability, CVE-2025-9231, is a timing side-channel issue in SM2 signature computations on 64-bit ARM platforms, which could enable attackers to recover private keys through precise timing measurements. While OpenSSL does not natively support SM2 keys in TLS, the risk remains for applications using SM2 signatures. The third flaw, CVE-2025-9232, details were not fully elaborated in the available sources, but it is included in the urgent patch set. OpenSSL has released patched versions 3.5.4, 3.4.3, 3.3.5, 3.2.6, 3.0.18, 1.0.2zm, and 1.1.1zd to address these vulnerabilities. Security experts and the OpenSSL Project strongly urge all users and organizations to update to the latest versions immediately to mitigate the risk of exploitation. The vulnerabilities impact a broad range of systems and applications that rely on OpenSSL for secure communications, making prompt patching critical for maintaining the confidentiality and integrity of data in transit. The flaws could be exploited in scenarios where attackers have access to cryptographic operations or can induce specific decryption processes. The OpenSSL advisory emphasizes that, despite the low probability of successful exploitation for some of the flaws, the potential impact warrants immediate attention. Organizations are advised to review their use of OpenSSL, especially in environments utilizing ARM platforms or custom cryptographic implementations. The updates are part of OpenSSL's ongoing commitment to maintaining the security of its cryptographic library, which underpins much of the internet's secure traffic. Security researchers continue to scrutinize OpenSSL due to its widespread deployment and critical role in protecting sensitive information. The release of these patches highlights the importance of timely vulnerability management and the need for organizations to monitor security advisories from key software suppliers. Failure to apply these updates could leave systems exposed to advanced attacks, including those that bypass traditional security controls. The OpenSSL Project's rapid response demonstrates the collaborative effort between researchers and maintainers to address security issues before they can be widely exploited.
Jun 29, 2026
Apple has released the post-quantum cryptography components of its `corecrypto` library as open source, publishing implementations of the NIST-standardized **ML-KEM** and **ML-DSA** algorithms alongside mathematical proofs, documentation, and verification tooling for independent review. The company said `corecrypto` underpins encryption, hashing, random number generation, and digital signatures across more than 2.5 billion active devices, and that post-quantum protections introduced in 2024 are already used in **iMessage**, VPN services, and TLS networking, including the **PQ3** messaging protocol Apple previously described as a large-scale quantum-secure design. Apple said it validated the code through a hybrid assurance model combining conventional testing, simulation, independent review, and formal verification, using a workflow that linked portable C implementations to **Cryptol** and **Isabelle** proofs with support from Galois. According to Apple, that process uncovered a subtle early **ML-DSA** flaw that could rarely produce incorrect output and likely would have escaped standard testing; the issue was fixed before deployment. The release is intended to make Apple’s analysis reproducible and give outside experts a chance to scrutinize security-critical cryptographic code as organizations prepare for future quantum threats.
Jun 29, 2026
The OpenSSL Project released updated versions across multiple supported branches to fix a set of security flaws in the SSL/TLS toolkit, with **OpenSSL 3.6.2** carrying the broadest set of patches. The updates address issues including incorrect failure handling in RSA KEM `RSASVE` encapsulation, an out-of-bounds read in `AES-CFB-128` on x86-64 systems with `AVX-512` support, a potential use-after-free in DANE client code, several `NULL` pointer dereference bugs, and a heap buffer overflow in hexadecimal conversion. OpenSSL said the most severe issue in the release was rated **Moderate**. Additional releases — **3.5.6, 3.4.5, 3.3.7, 3.0.20, 1.1.1zg, and 1.0.2zp** — also shipped with security fixes and minor bug corrections, though older branches received smaller subsets of the patches. The 3.6.2 release also repaired two regressions introduced in 3.6.0 affecting `X509_V_FLAG_CRL_CHECK_ALL` behavior and stapled OCSP response handling that could trigger handshake failures. Administrators running **OpenSSL 3.6.x** on x86-64 systems with `AVX-512` enabled were specifically urged to prioritize the `AES-CFB-128` fix because of memory-read exposure.
Jun 29, 2026