Loading story…
Cloudflare, Mozilla, and Opera moved to disable or sharply reduce support for SSLv3 after the disclosure of POODLE, a flaw that lets a man-in-the-middle force encrypted web sessions to downgrade from TLS to SSLv3 and then exploit a CBC padding oracle to recover sensitive data such as HTTP cookies. Mozilla said the issue affected any browser or site that still supported SSLv3, even if newer TLS versions were available, because insecure fallback behavior made downgrade attacks practical; its telemetry showed SSLv3 still accounted for roughly 0.3% of Firefox HTTPS connections, while external measurements found about 0.42% of the Alexa top million domains still relied on it in some way.
In response, Cloudflare disabled SSLv3 by default, Mozilla said Firefox 34 would turn off SSLv3 by default and Firefox 35 would add TLS_FALLBACK_SCSV downgrade protection, and Opera announced multiple mitigations across desktop and Android, including anti-POODLE record splitting, support for TLS_FALLBACK_SCSV, removal of security indicators for SSLv3-only sites, and disabling SSLv3 in Opera 12 desktop. Vendors also urged website operators to retire SSLv3 and migrate to modern TLS, while Opera noted its main servers had already been patched and that Opera Mini clients were not affected.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Opera announced anti-POODLE record splitting in Opera 25 for desktop and Android, support for TLS_FALLBACK_SCSV, removal of security indicators for SSLv3-only sites, and disabling SSLv3 in Opera 12 desktop. Opera also said its main servers had been patched, while noting iOS fixes depended on Apple's SSL stack.
Microsoft published Security Advisory 3009008 for CVE-2014-3566, stating that all supported Windows versions implementing SSL 3.0 were affected by the protocol flaw and recommending customers disable SSL 3.0 and migrate to TLS. Microsoft said it was not aware of active attacks at the time and noted its online services would phase out SSL 3.0 support.
Mozilla said Firefox 34 would disable SSLv3 by default on November 25, 2014, and that Firefox 35 would add TLS_FALLBACK_SCSV downgrade protection. It also urged website operators to disable SSLv3 and migrate to modern TLS.
Cloudflare announced that it had disabled SSLv3 support by default across its service in response to the POODLE vulnerability, aiming to reduce customer exposure to downgrade attacks against the obsolete protocol.
Google researchers identified the POODLE vulnerability in SSLv3, showing that a man-in-the-middle attacker could force protocol downgrades and exploit CBC padding weaknesses to recover sensitive data such as cookies from encrypted sessions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
7 references tracked. Mallory keeps watching after this page renders.
technet.microsoft.com
Open sourceblogs.opera.com
Open sourceblog.mozilla.org
Open sourceimperialviolet.org
Open sourceblog.cloudflare.com
Open sourcepraetorian.com
Open sourceopenssl.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OpenSSL released fixes for **CVE-2026-84782**, a high-severity DTLS handshake retransmission flaw that can allow a connected peer to disclose adjacent heap memory in plaintext or crash an affected application. The out-of-bounds read occurs when retransmission starts while transmission of a fragmented handshake message is suspended, leaving OpenSSL with an incorrect buffer position. CISA assigned the issue a CVSS score of 8.2; no exploitation was known as of September 29, 2026, and OpenSSL has published no workaround. Organizations should update to OpenSSL **4.0.3**, **3.6.5**, **3.5.9**, or **3.4.8**, or install their vendor’s corrected package. The flaw also affects 3.0, 1.1.1, and 1.0.2, but patches for those older branches require premium support. OpenSSL 3.0 reached public end of life on September 7, 2026 and no longer receives publicly available security fixes, increasing upgrade urgency; OpenSSL recommends moving to the 3.5 LTS release, supported through April 2030, or OpenSSL 4.0. The vulnerable DTLS logic lies outside the FIPS module boundary.
Oct 2, 2026
OpenSSL maintainers announced forthcoming releases to address a critical vulnerability in OpenSSL 3.x, affecting versions `3.0.0` through `3.0.6`, with version `3.0.7` identified as the patch release. Subsequent reporting found the vulnerable library was widely deployed across internet-facing systems worldwide, with notable concentrations in the United States, Russia, Japan, Germany, and China, and common exposure in products including **Apache httpd** and **OpenSSH**. SecurityScorecard said its investigation of recently scanned systems running OpenSSL 3.x identified 21 external IP addresses previously associated with malicious activity communicating with potentially affected hosts. The company said three of those IPs had prior intelligence links to activity associated with **Kimsuky**, **Lazarus Group**, and **APT-C-23**, while cautioning that the observed traffic did not confirm exploitation of the flaw. The findings nonetheless underscored how quickly threat actors could discover exposed services and reinforced the need for urgent patching and exposure reduction.
Aug 21, 2026
OpenSSL released fixes for eight Moderate- and Low-severity vulnerabilities across supported branches, affecting QUIC, CMS, CMP, DTLS, TLS Raw Public Key processing, and AEAD decryption. The most significant issues are a QUIC INITIAL-packet double free (`CVE-2026-18798`), a CMS key-unwrapping heap buffer overflow (`CVE-2026-63072`), and a CMP invalid-pointer dereference triggered through a crafted `protectionAlg` value (`CVE-2026-63076`). Most flaws can cause denial of service through crashes, heap corruption, or memory exhaustion. Organizations should upgrade to OpenSSL 4.0.2, 3.6.4, 3.5.8, 3.4.7, or 3.0.22; premium-support customers using legacy branches should update to 1.1.1zi or 1.0.2zr where applicable. Affected releases include versions before those fixes across the 1.0.2, 1.1.1, 3.0, 3.4, 3.5, 3.6, and 4.0 branches. OpenSSL stated that none of the disclosed vulnerabilities affects its FIPS module, as the vulnerable paths are outside the FIPS boundary or involve non-FIPS-approved algorithms.
Aug 31, 2026