Loading story…
Privoxy 4.2.0 has been released with security fixes for two flaws in the privacy-focused non-caching web proxy, including a bug in parse_chunk_size() triggered by malformed chunk sizes in HTTP/1.0 Chunked Transfer Encoding handling and a flaw in ssl_send_certificate_error() caused by incorrect data-length processing that could lead to an integer overflow. The project said CVE identifiers were still pending at the time of publication, and the release also updates dependency handling by dropping support for mbedtls 2.x and OpenSSL 2.0.
The release also expands HTTPS inspection capabilities, including support for elliptic-curve certificates using SN_X9_62_prime256v1 in some cases, adds a new --enable-acl-debugging option, and improves web-based action-file editing, logging, and other web interface behavior. Privoxy, distributed under GPLv2+ for Linux and Windows, is used for privacy enhancement, ad blocking, cookie control, header modification, and web content filtering.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
Privoxy 4.2.0 was released with new and improved features including HTTPS inspection enhancements, ACL debugging support, and web interface updates. The release also fixed security issues in parse_chunk_size() and ssl_send_certificate_error(), with CVE identifiers noted as pending.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OpenSSL disclosed a broad set of vulnerabilities affecting ASN.1 parsing, PKCS#12, CMS/PKCS#7, QUIC, OCSP, CMP/CRMF, DH key validation, AEAD cipher handling, and certificate and email validation across the 4.0, 3.6, 3.5, 3.4, and 3.0 branches. The most severe issue, **CVE-2026-45447**, is a high-severity heap use-after-free in `PKCS7_verify()` that can be triggered by specially crafted PKCS#7 or S/MIME signed messages and could lead to crashes, heap corruption, or potentially remote code execution. The advisory also details moderate-severity flaws that could enable forged CMS `AuthEnvelopedData` messages, denial-of-service conditions in QUIC and OCSP processing, a TLS client double-free via OCSP stapling, a QUIC server `NULL` dereference, and cryptographic failures in AES-OCB when applications use the `EVP_Cipher()` one-shot API, alongside numerous lower-severity parsing, validation, and bounds-checking bugs. OpenSSL said most issues were fixed in **4.0.1**, **3.6.3**, **3.5.7**, **3.4.6**, and **3.0.21**, with **1.1.1zh** and **1.0.2zq** issued for supported legacy customers; most flaws were reported as outside the OpenSSL FIPS module boundary, except **CVE-2026-42770**, which affects FIPS modules in multiple supported branches.
Jun 29, 2026
The Apache Software Foundation released **Apache HTTP Server 2.4.68** to patch 13 vulnerabilities affecting versions prior to `2.4.68`, with many issues spanning `2.4.0` through `2.4.67`. The flaws span multiple modules, including `mod_http2`, `mod_proxy_ftp`, `mod_proxy_html`, `mod_ssl`, `mod_ldap`, `mod_dav_fs`, `mod_xml2enc`, and `mod_headers`, and include use-after-free, heap and buffer overflows, out-of-bounds reads, denial-of-service conditions, cross-site scripting, privilege-escalation and path-handling weaknesses. Apache and national defenders, including Canada’s Cyber Centre, urged administrators to review the advisory and upgrade because workarounds are unavailable for most of the issues. Notable CVEs include `CVE-2026-49975`, a `mod_http2` denial-of-service bug triggered by excessive size values in malicious HTTP/2 requests; `CVE-2026-48913`, a `mod_http2` memory-corruption issue when file handles are exhausted; `CVE-2026-34355` and `CVE-2026-34356`, buffer-overflow flaws tied to untrusted backend systems in `mod_proxy_html` and `ProxyPassReverseCookie*`; `CVE-2026-44631`, a heap underflow in `ap_regname` caused by crafted regular expressions; `CVE-2026-29167`, a `mod_ldap` per-directory use-after-free; `CVE-2026-29170` and `CVE-2026-44186` in `mod_proxy_ftp`; `CVE-2026-44185` in `mod_ssl` OCSP handling; and `CVE-2026-42535` in `mod_dav_fs`. The release also ships non-security changes such as OpenSSL 4.0 support and `mod_http2` updates, but the immediate priority for exposed environments is upgrading all Apache HTTP Server deployments to `2.4.68`.
Jun 29, 2026
Wireshark has released version **4.6.7**, a maintenance update that fixes **12 security vulnerabilities** affecting the processing of untrusted packets and capture or trace files. The flaws primarily allowed crashes through out-of-bounds reads, invalid memory access, and large or infinite processing loops triggered by crafted network traffic or malformed files, while one issue in the **BLF** parser could lead to information disclosure. The patched areas span multiple protocol dissectors and parsers, including **Catapult DCT2000**, **SSH**, **IEEE 802.11**, **Z39.50**, **UMTS FP**, the **pcapng** reader, **DBS Etherwatch**, the **TLS ECH** decryption path, and the **CiscoDump extcap** helper. The release also fixes **16 non-security bugs**, updates several protocol handlers, and notes that on Unix-like systems, `extcap` binaries are now searched under the **libexec** directory by default.
Jul 11, 2026