Loading story…
OpenSSL maintainers announced forthcoming releases to address a critical vulnerability in OpenSSL 3.x, affecting versions 3.0.0 through 3.0.6, with version 3.0.7 identified as the patch release. Subsequent reporting found the vulnerable library was widely deployed across internet-facing systems worldwide, with notable concentrations in the United States, Russia, Japan, Germany, and China, and common exposure in products including Apache httpd and OpenSSH.
SecurityScorecard said its investigation of recently scanned systems running OpenSSL 3.x identified 21 external IP addresses previously associated with malicious activity communicating with potentially affected hosts. The company said three of those IPs had prior intelligence links to activity associated with Kimsuky, Lazarus Group, and APT-C-23, while cautioning that the observed traffic did not confirm exploitation of the flaw. The findings nonetheless underscored how quickly threat actors could discover exposed services and reinforced the need for urgent patching and exposure reduction.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
As of 10:30 PM EST on October 29, SecurityScorecard reported 1,617 observations of affected products in the United States, 775 in Russia, 449 in Japan, 442 in Germany, 334 in China, and 308 in Czechia.
On October 28, SecurityScorecard ran a query for products observed using OpenSSL 3.x and found 116 results, with only five results representing products other than IP cameras.
Mark Cox announced that OpenSSL 3.0.7 would be released on November 1, 2022 to fix a new critical vulnerability affecting OpenSSL 3.0 and later.
From October 28 to 29, SecurityScorecard recorded 474 observations of affected products in a 24-hour dataset. Apache httpd accounted for 331 observations and OpenSSH for 61.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 22 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OpenSSL maintainers released urgent security updates to address three newly discovered vulnerabilities affecting all supported versions of the widely used SSL/TLS library. The vulnerabilities, tracked as CVE-2025-9230, CVE-2025-9231, and CVE-2025-9232, pose risks including key recovery, remote code execution, and denial-of-service attacks. One of the flaws, CVE-2025-9230, involves an out-of-bounds read and write in the CMS decryption process with password-based encryption (PWRI), which could lead to application crashes or memory corruption, potentially allowing attackers to execute arbitrary code. Although the use of PWRI is rare, the consequences of successful exploitation could be severe, prompting OpenSSL to rate the flaw as moderate in severity. FIPS modules are not affected by this vulnerability. Another vulnerability, CVE-2025-9231, is a timing side-channel issue in SM2 signature computations on 64-bit ARM platforms, which could enable attackers to recover private keys through precise timing measurements. While OpenSSL does not natively support SM2 keys in TLS, the risk remains for applications using SM2 signatures. The third flaw, CVE-2025-9232, details were not fully elaborated in the available sources, but it is included in the urgent patch set. OpenSSL has released patched versions 3.5.4, 3.4.3, 3.3.5, 3.2.6, 3.0.18, 1.0.2zm, and 1.1.1zd to address these vulnerabilities. Security experts and the OpenSSL Project strongly urge all users and organizations to update to the latest versions immediately to mitigate the risk of exploitation. The vulnerabilities impact a broad range of systems and applications that rely on OpenSSL for secure communications, making prompt patching critical for maintaining the confidentiality and integrity of data in transit. The flaws could be exploited in scenarios where attackers have access to cryptographic operations or can induce specific decryption processes. The OpenSSL advisory emphasizes that, despite the low probability of successful exploitation for some of the flaws, the potential impact warrants immediate attention. Organizations are advised to review their use of OpenSSL, especially in environments utilizing ARM platforms or custom cryptographic implementations. The updates are part of OpenSSL's ongoing commitment to maintaining the security of its cryptographic library, which underpins much of the internet's secure traffic. Security researchers continue to scrutinize OpenSSL due to its widespread deployment and critical role in protecting sensitive information. The release of these patches highlights the importance of timely vulnerability management and the need for organizations to monitor security advisories from key software suppliers. Failure to apply these updates could leave systems exposed to advanced attacks, including those that bypass traditional security controls. The OpenSSL Project's rapid response demonstrates the collaborative effort between researchers and maintainers to address security issues before they can be widely exploited.
Jun 29, 2026
OpenSSL disclosed **Heartbleed** (`CVE-2014-0160`), a critical flaw in the TLS/DTLS heartbeat extension caused by a missing bounds check that let remote attackers read up to **64 KB** of memory from vulnerable clients and servers. The bug affected OpenSSL `1.0.1` through `1.0.1f` and some `1.0.2-beta` releases, potentially exposing private keys, passwords, cookies, and other sensitive data without leaving reliable forensic traces. OpenSSL urged organizations to upgrade to `1.0.1g` or disable heartbeats if they could not patch immediately, while researchers and vendors warned that remediation also required rotating keys, revoking and reissuing certificates, and resetting passwords only after affected services had been fixed. The vulnerability triggered emergency responses across the Internet and in embedded infrastructure, with Cisco, Juniper, Western Digital, Apple, Android device makers, and major online platforms assessing or patching affected products. Reports showed the risk extended beyond websites to routers, VPNs, storage appliances, mobile devices, and other systems using embedded OpenSSL, while Cloudflare demonstrated that theft of SSL private keys was practically achievable and incident reporting linked the flaw to real-world compromise, including theft of Canadian taxpayer data and suspected corporate intrusions. The incident also exposed a structural weakness in Internet security: one of the web’s most widely trusted cryptographic libraries had been maintained by a small, underfunded team, prompting calls for sustained investment in critical open-source infrastructure.
Jun 29, 2026
The OpenSSL Project released updated versions across multiple supported branches to fix a set of security flaws in the SSL/TLS toolkit, with **OpenSSL 3.6.2** carrying the broadest set of patches. The updates address issues including incorrect failure handling in RSA KEM `RSASVE` encapsulation, an out-of-bounds read in `AES-CFB-128` on x86-64 systems with `AVX-512` support, a potential use-after-free in DANE client code, several `NULL` pointer dereference bugs, and a heap buffer overflow in hexadecimal conversion. OpenSSL said the most severe issue in the release was rated **Moderate**. Additional releases — **3.5.6, 3.4.5, 3.3.7, 3.0.20, 1.1.1zg, and 1.0.2zp** — also shipped with security fixes and minor bug corrections, though older branches received smaller subsets of the patches. The 3.6.2 release also repaired two regressions introduced in 3.6.0 affecting `X509_V_FLAG_CRL_CHECK_ALL` behavior and stapled OCSP response handling that could trigger handshake failures. Administrators running **OpenSSL 3.6.x** on x86-64 systems with `AVX-512` enabled were specifically urged to prioritize the `AES-CFB-128` fix because of memory-read exposure.
Jun 29, 2026