Loading story…
The ntop project released nDPI 6.0, an open-source deep-packet-inspection library derived from OpenDPI that classifies network protocols independently of port assignments. The update identifies more than 450 protocols and applications and 56 flow-risk categories, including encrypted and tunneled traffic.
Version 6.0 adds detection for slow HTTP denial-of-service techniques—Slowloris, Slow POST, and Slow GET—and expands JA4 TLS fingerprinting to improve encrypted-connection identification. It also introduces USDT tracing, recognizes mesh-network protocols and additional GitHub and Proton services, and improves parsing and handling of SSL/TLS, JSON, MsgPack, and other application-layer protocols.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
The ntop project released nDPI 6.0, an open-source deep-packet-inspection library derived from OpenDPI. The release adds detection for Slowloris, Slow POST, and Slow GET patterns, expanded JA4 TLS fingerprinting, USDT probes, and recognition for mesh protocols and GitHub and Proton services.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
opennet.ru
Open sourceopennet.me
Open sourcentop.org
Open sourcentop.org
Open sourcedatatracker.ietf.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Wireshark has released version **4.6.7**, a maintenance update that fixes **12 security vulnerabilities** affecting the processing of untrusted packets and capture or trace files. The flaws primarily allowed crashes through out-of-bounds reads, invalid memory access, and large or infinite processing loops triggered by crafted network traffic or malformed files, while one issue in the **BLF** parser could lead to information disclosure. The patched areas span multiple protocol dissectors and parsers, including **Catapult DCT2000**, **SSH**, **IEEE 802.11**, **Z39.50**, **UMTS FP**, the **pcapng** reader, **DBS Etherwatch**, the **TLS ECH** decryption path, and the **CiscoDump extcap** helper. The release also fixes **16 non-security bugs**, updates several protocol handlers, and notes that on Unix-like systems, `extcap` binaries are now searched under the **libexec** directory by default.
Jul 11, 2026
Wireshark released version **4.6.8** with fixes for a large set of security vulnerabilities spanning packet dissectors, codecs, parsers, and related utilities. The advisory tracks issues under `wnpa-sec-2026-08` through `wnpa-sec-2026-50` and describes widespread crash conditions, infinite loops that can trigger denial of service, and several flaws marked as possible code execution, including issues in the **TLS** dissector, **RDP** dissector, **SBC** codec, and profile import functionality. Affected components also include handlers for protocols such as **SMB2**, **HTTP**, **WebSocket**, **ZigBee**, **MySQL**, **ICMPv6**, and **OpenFlow**, highlighting risk across Wireshark’s packet parsing and decompression surface. Supporting issue reports show specific parser weaknesses such as a **BT-DHT dissector stack overflow via nested structs** and an **FC-SWILS dissector stack overflow via nested zone set objects**, while CVE tracking includes identifiers such as `CVE-2026-5408` and `CVE-2026-5409`. The release notes also reference additional non-CVE defects involving memory corruption, integer underflow, heap overflow, parser overflows, and stability problems in **Sharkd**, underscoring that malformed capture data or imported content could crash analysis workflows and, in some cases, potentially lead to code execution.
Aug 21, 2026
Netty published a broad set of security advisories covering **22 vulnerabilities** across its networking stack, with impacts ranging from remote denial of service to trust-boundary failures. The issues affect multiple modules and protocols, including **HTTP/2, HTTP/3, QUIC, DNS, Redis, SCTP, Unix domain sockets, HAProxy PROXY protocol v2, and TLS handling**. Reported consequences include uncontrolled memory allocation, `ByteBuf` and file descriptor leaks, failure to enforce HTTP/2 stream limits, DNS cache poisoning, improper TLS hostname validation, IPv6 subnet access-control bypass, request smuggling, and QUIC reflection or stateless reset abuse. One of the most serious flaws, **`CVE-2026-45416`**, allows a remote attacker to send as little as **nine bytes** in a crafted TLS `ClientHello` and trigger roughly **16 MiB** of unpooled direct-memory allocation per connection in Netty's SNI handling path. Because the buffer can remain allocated until the connection closes, repeated connections can exhaust direct memory and disrupt services. The flaw affects **Netty 4.1.x before `4.1.135.Final`** and **4.2.0.Final through `4.2.14.Final`**, and was fixed in **`4.1.135.Final`** and **`4.2.15.Final`**; the wider advisory set was published through Netty's GitHub security advisories and highlights the risk to Java applications that embed Netty as a dependency.
Jul 10, 2026