Topic
OpenSSL
From Root CA to User Authorization in nginx and Apache: Client Certificate Login Explained
Other
Russian Ministry Certificates Enable Potential State MITM on Foreign Domains
Privacy & Surveillance
Dangerous C++ Traps: Memory Safety Issues, Undefined Behavior, and Code That Betrays Developers
Vulnerabilities & ExploitsDell Releases Security Update for PowerProtect Data Manager Fixing 359 Vulnerabilities
Dell has issued a security update for its data protection solution Dell PowerProtect Data Manager to address a total of 359 vulnerabilities. The company published security advisory DSA-2026-287 on July 14, 2026, rating the issues as Critical and urging users to apply the fixes immediately. Six product-specific flaws were resolved, including CVE-2026-40712 in the REST API that allows privilege escalation after input validation bypass and CVE-2026-49499 stemming from improper security token generation. The remaining four native vulnerabilities received CVSS v3.1 base scores between 6.0 and 7.2. In addition, 353 third-party component vulnerabilities were patched, covering 130 issues in the Linux kernel along with flaws in Apache Log4j, Apache Tomcat, Samba, PostgreSQL, OpenSSL, glibc, and Vim. Administrators are advised to upgrade to version 20.2.0.0 or later to mitigate the risks.
Phantomdrive Open-Source USB Drive Conceals Encrypted Storage to Resist Coercion
Developer Ryan Walker has released Phantomdrive, a fully open-source USB device that initially appears as an 8 GB drive while hiding the remaining capacity from the operating system. The gadget uses a CH569 microcontroller with hardware AES support and an SD card for storage, switching to a hidden encrypted partition when a specific password string is written to a text file. It employs a key derivation function with 100,000 rounds of SHA-256 combined with a unique device salt derived from the USB serial number to strengthen password security. The project supports AES-CTR mode by default for performance reasons, delivering up to 20 MB/s reads, while AES-XTS is available as a slower but more robust alternative. All firmware, hardware schematics, and mechanical designs are published under open licenses, and the device is physically secured with epoxy resin to deter tampering. Walker acknowledges earlier community criticism regarding cryptographic implementation details and has addressed functional testing against OpenSSL references.
OpenSSL Patches HollowByte Vulnerability That Enables Denial-of-Service Attacks on TLS Connections with Just 11 Bytes
OpenSSL has released fixes for a vulnerability dubbed HollowByte that allows denial-of-service attacks against servers using unpatched versions of the library. The flaw can be triggered by a malicious TLS request as small as 11 bytes and was addressed without a CVE or formal security advisory because it was classified as a hardening improvement. Researchers from Okta warn that the operational impact can be significant on internet-facing servers, as the issue occurs during the initial TLS handshake when vulnerable OpenSSL versions reserve memory based on the client-declared size before verifying actual data delivery. Attackers can open connections, claim they will send a large message, and then deliver only a tiny portion, leaving the server waiting indefinitely with reserved memory. In tests with NGINX, low-memory servers could be completely taken down while more powerful machines suffered substantial capacity loss without triggering abnormal traffic volumes. The patches are included in OpenSSL versions 4.0.1, 3.6.3, 3.5.7, 3.4.6, and 3.0.21, and administrators are advised to update packages, restart affected services, and monitor for unusual memory growth.