News

A denial-of-service vulnerability in OpenSSL, named HollowByte by Okta’s Red Team, enables a remote unauthenticated attacker to permanently exhaust server memory using a crafted 11-byte TLS handshake payload. The flaw was quietly fixed in a multi-branch OpenSSL release on June 9, 2026. No official CVE advisory was published by the OpenSSL project at the time […]

For most of the last decade, the maximum validity period for a publicly trusted TLS certificate sat at 398 days — just over thirteen months. Long enough that a sysadmin could handle renewals with a calendar reminder and a few manual steps. That window is closing. In April 2025, the CA/Browser Forum passed a ballot