Let's Encrypt is developing support for post-quantum cryptography to protect HTTPS certificates against future quantum computing threats. The certificate authority plans to issue post-quantum certificates starting in 2026.
Let's Encrypt announced plans to issue certificates using post-quantum cryptographic algorithms, addressing security risks posed by quantum computers capable of breaking current encryption methods.
The initiative involves implementing hybrid certificates that combine classical and post-quantum algorithms during a transition period. This approach ensures compatibility with existing systems while introducing quantum-resistant security.
Post-quantum cryptography relies on mathematical problems believed to resist quantum computing attacks, such as lattice-based and hash-based algorithms. Standards for these methods are being finalized by NIST, with adoption expected across the industry.
The 2026 timeline aligns with the broader industry push toward quantum-safe infrastructure. Let's Encrypt's role as a major certificate provider makes this transition significant for web security.
The move follows growing recognition that encrypted data collected today could be decrypted by quantum computers in the future, creating urgency for cryptographic modernization across critical infrastructure.
WordPress disclosed an unauthenticated path traversal vulnerability that could lead to conditional remote code execution. The issue affects WordPress core and has been documented in an official security advisory.
Security researchers have demonstrated an attack allowing hackers with privileged access to register fake MFA providers and harvest user passwords during login. The vulnerability exploits the authentication process itself.
GrapheneOS, a privacy-focused Android fork, is on track to ship preinstalled on commercial devices within three years. The project has gained significant momentum in developer circles.
A Chinese-speaking threat actor has exploited vulnerabilities in ZyXEL GS1900 Smart Managed Switches and WordPress to compromise 996 devices and steal over 18,500 database records from government systems.