Eleven Bytes, 131 KB of Frozen Memory

Eleven bytes. That’s all it takes to make an unpatched OpenSSL server set aside up to 131 KB of memory for a message that never arrives. On glibc systems, that memory stays locked until the process restarts. Not great for a production server.

This is the HollowByte flaw, a denial-of-service bug that Okta’s Red Team found, named, and reported. The team published its findings after OpenSSL shipped a fix — quietly, with no CVE, no advisory, and no changelog entry pointing at it.

So how does a tiny TLS request cause so much damage? The trick lies in how OpenSSL handles certain message fragments. A crafted 11-byte request triggers an allocation that never gets freed. Repeat it enough times, and you’ve got a memory leak that grinds the server to a halt.

What Exactly Is HollowByte?

HollowByte is a memory exhaustion vulnerability in OpenSSL’s TLS handling. It doesn’t require authentication. It doesn’t need special privileges. Just a network connection and a carefully constructed request.

Okta’s Red Team discovered that sending a specific 11-byte TLS message causes the server to allocate memory for a response that never comes. On systems using glibc — the standard C library on most Linux distributions — that allocated memory isn’t reclaimed. It sits there, frozen, until the process dies.

The impact? An attacker can send repeated requests to exhaust available memory, effectively freezing the server. It’s a classic DoS vector, but with a twist: the trigger is absurdly small.

Why glibc Makes It Worse

The memory behavior isn’t universal. On some systems, the allocation gets cleaned up. But glibc’s allocator handles certain patterns differently, and that’s where the freeze happens. Okta’s testing showed the memory staying put until restart — no garbage collection, no cleanup, just a slow leak that compounds.

For organizations running OpenSSL on glibc-based systems, this is a real problem. A single connection isn’t dangerous. Thousands of them? That’s a different story.

OpenSSL’s Quiet June Fix

Here’s the part that’s raising eyebrows. OpenSSL patched HollowByte in June — but did it without a CVE, without a security advisory, and without a changelog entry that mentions the vulnerability.

That’s unusual. Security fixes typically get publicized so administrators know to update. A silent patch means many systems remain vulnerable, simply because nobody knows to apply the update.

Okta’s Red Team, which reported the bug and gave it the HollowByte name, published its research to fill that gap. The disclosure includes technical details on how the attack works and which versions are affected.

Who’s Affected and What to Do

If you’re running OpenSSL on a glibc-based system, you need to check your version. The fix shipped in June, so any version before that is vulnerable. The exact version numbers are in Okta’s disclosure.

Here’s what to do right now:

• Update OpenSSL to the latest patched version. Don’t wait for a CVE announcement.
• Check your changelog — if you’re on a version from June or later, verify it includes the fix.
• Monitor memory usage on TLS-facing servers. Unexpected spikes could indicate an attack.
• Restrict network access to TLS endpoints where possible, limiting who can send requests.

The update itself is straightforward. The challenge is knowing you need it.

The Bigger Problem: Silent Security Fixes

HollowByte highlights a broader issue in open-source security: fixes without fanfare. When a vulnerability is patched silently, the window of exposure stretches. Attackers who reverse-engineer the patch can exploit systems that haven’t updated — and they’ll do it before the news spreads.

Okta’s decision to publish the research after the patch is a pragmatic move. It alerts the community while giving administrators a heads-up. But it also raises questions: how many other HollowByte-style flaws are out there, patched but unannounced?

For security teams, the lesson is clear. Don’t rely solely on CVE alerts. Regularly audit your dependencies, track upstream changes, and test for unusual behavior. A silent patch is still a patch — but only if you apply it.

Interested in related security topics? Check out our guides on TLS certificate management and denial-of-service attack prevention for more context on keeping your infrastructure safe.

Coca-Cola Confirms Data Breach After Fairlife Ransomware Attack

The soft drinks giant confirmed on Monday that the recent ransomware attack on its dairy subsidiary Fairlife escalated into a full-blown data breach. Coca-Cola disclosed the cybersecurity incident on July 16, when it suspended production at Fairlife facilities across the United States while investigating the intrusion.

Now, the Anubis ransomware group has claimed responsibility and is threatening to leak stolen data. Here’s what we know so far.

What Happened: Fairlife Production Halted, Then Resumed

Coca-Cola initially announced the cyberattack on July 16, halting operations at four Fairlife facilities in the US. The company said it was working with law enforcement and cybersecurity experts to contain the threat.

By Monday, a statement from Coca-Cola confirmed that “a majority of production has been resumed” at those facilities. The company also acknowledged that the incident involved the “taking of certain data,” though it declined to share further details.

“Retail availability of Fairlife products has been largely unimpacted, due to the availability of existing inventory,” the statement read. “Product quality and safety have not been impacted.”

Anubis Ransomware Group Takes Credit, Threatens Leak

The Anubis ransomware group listed Coca-Cola and Fairlife on its leak website on July 20, claiming to have encrypted files and stolen 1 TB of confidential data. A timer on the site indicated that the stolen data would be made public within hours unless a ransom was paid.

It’s unclear exactly what type of data was compromised, but extortion gangs often exaggerate the importance of stolen files to pressure victims into paying. This is a common tactic in double-extortion schemes.

Who Is the Anubis Ransomware Group?

Active since December 2024, Anubis has listed roughly 100 targeted organizations on its website. The group uses a double-extortion model: encrypting files on compromised systems and exfiltrating valuable data to increase the chances of getting paid.

What sets Anubis apart is its ‘wiper mode’ feature, which allows it to permanently delete victims’ files and prevent recovery. This makes the group particularly dangerous, as even organizations with backups may lose critical data.

Impact on Coca-Cola and Fairlife

Coca-Cola stated that, based on current information, the incident has not had and is not reasonably likely to have a material impact on the company’s financial condition or results of operations.

Still, the breach raises concerns about the security of supply chain partners. Fairlife, a popular dairy brand, relies on Coca-Cola’s distribution network, and any prolonged disruption could affect retail availability.

Related incidents in the dairy and food sector have shown that ransomware attacks can have cascading effects. For example, the DentaQuest data breach impacted over 23 million people, and the MCBS data breach affected 1.2 million individuals. Even Australian energy giant Origin faced a data breach after being hacked.

What Should Businesses Learn from This?

The Fairlife attack underscores the importance of robust cybersecurity measures, especially for subsidiaries of large corporations. Attackers often target smaller entities within a larger organization, knowing they may have weaker defenses.

Key takeaways for businesses:

• Ensure subsidiaries and third-party partners have strong security protocols.
• Regularly back up critical data and test recovery procedures.
• Monitor for signs of double-extortion ransomware, including wiper capabilities.
• Have a response plan that includes communication with customers and regulators.

As the Anubis group continues its activities, the cybersecurity community will be watching closely. For now, Coca-Cola and Fairlife are left to manage the fallout of a breach that could have been prevented with stronger defenses.

One Request, Full Control

Here’s the nightmare scenario every site owner dreads: an anonymous HTTP request — no login, no special privileges, nothing — and your WordPress installation is running code it shouldn’t. That’s the reality of wp2shell WordPress flaw, a core vulnerability that makes even a bare install with zero plugins exploitable.

The bug sat in WordPress core itself. Every site running version 6.9 or 7.0 was in range. That’s not a niche subset — that’s a massive chunk of the web’s content management backbone.

The Discovery: Assetnote’s Adam Kues

Adam Kues at Assetnote, the attack surface management arm of Searchlight Cyber, found the flaw. He reported it responsibly, and the WordPress team got to work. But the timeline here matters. The disclosure wasn’t a slow burn — it was a race to patch before the public knew what was possible.

Kues’s background in finding similar issues in other platforms likely helped him spot this one. Assetnote has a track record of digging into CMS internals, and this find is squarely in their wheelhouse.

What the Patch Looks Like

On Friday, WordPress shipped two versions: 6.9.5 and 7.0.2. Both close the hole. But here’s the twist — the team also enabled what it calls forced updates through the auto-update system. That’s a significant move. WordPress has always nudged users to update, but forcing the issue for a security patch is a departure from the usual gentle reminder.

The forced update mechanism means that even sites with auto-updates disabled for minor versions might get the fix pushed through. It’s a pragmatic response to a critical flaw, but it also raises questions about control. Do site owners want WordPress deciding when to update? In this case, the answer is probably yes — because the alternative is being hacked.

Why Core Bugs Are Especially Dangerous

Plugins get blamed for most WordPress breaches, and rightly so. But a core vulnerability changes the calculus. It’s not about a badly coded third-party add-on; it’s the foundation itself that’s cracked. The wp2shell WordPress flaw requires no plugins, no themes, no configuration changes. Out-of-the-box WordPress is vulnerable.

That’s why this one feels different. The attack surface is every single site running the affected versions. No excuses, no workarounds, no “just disable that plugin.”

What Site Owners Should Do Right Now

If you haven’t updated yet, stop reading and do it. Here’s the checklist:

• Check your WordPress version — if it’s below 6.9.5 or 7.0.2, you’re exposed.
• Log into your admin dashboard and look for the update prompt. If it’s not there, check manually under Updates.
• Verify the update actually applied by checking the version number in At a Glance or via wp-cli if you use it.
• If you’re on a managed host, confirm they’ve applied the patch on their end.

Don’t assume the forced update got you. It’s designed to help, but you should still verify. A quick check takes two minutes and saves you from a potential takeover.

The Bigger Picture: WordPress Security in 2025

This isn’t the first core flaw, and it won’t be the last. WordPress powers over 40% of the web, making it a prime target for attackers who want maximum impact with minimal effort. The wp2shell WordPress flaw is a reminder that even the most popular CMS isn’t immune to critical bugs.

The good news? Responsible disclosure works. Assetnote didn’t sell the exploit or leak it; they reported it, and WordPress responded with a patch and an aggressive update push. That’s how the system is supposed to work.

But it also highlights the importance of staying current. If you’re running an old version of WordPress because you’re afraid updates will break something, this is your wake-up call. The risk of staying behind far outweighs the risk of a minor plugin incompatibility.

Final Thoughts

The wp2shell WordPress flaw is a serious issue, but it’s also a solved one — provided you update. Check your version, apply the patch, and move on. And maybe take a moment to appreciate the security researchers who find these bugs before the bad guys do.

For more on keeping your site secure, check out our guide on WordPress security hardening and learn how to protect your site from brute force attacks. Staying informed is half the battle.