VulnHub

Real-time Cybersecurity News

Measuring Human Cryptanalysis Effort

Schneier on Security

Overview

Matthew Green has launched a new website aimed at estimating the amount of research time dedicated to analyzing various public-key cryptographic algorithms. By examining around 16,000 academic papers, the site classifies research efforts on topics like elliptic curve discrete logarithm problem (ECDLP) and lattice-based cryptography. The study reveals that lattice-based algorithms have recently surpassed elliptic curves in terms of cumulative research hours. However, the estimates may be inflated as they rely on publication counts rather than actual hours spent. The analysis was conducted with the help of AI models, including Claude and GPT-6 Astra, while Green oversaw the project and determined its methodology. This initiative could provide valuable insights for researchers and cryptographers as they assess the state of public-key cryptography.

Key Takeaways

  • Timeline: Newly disclosed

Original Article Summary

Matthew Green has a new site that tries to estimate the number of cryptanalyst-hours that have been spent analyzing different public-key algorithms: Abstract: We estimate how much public cryptanalysis each public-key assumption has received, using the literature itself as the instrument. From roughly sixteen thousand candidate papers we classify cryptanalytic work on ECDLP, structured and plain lattices, syndrome decoding and their comparators, then convert papers into estimated research-allocation years through a person-level author map. These publication-based estimates may substantially overstate actual time spent. Lattices have overtaken elliptic curves in this cumulative measure only recently; we express that history as inference budgets under stated productivity assumptions. The study was conducted by AI models: Claude Fable 5.1 and Claude Opus 5.5 built the pipeline, ran the analysis and wrote this page, with contributions from GPT-6 Astra. Matthew Green set the questions, made the key methodological decisions and oversaw the work...

Impact

Not specified

Exploitation Status

No active exploitation has been reported at this time. However, organizations should still apply patches promptly as proof-of-concept code may exist.

Timeline

Newly disclosed

Remediation

Not specified

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Read Original Article

Related Coverage

Microsoft Teams to get AI-powered, context-aware phishing detection

BleepingComputer

Microsoft is set to enhance its Teams messaging platform with AI-driven phishing detection capabilities starting in early November 2026. This new feature aims to identify and flag potential phishing attempts within Teams messages, helping users avoid falling victim to scams. The integration of AI is expected to improve the accuracy of phishing detection by analyzing the context of messages. This is particularly important as phishing attacks continue to rise, targeting both individuals and organizations. By implementing this technology, Microsoft hopes to bolster security for its users and reduce the risk of data breaches associated with phishing.

Oct 23, 2026

Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws

The Hacker News

Ruby has released updates to versions 4.0.9, 3.4.12, and 3.3.13 to address three bugs in the Onigmo regular expression engine. These bugs are linked to four critical vulnerabilities that GitLab recently patched. The vulnerabilities could allow attackers to craft specific patterns that may corrupt memory during the compilation process, potentially enabling remote code execution on affected servers. This issue is particularly concerning for GitLab users, as it puts their systems at risk if the vulnerabilities are exploited. Users are encouraged to update to the latest Ruby versions to mitigate these risks.

Oct 23, 2026

Quest Diagnostics confirms data breach exposed patient records

BleepingComputer

Quest Diagnostics, a major American clinical laboratory, has confirmed a data breach involving unauthorized access to its Quanum LSM system. This breach has led to the exposure of sensitive patient records, although the company has not disclosed the exact number of affected individuals or the specific types of data compromised. The incident raises significant concerns about patient privacy and the security of personal health information. As a trusted provider of medical diagnostics, the breach may undermine patient confidence in Quest's ability to protect their sensitive data. This incident serves as a reminder of the ongoing risks faced by healthcare organizations in safeguarding personal information against cyber threats.

Oct 23, 2026

PHP shares mitigation for new RCE vulnerability with no patch

BleepingComputer

The PHP security team has announced a new remote code execution (RCE) vulnerability affecting systems with non-default configurations. This vulnerability currently has no patch available, which raises concerns for users who may be exposed. It is particularly important for administrators to review their configurations to ensure they are not inadvertently leaving their systems vulnerable. The PHP team has provided mitigation measures to help users protect their systems until a fix can be implemented. This situation underscores the ongoing challenges in maintaining secure software environments, especially when vulnerabilities are discovered without immediate solutions.

Oct 23, 2026

You gave your AI agent access, but who is giving it orders?

BleepingComputer

AI agents, designed to assist users, can be manipulated by attackers to perform harmful actions such as stealing data or deleting files. This exploitation occurs through common methods like malicious emails, websites, and plugins that trick the AI into executing unauthorized commands. Gen Digital has introduced its Agent Trust Hub, which aims to enhance the security of these AI agents by verifying their skills, ensuring secure connections, and implementing runtime controls to stop harmful actions before they can cause damage. This incident raises concerns about the security of AI tools, as they operate with legitimate permissions that can be abused if not properly safeguarded. Users and companies need to be vigilant about the commands they give to AI agents and the potential risks involved.

Oct 23, 2026

Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials

The Hacker News

Cybersecurity researchers have revealed a significant breach involving exposed network edge devices, particularly targeting Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. The attackers gained access to over 70,000 user credentials from various organizations around the world. This ongoing campaign aims not only to exploit these devices but also to further compromise the networks of affected victims. Such incidents highlight the vulnerabilities that can arise from improperly secured network devices, urging companies to reassess their security measures. Organizations using these firewall products should take immediate action to secure their systems and protect sensitive information.

Oct 23, 2026