HollowByte DDoS flaw bloats OpenSSL server memory with 11-byte payload

BleepingComputer roundup covering multiple high-impact security events: a new HollowByte OpenSSL flaw allows unauthenticated DoS with an 11‑byte payload; a Windows zero‑day (LegacyHive) grants local privilege escalation on up‑to‑date systems; CISA ordered urgent patching of actively exploited Fortinet FortiSandbox vulnerabilities; and Ernst & Young disclosed a data breach via a compromised third‑party support system. Additional notable items include macOS ClickLock info‑stealer that coerces users to reveal passwords, a Claude Chrome extension weakness that lets malicious extensions trigger AI‑