Industry surveys show organizations increasingly recognize post-quantum cryptography as a priority but have not completed the foundational step of inventorying their cryptographic assets. A DigiCert study found 87% of organizations are planning, testing or implementing PQC, yet only 44% have built transition plans or asset inventories, while Ponemon Institute research found just 43% have full visibility into their cryptographic estate. QubitAC founder Dr. Anurag Swarnim Yadav said companies across the board remain stuck in this early discovery phase.
darkreading.com
· 2026-11-12
At Devcon 8 in Mumbai, Ethereum Foundation researcher Justin Drake said he hopes the network's post-quantum and post-AI transition could be completed by December 2028, a year ahead of the foundation's official December 2029 roadmap deadline. He described this as an aspiration, not a formal commitment, noting it would require shipping three network upgrades within 24 months after an expected early-2027 milestone.
techreport.com
· 2026-11-06
Kaspersky researchers identified a Lazarus Group operation, dubbed FlashHole, that uses the ML-KEM-1024 post-quantum cryptographic standard to secure communications between malware and its command-and-control servers. The campaign, active since July 2025, uses phishing pages linked to crafted GitHub sites to trigger a multi-stage infection chain involving tools like LPEClient, TechHub, and ClientHub, with at least three South Korean firms in software, construction, and telecom equipment confirmed as targets.
bleepingcomputer.com
· 2026-10-21
Latacora has published a revised version of its long-running 'Cryptographic Right Answers' developer guide, updating recommendations in light of an accelerated post-quantum cryptography transition timeline that now targets completion by 2029. The guide states symmetric cryptography remains largely unaffected by quantum threats, but nearly all asymmetric recommendations have changed since the 2018 and 2024 editions. It also now recommends getting cryptographic code reviewed by capable LLMs alongside using memory-safe languages.
words.filippo.io
· 2026-10-12
Forescout Technologies analyzed roughly 2.5 million devices across more than 50 healthcare organizations and found widespread gaps in support for post-quantum cryptography. Only about half of IT devices supported SSH implementations capable of PQC, versus 16% of operational technology and just 6% of Internet of Medical Things devices such as patient monitors and insulin pumps. The firm also found over 5,500 Internet-reachable systems holding medical records and imaging data, only 31% of which used TLS 1.3, the protocol needed for current PQC standards.
darkreading.com
· 2026-10-06
A team including UC San Diego professor Nadia Heninger published research describing a new classical-computing attack that forges RSA signatures without factoring the underlying keys. The method reportedly cracked deprecated 1024-bit RSA keys in a few months using an academic CPU cluster, far less effort than factoring would require, and it also degrades the theoretical security of 2048- and 4096-bit keys.
it.slashdot.org
· 2026-09-25
Bernstein's cr.yp.to blog post argues that switching protocols entirely to post-quantum (PQ) cryptography, rather than combining it with existing ECC, creates unnecessary security risk. He contends that PQ implementations will inevitably contain exploitable bugs, and keeping ECC alongside PQ limits the damage those flaws can cause, at minimal extra cost.
blog.cr.yp.to
· 2026-09-01
GoKawiil