AWS now lets you pick hybrid ML-KEM key-exchange groups on Aurora PostgreSQL 18 through the ssl_groups parameter, with no reboot. Turn it on for databases holding long-lived data to neutralize harvest-now-decrypt-later collection.
On October 21, 2026, Kaspersky revealed operation FlashHole: North Korea’s Lazarus Group uses ML-KEM-1024, the NIST-approved post-quantum standard, to encrypt C2 traffic and hide the final payload. Cryptography designed to survive quantum computers is now being used to blind today’s analysts: revisit your network detection if your threat model includes North Korea.
On 29 September 2026, Cloudflare announced its intent to become a public certificate authority, twelve years after launching Universal SSL, with a root acquired from GlobalSign and applications to the Chrome, Apple, Microsoft, and Mozilla root programs. It is targeting post-quantum certificates and Merkle Tree Certificates as early as Q1 2027: a second mass-scale free provider is taking shape, and your ACME deployment chain must be able to switch.
The v1.38.0-alpha.1 pre-release adds beta support for ML-DSA signing of pod certificates and CSRs, preparing the control plane for the post-quantum era. Enable the CertificateSigningRequestMLDSA feature gate on a test cluster and map your gRPC dependencies before upgrading.
On September 17, 2026, AWS released Corretto 27, its free OpenJDK distribution, with hybrid post-quantum key exchange for TLS 1.3 and compact object headers turned on by default. Test these wins in non-critical environments, but keep your LTS workloads on Java 21 or 25 — this release is only supported through April 2027.
The public resolver 1.1.1.1 now validates DNSSEC signatures made with ML-DSA-44, the NIST-standardized post-quantum algorithm whose every signature weighs 2,420 bytes. It is the first Internet-scale test of carrying oversized DNS responses and blocking downgrade to weakened algorithms.
On September 9, 2026, the first OpenSSL 4.1 alpha enabled DTLS 1.3 — shorter handshakes, forward secrecy and built-in post-quantum crypto — plus GREASE, the mechanism that stops middleboxes from ossifying TLS. For anyone running gateways, IoT fleets or UDP-based services, it is the signal to start planning the migration.
On August 19, 2026, the Go team released version 1.27, six months after 1.26. It adds generic methods, an encoding/json/v2 package with stricter defaults, and the ML-DSA post-quantum scheme wired into TLS 1.3.
On August 11, 2026, Google Cloud published its post-quantum cryptography migration roadmap, targeting full readiness by 2029 with dated milestones for 2027 and 2028. For a customer, Store Now Decrypt Later risk now has a deadline: the cryptographic inventory starts today.
