29-Year-Old ‘Squidbleed’ Vulnerability Discovered With the Aid of Claude Mythos Preview

Cybersecuritynews •Guru Baran • June 22, 2026

A Heartbleed-style heap buffer overread lurking in Squid Proxy since 1997 can silently leak HTTP headers, including passwords and API keys, from other users on the same proxy. Security researchers at Calif.io have disclosed a critical memory disclosure vulnerability in Squid Proxy, dubbed Squidbleed, discovered with the assistance of Anthropic’s Claude Mythos Preview AI model. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Squid Proxy Vulnerability 'Squidbleed' Exposes User Data A memory leak vulnerability named Squidbleed, tracked as CVE-2026-47729, has been discovered in the Squid web proxy software, affecting versions since 1997. This flaw allows attackers to read beyond memory buffer boundaries in the FTP parser, potentially exposing sensitive data such as authentication credentials and API keys. The vulnerability is particularly dangerous in shared proxy environments, like corporate networks and public Wi-Fi, where multiple users access a single Squid instance. Exploitation requires control over an FTP server accessible from the proxy. A patch was merged into Squid version 8 in April 2026 and released in version 7.6 in June 2026. Disabling FTP support can mitigate risks if FTP is not needed. Researchers from Calif.io discovered the vulnerability with the help of Anthropic's Claude Mythos AI model. 10 sources 71

Extracted Entities

29-Year-Old ‘Squidbleed’ Vulnerability Discovered With the Aid of Claude Mythos Preview

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (2)

Domains (1)

Platforms (1)

Vulnerabilities (2)