BOUNCY CASTLE CVE-2026-71885 HARVESTED THE CREDENTIAL BINDING THAT AUTHENTICATES AGENT-TO-AGENT CHANNELS

Summary from the TLDR InfoSec newsletter

A critical vulnerability in Bouncy Castle for Java versions before 1.86 lets attackers spoof legitimate participants and decrypt messages within Messaging Layer Security groups. Improper certificate validation in the protocol implementation lets threat actors bypass core security objectives by presenting arbitrary credentials. Developers must upgrade to version 1.86 to enforce cryptographic binding between end-entity certificates and LeafNode signature keys.