CVE-2026-74889 in OpenSSL's openssl_encrypt isn't a cryptographic breakthrough—it's an abstraction failure. The function derives keys using HKDF without salt and with a static info parameter, meaning identical inputs produce identical derived keys across sessions, users, and deployments. This doesn't look like a bug in testing because the function works—it encrypts and decrypts correctly. It only fails under multi-target pressure, where an attacker who recovers one derived key can immediately recognize it in other ciphertexts.
The immediate risk is retroactive exposure. Any attacker who passively collected openssl_encrypt output before the 1.4.0 patch now holds a corpus of ciphertexts encrypted under deterministic key derivation. The patch protects future sessions but offers zero remediation for what was already captured. Assume compromise: rotate any keys derived through openssl_encrypt in versions before 1.4.0, and treat all historical ciphertexts as potentially readable by adversaries who were collecting during the vulnerable window.
Three concrete actions define the response. First, audit your codebase for calls to openssl_encrypt and identify what key material they produced—those keys need rotation now. Second, verify whether your deployment uses openssl_encrypt in contexts where multiple users, sessions, or deployments share derived keys; that's the exact multi-target exposure scenario this CVE enables. Third, check what the 1.4.0 patch actually does. Adding salt isn't sufficient if the salt is static—per-session randomization is what breaks the multi-target attack, and it's not obvious from the CVE description whether the fix achieves that.
The deeper pattern worth watching: this vulnerability almost certainly exists elsewhere in OpenSSL's codebase. The static-info HKDF pattern is a configuration choice that tends to propagate through helper functions, legacy export paths, and internal library calls that weren't in scope for this CVE. The patch fixes this instance; it doesn't audit the class. Your incident response should include a sweep for similar KDF misuse in other code paths.