The v1.38.0-alpha.1 pre-release adds beta support for ML-DSA signing of pod certificates and CSRs, preparing the control plane for the post-quantum era. Enable the CertificateSigningRequestMLDSA feature gate on a test cluster and map your gRPC dependencies before upgrading.
On September 17, 2026, AWS released Corretto 27, its free OpenJDK distribution, with hybrid post-quantum key exchange for TLS 1.3 and compact object headers turned on by default. Test these wins in non-critical environments, but keep your LTS workloads on Java 21 or 25 — this release is only supported through April 2027.
The public resolver 1.1.1.1 now validates DNSSEC signatures made with ML-DSA-44, the NIST-standardized post-quantum algorithm whose every signature weighs 2,420 bytes. It is the first Internet-scale test of carrying oversized DNS responses and blocking downgrade to weakened algorithms.
On September 9, 2026, the first OpenSSL 4.1 alpha enabled DTLS 1.3 — shorter handshakes, forward secrecy and built-in post-quantum crypto — plus GREASE, the mechanism that stops middleboxes from ossifying TLS. For anyone running gateways, IoT fleets or UDP-based services, it is the signal to start planning the migration.
On August 19, 2026, the Go team released version 1.27, six months after 1.26. It adds generic methods, an encoding/json/v2 package with stricter defaults, and the ML-DSA post-quantum scheme wired into TLS 1.3.
On August 11, 2026, Google Cloud published its post-quantum cryptography migration roadmap, targeting full readiness by 2029 with dated milestones for 2027 and 2028. For a customer, Store Now Decrypt Later risk now has a deadline: the cryptographic inventory starts today.
