Code-execution flaw in UEFI firmware affects most servers on planet Earth: https://arstechnica.com/security/2026/10/code-execution-flaw-in-uefi-firmware-threatens-most-servers-on-planet-earth/

This is an interesting bug for a few reasons:
- In part of the code that was heavily fuzzed (but ICMP was skipped)
- In the reference SDK used by huge amounts of downstream firmware
- Exploitable before the PCH check (can attack BitLocker keys in TPM)
- A forever-vulnerability in out-of-support hardware

Great work by Alex Matrosov (Anthropic) and Dan Holmes-Mitra (Google)!

Python's certifi package provides the trusted root CAs for a huge portion of the Python ecosystem. It's also a great example of how complex dependencies can get. Ultimately, these certs are sourced from Mozilla, but they go through 5 hops and a volunteer-run service to get there:

https://gist.github.com/hdm/2e5ebbffa5f29069a42bb69ea9a045ca

If you're looking for the most detailed AND *entertaining* way to read about the php2shell bugs, the Calif post is epic: https://calif.io/php2shell/

It looks like the PHP RCE details leaked early, mitigate with `session.upload_progress.enabled = Off` in php.ini: https://jackalsyn.com/posts/php-up-2026.html

Hello Las Vegas (and hackers following along at home)! I'm excited to share the first batch of our Out-of-Band / Baseboard Management Controller research at Black Hat USA today and DEFCON 34 this weekend. Read an exclusive by Ars Technica at:

https://arstechnica.com/security/2026/08/thousands-of-servers-can-be-backdoored-by-exploiting-buggy-motherboard-controllers/

Interested in checking your network? The pre-release of OOBscan is live on GitHub: https://github.com/runZeroInc/oobscan

Thank you to our friends at Dragos.com, NetRise.io, and all of the researchers abroad who helped with review & feedback!

Tom Ptacek posted a great writeup titled "Vulnerability Research Is Cooked", covering the state of vulndev and its rapidly accelerating future:
https://sockpuppet.org/blog/2026/03/30/vulnerability-research-is-cooked/

New AirSnitch attack breaks Wi-Fi encryption in homes, offices, and enterprises: https://arstechnica.com/security/2026/02/new-airsnitch-attack-breaks-wi-fi-encryption-in-homes-offices-and-enterprises/

AirSnitch resets WiFi security back to the bad-old-days of ARP spoofing and trivial MITM.

Just like chocolate and peanut butter, runZero and BloodHound are an amazing combination. Today we are introducing runZeroHound - an open source toolkit for bringing runZero Asset Inventory data into BloodHound attack graphs, using the brand new OpenGraph feature in BloodHound v8. Check out the announcement and open source code at: https://www.runzero.com/blog/introducing-runzerohound/

SpecterOps released "DumpGuard" along with a detailed article on how they were able to bypass Windows Credential Guard in both privileged and unprivileged contexts. I learned a ton about Isolated LSA and friends. Its funny to see that DES-cracking of NTLMv1 challenges is still relevant (and that https://ntlmv1.com/ has supplanted https://crack.sh).

Article: https://specterops.io/blog/2025/10/23/catching-credential-guard-off-guard/

DumpGuard: https://github.com/bytewreck/DumpGuard

Thank you to everyone who made it out for my DEF CON 33 presentation, "Shaking Out Shells With SSHamble", you can find the materials online at https://hdm.io/decks/MOORE%20-%20Shaking%20Out%20Shells%20With%20SSHamble.pdf

This deck includes some lightly-censored zero-day and I recommend tossing `sshamble scan -u root,admin,guest 22,24442,2222,70,222,10022,10399,2022,22222 --interact=all` at your local network to see what shakes out =D

(PS. You can find most of my presentations at https://hdm.io/)

Are you an Austin-area software engineer who writes Go (or aspires to become one)? Join us Wednesday, August 13, 2025 for two hours of lightning talks and discussion, including recaps of awesome Go work presented at the Black Hat and DEF CON conferences. Have a short talk on Go (with or without security focus)? Bring it!

This meetup is hosted by Capital Factory and runs from 6:30 PM to 8:30 PM CDT: https://www.meetup.com/atxgolang/events/305492505/?slug=atxgolang&eventId=305492505

Please RSVP so we can accurately order enough pizza and drinks.

The researchers who found the Next.js middleware vulnerability (CVE-2025-29927) have released the full paper: https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware

Notable is that the auth bypass requires the x-middleware-subrequest value to be one of these two forms:
middleware:middleware:middleware:middleware:middleware OR
src/middleware:src/middleware:src/middleware:src/middleware:src/middleware

PS. Are you an Austin local? DM or email me for a discount code (x[at]hdm.io)

Texas hacker-people - Ringzer0's BOOTSTRAP25 conference is in Austin, Texas one week from today (Friday night mixer, Saturday day conference)! Mixer tickets are $70, full-day conference pass for Saturday (including workshops) is $249. It should be an amazing event and I hope to see you there!

Registration @ https://ringzer0.regfox.com/bootstrap25-austin
Schedule @ https://cfp.ringzer0.training/ringzer0-bootstrap25-austin/schedule/

The Tarlogic claim of backdoor functions in the ESP32 Bluetooth firmware seem overblown. The features they identified require privileged code execution and are helpful for improving open source software for these devices.

Useful resources:

- https://darkmentor.com/blog/esp32_non-backdoor/
- https://x.com/naehrdine/status/1898703255883886909
- https://esp32-open-mac.be/ (WiFi, not BT, but similar work)

Great update from Stefan Viehböck on VxWorks’ password hashing (and 6.x EoL): https://sec-consult.com/blog/detail/a-missed-opportunity-addressing-weak-password-hashing-in-vxworks/

Hi folks! I'm thrilled to present runZero's latest applied research: "Inside Out Attack Surface Management". With IOASM you can immediately identify exposures that other approaches miss, with zero false positives, and no additional investment. Join me for a live demo on Wednesday, December 4th at 1PM EST: https://dr-resources.darkreading.com/free/w_runz04/

At least they are using #golang https://www.ac3.com.au/resources/discovery-of-CVE-2024-2550/

Happy Thanksgiving to my fellow US-ians. This is an annual reminder that Base64 can decode different input to the same output. "Secrets" decodes from U2VjcmV0cw==, U2VjcmV0cw=, U2VjcmV0cw, U2VjcmV0cx, U2VjcmV0c9, and sometimes U2V|jcm|V0c|9.

Base64 makes a bad hash or lookup key!

https://m.youtube.com/watch?v=VYOjWnS4cMY