Cascadity Audio
← All streams

#disclosure

Everything tagged disclosure, across every stream.

0
CCybersecurity #disclosure#firmware#secure-boot#servers#uefi#vulnerability

A 16-year-old flaw in the firmware code most servers boot from leaks out months before its planned disclosure

Ars explains who is actually exposed (network-booting machines, not home PCs) and what admins can do while vendors stay quiet.

A memory-corruption bug in TianoCore EDK II, the open source code that most makers of UEFI boot firmware build on, can let an attacker run code before the operating system and Secure Boot load, Ars Technica reports. The flaw, CVE-2026-97631, is rated 9.5 of 10 and sits in the network-boot (PXE) driver, which copies incoming ICMP error messages into a fixed 504-byte field without enforcing the limit.

It was found by Alex Matrosov of Anthropic and Dan Holmes-Mitra of Google and was meant to stay secret until a coordinated disclosure in January, but a public code fix from AMI exposed it and TianoCore published an advisory.

The limits matter: an attacker must reach the machine during network boot, typically from inside the local network, and exploits must be tuned to each firmware build. Home and office users who boot from disk are not affected. Intel and Arm told Ars their own products are not directly affected; AMD, AMI, Phoenix, Microsoft and Amazon had not answered. Ars suggests asking the firmware maker for guidance and turning off network boot where possible.

Rabbit Holes 2
Generated by AI.
0
MVMaker Views #ai-security-research#coordinated-disclosure#disclosure#Hacker-News#patch#php#remote-code-execution#vulnerability#web-servers

PHP patches two critical remote code execution flaws after a leak forces an early release

If you run PHP, update. The Foundation post is a frank account of how a 2024 lead stalled and how the disclosure unraveled.

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution: CVE-2026-109618 (out-of-memory handling leaves request data half-initialized) and CVE-2026-109619 (state from a freed request is reused by a later one). The PHP project says every installation serving web requests is at risk, mod_php most of all, and urges an immediate update; it also published minimal backports for PHP 7.4 to 8.1.

The PHP Foundation says the first signs of the memory bug surfaced during a 2024 audit, but work on a fix stalled, which it calls a structural failure. Reports from Calif, OpenAI and Wiz in August made the impact clear. After the CVE IDs leaked on October 20, the release was moved up a day; security firm Calif mistakenly published a demo video, and the Foundation says Chainguard broke the embargo by publishing fixed images hours early.

Three Hacker News threads (the top one 1,549 points) argued over embargoes versus releasing fixes at once, Chainguard's move, and admins racing to patch or shut servers down.

Cascadic Analysis 1
UndertowAutonomous cyber capability scales attackers enormously

What hidden risk could pull against this, even if the news is good?

Amazon says it saw an exploit attempt on its honeypots on October 17, four days before disclosure, and proof-of-concept exploits within hours of release, adding that AI-assisted analysis makes it cheaper to turn a patch or advisory into a working exploit. The PHP Foundation describes the other side: AI-assisted research means far more reports, with 15 CVEs since July 1 and more than 100 reports that turned out to be invalid, all handled by a small team.

0
Rabbit Holes 2

Sign in to upvote

Your votes tell us which stories, analysis and rabbit holes are worth it. We'll bring you right back to this spot and count your vote.

Sign in Create an account