VulnHub

Real-time Cybersecurity News

Critical

Critical U-Boot Bugs Undermine Secure Boot on Millions of Devices

Security Affairs
Critical

Overview

Researchers at Binarly have identified six vulnerabilities in U-Boot, an open-source bootloader used widely in devices such as home routers, smart cameras, and server management controllers. Among these flaws, two are particularly concerning as they allow for unauthorized code execution during the boot image verification process. This affects over 50 different releases of U-Boot, potentially jeopardizing the security of millions of devices connected to the internet. The presence of these vulnerabilities could enable attackers to compromise devices before the operating system even loads, posing serious risks to users and organizations relying on these technologies. It's critical for manufacturers and users to remain vigilant and apply necessary updates as they become available.

Key Takeaways

  • Affected Systems: Home routers, smart cameras, server management controllers, and various embedded hardware utilizing U-Boot.
  • Action Required: Users should check for updates or patches from their device manufacturers that address these vulnerabilities and ensure that their firmware is up to date.
  • Timeline: Newly disclosed

Original Article Summary

Binarly found six U-Boot flaws, including two that enable code execution during boot image verification, impacting 50+ releases. Binarly’s research team has found six vulnerabilities in U-Boot, the open-source bootloader that runs on home routers, smart cameras, server management controllers, and a large portion of the embedded hardware that powers the internet. All six are […]

Impact

Home routers, smart cameras, server management controllers, and various embedded hardware utilizing U-Boot.

Exploitation Status

The exploitation status is currently unknown. Monitor vendor advisories and security bulletins for updates.

Timeline

Newly disclosed

Remediation

Users should check for updates or patches from their device manufacturers that address these vulnerabilities and ensure that their firmware is up to date.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Critical.

Read Original Article

Related Coverage

Progress Told ShareFile Customers to Pull the Plug on Their Servers. Here’s What We Know.

Security Affairs

Progress Software has alerted its ShareFile Storage Zone customers to immediately shut down their internet-facing servers due to a credible security threat that is currently under investigation. An email sent on July 10 emphasized the urgency of the situation, indicating that immediate action is necessary to protect sensitive data. This warning affects customers using the Storage Zone feature of ShareFile, which is designed for secure file storage and sharing. The need for prompt action highlights the potential risks associated with exposed servers, especially in an era where cyber threats are increasingly sophisticated. Customers are advised to take this warning seriously to mitigate any possible security breaches.

Jul 12, 2026

RedHook Android malware now uses Wireless ADB for shell access

BleepingComputer

A new version of the RedHook malware for Android has been discovered using a technique that exploits the Wireless Debugging feature, known as Wireless ADB. This allows attackers to gain shell-level access to devices without needing a physical connection to a computer. This development raises concerns because it can enable unauthorized control over affected devices, putting personal data and privacy at risk. Users of Android devices, especially those with Wireless ADB enabled, should be particularly vigilant. Researchers emphasize the need for users to disable this feature when not in use to mitigate potential risks.

Jul 12, 2026

Week in review: Accenture data breach, great open-source cybersecurity tools

Help Net Security

Last week, Accenture experienced a significant data breach that has raised concerns about the security of sensitive information. While specific details about the breach have not been fully disclosed, it is known that the attack may have compromised client data, which could have serious ramifications for businesses relying on Accenture's services. Cybersecurity experts are urging companies to review their security measures and ensure that they are prepared for potential fallout from this incident. Additionally, there was a discussion on the importance of tools like DMARC and BIMI for securing email communications, highlighting the ongoing challenges in protecting digital identities and brand integrity. This breach serves as a reminder of the vulnerabilities that large organizations face and the need for robust security practices.

Jul 12, 2026

Security Affairs newsletter Round 585 by Pierluigi Paganini – INTERNATIONAL EDITION

Security Affairs

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added vulnerabilities in iCagenda and Balbooa Forms to its Known Exploited Vulnerabilities catalog. These flaws could allow attackers to compromise systems that utilize these applications, potentially leading to unauthorized access or data breaches. Organizations using these products should assess their systems for the vulnerabilities and apply any available patches or updates. The inclusion of these vulnerabilities in the CISA catalog signals their seriousness and emphasizes the need for organizations to stay vigilant about securing their software. This update is part of ongoing efforts to inform the public about critical vulnerabilities that could be exploited by cybercriminals.

Jul 12, 2026

U.S. CISA adds iCagenda and Balbooa Forms flaws to its Known Exploited Vulnerabilities catalog

Security Affairs

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added vulnerabilities associated with iCagenda and Balbooa Forms to its Known Exploited Vulnerabilities catalog. iCagenda is an open-source event management extension for Joomla, while Balbooa Forms is a popular form builder for Joomla sites. The inclusion of these flaws in the catalog means that they are recognized as actively exploited vulnerabilities, posing a risk to users of these platforms. It's essential for site administrators using these extensions to take immediate action to secure their systems and protect sensitive data. Ignoring these vulnerabilities could lead to unauthorized access or data breaches, affecting both website operators and their users.

Jul 11, 2026

Hackers Weaponize Balochistan Police Portal in Multi-Group Espionage Campaigns

The Hacker News

Cybersecurity researchers have reported a series of cyber espionage attacks targeting multiple law enforcement agencies in Pakistan, specifically between February 2024 and April 2026. The Balochistan Police's web applications, which manage sensitive police and citizen data, were among the compromised assets. The attackers are believed to be linked to threat actors aligned with either China or India. This incident raises serious concerns about the security of law enforcement data in Pakistan and the potential implications for public safety. Such breaches not only compromise sensitive information but also can undermine trust in law enforcement institutions.

Jul 11, 2026