Security news aggregator

Latest coverage for Firmware

Stay updated on firmware security: Explore the latest threats, updates, and protection strategies for safeguarding critical system software.

8 headlines in this view

Refine the feed

Search across headline titles and summaries.

Tag briefing

Background for this topic.

Firmware is software stored in a device’s nonvolatile memory that initializes and controls hardware, often before an operating system or application runs. It may reside in computers, network equipment, phones, industrial controllers, storage devices, and embedded components. Firmware can be updated, so it is not necessarily permanent or read-only.

Firmware matters to security because vulnerabilities or unauthorized changes can affect a device beneath the operating system and may persist across software reinstallation. Important controls include authenticated, cryptographically signed updates; secure boot, which verifies code before execution; protection against unauthorized flashing and downgrade attacks; and a reliable recovery mechanism. Practitioners also need firmware inventories, vulnerability tracking, and a supported update process, since obscure components can remain unpatched or use insecure update mechanisms. During an investigation, verifying firmware integrity and the device’s boot chain can help distinguish an operating-system compromise from a deeper modification.

Volume over time

Weekly headline count for the current query.

Showing 8 most recent headlines Filtered view

CERT/CC warns an unpatched backdoor in several Tenda routers lets attackers bypass login and gain full admin access with a hidden password. CERT/CC published an alert documenting an undocumented authentication backdoor in multiple Tenda firmware versions, tracked as CVE-2026-11405. The flaw gives anyone who knows the right password full administrative access to the device’s web […]

More from Security Affairs 7 Jul 2026, 9:45 p.m. Incident · 5 stories CVE-2026-11405 Authentication Backdoor Bypass CVE Firmware Flaw Patch Routers Warning

Fortinet has confirmed a new, actively exploited critical FortiCloud single sign-on (SSO) authentication bypass vulnerability, tracked as CVE-2026-24858, and says it has mitigated the zero-day attacks by blocking FortiCloud SSO connections from devices running vulnerable firmware versions. [...]

More from Bleeping Computer 28 Jan 2026, 12:19 p.m. Actively exploited CVE-2026-24858 0-Day Authentication Bypass CVE Firmware Fortinet Patch SSO Vulnerability

Cybersecurity researchers have discovered a new ransomware strain dubbed HybridPetya that resembles the notorious Petya/NotPetya malware, while also incorporating the ability to bypass the Secure Boot mechanism in Unified Extensible Firmware Interface (UEFI) systems using a now-patched vulnerability disclosed earlier this year

More from The Hacker News 12 Sep 2025, 11:50 p.m. CVE-2024-7344 Antivirus Bypass CVE Disclosure Exploit Firmware Malware Patch Ransomware Research Vulnerability
Bank Info Security 1 year, 7 months ago

OpenWrt Update Flaw Exposed Devices to Malicious Firmware

Embedded Device Operating Sytem Had Flaw Allowing Hacers to Bypass Integrity CheckA critical flaw in the updating service of a popular Linux operating system for embedded devices could enable hackers to compromise firmware with malicious images. OpenWrt developers patched the vulnerability, with a CVSS core of 9.3 and tracked as CVE-2024-54143.

More from Bank Info Security 11 Dec 2024, 10:00 a.m. CVE-2024-54143 Bypass Compromise Critical Vulnerability CVE Exposure Firmware Flaw Linux Patch Vulnerability