A firmware flaw in Coldcard Bitcoin hardware wallets let attackers reconstruct wallet seeds offline and sweep roughly 70 million dollars from 1,196 addresses in 41 minutes on July 30. A March 2021 build error routed seed generation to a weak software random number generator instead of the device's hardware one, because the check confirmed a configuration macro existed rather than that it was enabled. That collapsed the randomness behind seeds to as little as 40 bits on older models, letting an attacker who can constrain the device identifier and timer state reproduce candidate seeds and match them to funded addresses. Coinkite shipped emergency firmware, but updating does not repair an already-generated seed.
Researchers at ESET found 11 old Microsoft-signed Linux boot components, called shims, that can be used to bypass UEFI Secure Boot on almost any PC, regardless of its operating system. The trick needs no new vulnerability: because these shims were signed years ago with a trusted Microsoft certificate and never revoked, an attacker with admin or boot-level access can copy an old vulnerable shim onto a machine and run untrusted code before the operating system loads. That enables stealthy bootkits that survive reinstalls and start before security tools. Microsoft revoked all 11 in June by blocklisting their hashes, which Windows applies automatically and Linux systems can pull through firmware updates.
Researchers at Binarly found six flaws in U-Boot, the open-source bootloader inside routers, IoT devices, industrial systems, and the management chips of data-center servers. All six are triggered while U-Boot is still reading an untrusted firmware image, before it verifies the signature, so an attacker who supplies a malicious image can act before the trust check runs. Two of the flaws can lead to arbitrary code execution at boot, undermining the whole chain of trust, while the other four crash the device. The vulnerable code dates back to 2013, affecting many releases and vendor forks. Exploiting them does not always need physical access: a compromised management interface could push a malicious image.
CERT/CC has warned that several Tenda router firmware versions contain an undocumented authentication backdoor that grants full administrative access to the web management interface. Tracked as CVE-2026-11405, the flaw lives in the login function of the router's web server: if normal password checking fails, the firmware compares the supplied password against a hidden value stored in the device configuration and, on a match, grants admin access regardless of the username. It affects models including the FH1201, W15E, AC10, AC5, and AC6, is baked into the firmware, and cannot be disabled from the interface. Tenda has not responded, so there is no fix, and public exploit tooling is already scanning for vulnerable devices.
Researchers at runZero disclosed seven vulnerabilities in FatFs, a tiny filesystem library that lets devices read FAT and exFAT media like USB drives and SD cards and that is bundled into the firmware of countless embedded and industrial products. The most serious, CVE-2026-6682, is an integer overflow when mounting a FAT32 volume that can lead to memory corruption and code execution, and several bugs are reachable through firmware update flows, not just physical media. The hard part is patching: FatFs is maintained by a single developer who did not respond to the researchers, so most of the memory-corruption flaws have no upstream fix and downstream vendors may never learn they are affected.
The original 2011 Microsoft certificates that underpin UEFI Secure Boot begin expiring in late June 2026, and organizations that have not rolled out the replacement 2023 certificates risk a slow erosion of boot-level security. Devices will keep starting normally, but once the old certificate authorities lapse they stop receiving Secure Boot updates for pre-boot components, leaving them more exposed to bootkits, and future bootloaders signed only with the new keys may fail to verify. Most consumer Windows PCs receive the 2023 certificates automatically through Windows Update, but Windows Server and many self-managed or older fleets need manual action. A second certificate that signs the Windows bootloader expires in October.
TrustStrike Labs