😳
It would be ironic if AI used this exploit to turn itself and every computer on the planet off forever.
Like fuck this mess, I’m out. Peace.
Then we’d have to fix our own shit and start taking to each other instead of destroying each other.
Venusian war begins.
Somewhere in the NSA someone is going “damnit! They found that one too!?”
In the PXE boot code. Very low risk for the vast majority of people.
You also need to have sufficiently infiltrated the target’s local network to masquerade as a PXE server, and be in a position to force a server to reboot / just wait for one to reboot. Yes, a few places have large, fairly open networks with a lot of devices configure to PXE boot and they should apply the update before the next reboot, but vast majority of people, no issue at all.
If a hacker can get PXE boot working reliably I’d hire them
Since it is remote execution in UEFI, does that mean if you compromised the system you can now use this to install a backdoor in the firmware so wiping and reinstalling won’t help?
Thanks for clarifying this VERY relevant part.
What about Planet Phatt?
The parties that discovered CVE-2026-97631—Alex Matrosov of Anthropic and Dan Holmes of Google—had arranged for it to stay under wraps until a coordinated disclosure that was scheduled for January. AMI, a maker of motherboards and other hardware, published this pull request last month that detailed the vulnerability and included a code fix. Once the post came to the attention of the discovering parties, TianoCore Project members published a public advisory last week.
Hot take: botched disclosures like this should open a company to criminal liability. We need to start treating SWE with the same level of scrutiny we do other engineering fields and not “oopsie poopsie, I accidentally just disclosed an attack that endangers global infrastructure.”
Edit: Also, just of fucking course it’s a buffer overflow in C code. “No way to prevent this, says only nation where this regularly happens” vibes.
That is indeed a hot take. The cve involves crafting a PXE packet, so just… Don’t use PXE in your environment.
If you do, you already know of the dangers of signing exploits in boot images, DNS shenanigans, and all that.
I’m not saying this isn’t serious, but it’s not really the end of the world.
Ok so just don’t turn computers on anymore. Got it 👍
Welp, never reboot ig
