All Posts

Let us get the important part out of the way before somebody's CISO reads a headline and orders an emergency migration off AES at eleven at night. AES is fine. Your TLS is fine. Your disk encryption is fine. Nothing you are running tonight is weaker than it was this morning. Now that the adults have stopped hyperventilating, the actual story is genuinely one of the more interesting things to happen in security this year, and it is not the thing the headlines are pointing at.

Every cloud and hosting contract signed in the last fifteen years rests on the same diagram. There is a line. Below the line is the provider's problem — power, cooling, hardware, hypervisor. Above the line is yours — operating system, patches, application, data. The line is why the arrangement is sellable. It tells two organisations which one gets fired. The baseboard management controller sits below the line, is operated by the provider, and has total authority over everythi

Earlier today we published a census: 31,325 baseboard management controllers answering the open internet, 28.8 percent of them concentrated in eight hosting networks, and roughly 24,650 handing out an authentication hash to anybody who asks before login. A census tells you the size of a surface. It does not tell you what the surface is worth. This post is the second half, and the honest reason to write it is that we understated the first half. "An attacker can power-cycle you

This morning we counted 31,325 baseboard management controllers facing the open internet, and argued that the concentration in hosting providers was the finding rather than the noise a census usually asks you to subtract. Then we asked a question that our own data can answer and most exposure research cannot: are the networks leaking server management interfaces the same networks that attack us? We have an edge that blocks things and keeps the receipts — 2.9 million block eve

On July 1 we published an argument about a botnet nobody needed to care about yet. RustDuck was small. It was not knocking over major services. On a threat-severity chart it barely registered. The post said to watch it anyway, and it said why in one line: A small botnet built like a durable product is not a small threat that will stay small. It is a large threat in its early, cheap-to-stop phase. That is a testable claim, and the honest way to treat a testable claim is to com

Our exposure censuses usually end with a subtraction. When we counted 1,479 internet-facing Ivanti EPM boxes in June, the useful finding was that three-quarters of them were cloud VPS noise, and the number that mattered was much smaller than the number that got reported. We ran the same subtraction on baseboard management controllers this afternoon and it came out the other way. The hosting concentration is not the noise. It is the finding. The numbers Pulled from Shodan toda

Threat intelligence is priced for the wrong hemisphere. The industry standard is a number set in San Francisco or Tel Aviv or London, then charged unchanged to a bank in Ouagadougou, a hospital in Addis Ababa, and a telecom in Lahore. The attacker targeting those places does not adjust for local purchasing power. Neither, usually, does the vendor selling the defense. The result is that the organizations with the least margin for a breach are the ones priced out of seeing it c

Kaspersky researchers Omar Amin and Vasily Berdnikov published a report today on new tooling from the Iranian state-nexus cluster tracked as Nimbus Manticore — you will also see it as UNC1549, Mirage Kitten, Smoke Sandstorm, GalaxyGato, and Subtle Snail, because this industry cannot agree on a name for anything. Three previously undocumented tools: a Windows backdoor called NightLedger, and two tunnelers, BridgeHead and ArcBridge. That is the research. It is theirs, it is goo

There is a version number you should go look up before you do anything else today, and it is on the least interesting box you own. CVE-2026-53921 is a stack buffer overflow in odhcpd, the DHCPv6, DHCPv4 and router-advertisement daemon that OpenWrt runs by default. It rates 9.8. The vector is the one that matters: network-reachable, low complexity, no privileges, no user interaction. An attacker who can send UDP to port 547 can overwrite a stack buffer in a process that runs a

On July 16, Hugging Face disclosed that an autonomous AI agent had breached its production infrastructure. We covered it that week, and the part we thought mattered most was that when Hugging Face's responders went to a frontier model for help reading the attack logs, the safety guardrails refused them — the vendors could not tell an incident responder from an attacker. Today JFrog closed the loop on how the thing got loose in the first place, and the answer deserves more att