At DISC 2026? https://events.dragos.com/disc2026 - Reach out if you'd like to chat about Dragos research and runZero product things! Great talks and an amazing community of defenders. I'd post photos/highlights, except its not that kind of conference, and you (literally) have to be here to see them.
home > posts
Trying to scan for the sshhole.com authentication bypass? SSHamble v0.5.0 has you covered, with a helpful PR from Paul Asadoorian (@paulasadoorian)! Code at https://github.com/runZeroInc/sshamble (with a bonus CoreOS check and Dockerfiles to validate both issues end-to-end)
Good news! We've wrapped our initial "Lights Out" research into out-of-band management devices and BMCs. The final advisories are live and OOBscan now includes detections for all issues. The bad news: many of these issues still have no patch (OpenBMC and derivatives) and many EoL devices are forever-exploitable (HPE iLO 4 and below). TL;DR: Turn off IPMI and place BMCs into per-device VLANs if possible.
https://github.com/runZeroInc/oobscan#research-and-disclosures
Code-execution flaw in UEFI firmware affects most servers on planet Earth: https://arstechnica.com/security/2026/10/code-execution-flaw-in-uefi-firmware-threatens-most-servers-on-planet-earth/
This is an interesting bug for a few reasons:
- In part of the code that was heavily fuzzed (but ICMP was skipped)
- In the reference SDK used by huge amounts of downstream firmware
- Exploitable before the PCH check (can attack BitLocker keys in TPM)
- A forever-vulnerability in out-of-support hardwareGreat work by Alex Matrosov (Anthropic) and Dan Holmes-Mitra (Google)!
Python's certifi package provides the trusted root CAs for a huge portion of the Python ecosystem. It's also a great example of how complex dependencies can get. Ultimately, these certs are sourced from Mozilla, but they go through 5 hops and a volunteer-run service to get there:
https://gist.github.com/hdm/2e5ebbffa5f29069a42bb69ea9a045ca
If you're looking for the most detailed AND *entertaining* way to read about the php2shell bugs, the Calif post is epic: https://calif.io/php2shell/
It looks like the PHP RCE details leaked early, (partially) mitigate with `session.upload_progress.enabled = Off` in php.ini — the complete fix requires updating to the patched PHP build (still unreleased) https://jackalsyn.com/posts/php-up-2026.html
The private keys for these certs are literally the numbers 4, 56, 66, 115, 155, 156, 230, and 237 (life imitates XKCD, again).
Hello Austin Gophers! This month's ATX Golang meetup is *tonight* September 9th, at STATION Austin, from 6:30-8:30. Note that we'll be downstairs (first floor) in Wall-E instead of Antones (16th) tonight. Join us for pizza, drinks, Go discussion, and maybe some short talks! https://www.meetup.com/atxgolang/events/312781581
The best part of BSidesLV/BlackHat/DEFCON is getting to meet the people you admire. I got a chance to nerd out with Thai Duong of calif.io today (photo proof!). Thai and team just posted their latest work - 3 remote exploits in FreeBSD - all critical issues if you use HA with your FreeBSD-based firewalls. Noteworthy is that these bugs were found months ago with relatively old model. Vulnerability discovery continues to accelerate!