Six vulnerabilities in the widely used U-Boot bootloader have been discovered that could allow attackers to execute malicious code during device boot, potentially enabling stealthy firmware attacks that compromise security protections and install persistent malware.

U-Boot is one of the world’s most widely used open-source bootloaders and is found in many embedded Linux devices, including enterprise servers’ Baseboard Management Controllers (BMCs), networking equipment, industrial systems, IoT devices, and other appliances.

Because U-Boot is responsible for loading the operating system, vulnerabilities in the bootloader can allow attackers to compromise a device before the operating system and its security software have a chance to start.

One of its security features, known as Verified Boot, uses cryptographic signatures to ensure that only firmware and operating system images signed by a trusted key are loaded during startup.

In a report published this week, firmware security company Binarly disclosed six vulnerabilities in U-Boot’s FIT (Flattened Image Tree) signature verification code.

“Recognising the critical nature of this component, the Binarly Research team decided to examine the core functionality of the U-Boot project more closely,” explains Binarly.

“This research revealed six distinct vulnerabilities, ranging in impact from denial of service (DoS) to arbitrary code execution during the verification of an untrusted image.”

According to the researchers, two of the flaws can potentially lead to arbitrary code execution during firmware verification, while the remaining four can be exploited to crash vulnerable devices. 

As these flaw impact the code for validating firmware images before the operating system starts, if an attacker can exploit that process, they may be able to execute malicious code before the operating system loads.

The six disclosed vulnerabilities are:

• BRLY-2026-037: A flaw that can cause U-Boot to crash when processing a malicious firmware image and, under certain conditions, can be used for arbitrary code execution.
• BRLY-2026-038: A memory corruption vulnerability that could allow attackers to execute arbitrary code during firmware signature verification.
• BRLY-2026-039: An out-of-bounds read vulnerability that can crash devices by forcing U-Boot to read beyond the firmware image.
• BRLY-2026-040: A null pointer dereference that allows specially crafted firmware images to crash the bootloader.
• BRLY-2026-041: Improper validation of externally stored firmware data that can cause U-Boot to crash when processing malicious firmware images.
• BRLY-2026-042: An unbounded recursion flaw that can exhaust available stack memory and crash the bootloader.

According to Binarly, most of the vulnerable code has existed since U-Boot version 2013.07, causing the flaws to potentially affect more than 50 releases of the project as well as vendors who utilized the vulnerable code in their own firmware.

“This means that they potentially affect over 50 stable releases of the U-Boot project. Counting many downstream vendor forks, these vulnerabilities have a significant impact on the industry,” explains Binarly.

If successfully exploited, the arbitrary code execution vulnerabilities could allow attackers to execute code during the earliest stages of the boot process.

Because this occurs before the operating system loads, attackers could potentially disable firmware security features, modify the boot process, install persistent firmware malware, or carry out other malicious actions with high levels of access.

Binarly says that malicious would be difficult to detect because they execute before the operating system starts.

Binarly says exploiting these vulnerabilities does not always require physical access. On systems such as BMCs that support remote firmware updates, an attacker who has already compromised the management interface could upload a specially crafted firmware image to exploit the flaws.

Binarly reported the vulnerabilities to the U-Boot maintainers and submitted patches for all six issues, which have since been accepted into the project’s upstream codebase.

However, because U-Boot is integrated into firmware by individual hardware manufacturers, the fixes must first be incorporated into vendors’ firmware updates before they can be distributed to customers.

Older or unsupported devices that no longer receive firmware updates may never be patched.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

On-Prem

Green groups want licenses frozen before a million satellites litter the exosphere

Environmental groups want the FCC to slam the brakes on orbital datacenters, arguing the agency shouldn’t approve constellations they say would total more than a million satellites before taking a hard look at their environmental impact.

Earthjustice, acting on behalf of DarkSky International, Environment America, and Public Employees for Environmental Responsibility (PEER), filed a petition this week urging the regulator to prepare a Programmatic Environmental Impact Statement (PEIS) under the National Environmental Policy Act (NEPA) before approving any of the pending applications.

The filing doesn’t target any single company. Instead, it asks the regulator to put the entire emerging orbital datacenter sector on hold while it assesses the cumulative effects of proposals from SpaceX, Starcloud, Blue Origin, Cowboy Space, and any similar applications that follow. According to the petition, those proposals collectively seek “well over a million datacenter satellites” in low Earth orbit.

“The FCC is currently considering multiple requests for licensing extraordinary numbers of satellite-based datacenters to be placed into low-earth orbit over the next decade,” the petition states. “Collectively, the proposals seek to place well over a million datacenter satellites into orbit, increasing the existing volume of satellites in low-earth orbit by multiple orders of magnitude.”

The groups argue that the FCC is trying to apply licensing rules written for much smaller satellite constellations to an entirely new class of infrastructure.

“If ever a situation warranted a PEIS, it is this one,” the petition says. It argues that a single review would allow the agency to examine “the risks, alternatives, needs, costs, and impacts of this sudden transformation of Earth’s exosphere” before deciding whether any of the projects are in the public interest.

The petition raises concerns about rocket launch emissions, pollutants released as satellites burn up during atmospheric reentry, depletion of the ozone layer, orbital debris, light pollution, impacts on wildlife, and interference with astronomy.

It also argues that the combined effects of these constellations cannot be understood by evaluating applications one at a time.

“It is difficult to imagine a better example of multiple projects presenting essentially identical impacts and risks that compound synergistically and cumulatively than the present proposals for orbital datacenter constellations,” the petition argues. “The FCC’s default position that such projects ‘individually and cumulatively’ have no environmental impact is plainly inapplicable here.”

The groups also criticize the applicants, saying they make expansive claims about the benefits of orbital computing while offering little detail about its environmental consequences.

“The proponents of these proposals describe their plans in grandiose, civilization-changing terms,” the petition states. “But these same proponents have refused to embrace any inquiry into the impacts of their self-claimed epochal technology on the environment, science, economy, or other values.”

The petition arrives as the FCC reconsiders its environmental review rules for satellites, acknowledging that rapid growth in the space industry has raised new questions about how to apply its existing framework. The petition argues that the FCC’s current approach, which generally treats satellite licenses as categorically excluded from detailed environmental review, is no longer fit for proposals measured not in dozens or thousands of spacecraft but in hundreds of thousands and, potentially, millions.

If the FCC agrees, orbital datacenter operators will have a mountain of paperwork to clear before sending their hardware skyward. ®

PERSONAL TECH

Open source recreation costs a fraction of the original and may even work with Twiggy drives

Apple Lisas are rare now. Here’s a rather cheaper way to build your own – and in theory, it can even use original floppy drives.

LisaFPGA does what it says on the GitHub repo: “The Apple Lisa computer implemented inside an FPGA!”

It’s an open source project that recreates a complete Apple Lisa on an FPGA board. It’s not entirely complete yet, but hardware went on sale in May and you might still be able to buy one – or download the bitstream of the model and build your own.

The Apple Lisa was a very strange computer, in part because it was pioneering new design territory. Apple started the project before the famous visits to Xerox PARC to see what became the Alto – also a radical machine, as The Reg FOSS desk tried to describe in 2023 for the machine’s 50th anniversary. After those visits (for which Apple paid Xerox in shares, which the photocopier giant promptly sold), Apple changed course. Now the Lisa would be the first mass-market computer with a GUI. (The “mass market” bit didn’t work out, and 2,700 unsold Lisas ended up as landfill in 1989.)

Even so, it was a very important and influential machine: The Register celebrated its 30th birthday and indeed took another look back in 2019.

So it’s quite hard to find an Apple Lisa today, and if you manage to do so, it will probably (a) cost you quite a lot of money and (b) not be in working condition. That’s a shame because Apple released the source to Lisa OS for the machine’s 40th birthday in 2023.

The enterprising developer behind LisaFPGA is Alex Anderson-McLeod, and he built his knowledge of the Lisa and its implementation from an earlier project. Last year, he managed to work out how to compile and build Lisa OS from Apple’s source code. This was a particularly difficult effort, and he documents the process of Lisa OS Source Code Compilation at length. We’ve read the account closely and we think it’s fair to say the build process is deeply arcane.

(Sadly, the repo does not contain the source code itself, as the very strange “Apple Academic License Agreement” allows recompilation and study, but it forbids redistribution. To get the code, you’ll have to agree to the license on the Computer History Museum.)

Anderson-McLeod learned a great deal about how the Lisa works while rebuilding the OS, and he’s applied that knowledge to designing and building LisaFPGA. It is not completely finished – under “Features,” the Introduction section of the README states: “Onboard ESP32-based floppy drive emulation (NOTE: THIS DOESN’T WORK YET).”

And a few lines down: “Supports Twiggy drives with an optional breakout board. Note that this is CURRENTLY UNTESTED as I don’t have a set of Twiggy drives.”

Even so, we are impressed by the effort, and it sounds like a very entertaining bit of kit. The first batch has already sold out, but finished boards were on sale from two official outlets: MacEffects for £264.89, and from Joe’s Computer Museum for $350. Both will take your info and contact you when the next batch is ready.

If you can’t wait, there is Ray Arachelian’s Lisa Emulator Project. The history section is particularly interesting, starting with So, Ray, how come you care about ancient, obsolete machines?

The LisaEm source code is on GitHub, but sadly, Arachelian died of cancer in 2023, which is why version 1.2.7 never got past Release Candidate 4. We feel it would be a good tribute for someone to pick it up and produce a finished release.

In the meantime, we wrote about the remarkable LisaGUI website last year, which recreates the machine’s user interface inside your browser. ®

Amazon‘s Prime Day sale has delivered another very tempting robot vacuum deal, with the Dreame X50 Ultra dropping to just AU$1,479. That’s a huge discount from its AU$2,999 launch price last year, and well below the usual AU$2,000 price we’ve seen it discounted to in recent months.

It isn’t a budget buy, even at AU$1,479, but this is the lowest price we’ve seen for this robovac so far and, given it scored an impressive 4.5 stars in our Dreame X50 Ultra Complete review, we think it’s worth considering at this price.

This isn’t just another robot vacuum with a mop attached to the rear. The Dreame X50 Ultra is built to be a proper hands-off floor cleaner, with a self-emptying, self-refilling and self-cleaning dock, 20,000Pa suction, extendable mop pads and a side brush designed to reach into edges and corners.

More Amazon Prime Day deals in Australia

security

Microsoft says GigaWiper combines at least 3 malware families into one modular tool

A newly identified destructive Windows backdoor combines ransomware-like encryption with multiple data-wiping features, according to Microsoft.

Last October, the Redmond threat-hunting team first spotted attacks using the Golang-based implant they’ve named GigaWiper. 

Its developers stuffed multiple malware families into the software as on-demand commands, giving criminals a Swiss Army knife of command-and-control (C2) and destructive capabilities, including multiple wiping commands and file encryption without any possibility of decryption.

“The consolidation of multiple destructive capabilities into a modular backdoor reflects a notable shift in wiper malware, which are typically designed purely to destroy rather than to extort and carry real-world consequences,” Microsoft Threat Intelligence wrote in a Thursday blog.

Microsoft declined to answer The Register‘s questions about the scale and scope of GigaWiper attacks.

In the blog, Redmond’s malware analysts said they uncovered two types of GigaWiper samples in victims’ environments, and both are unstripped portable executable files written in Golang. 

One is a standalone wiper that operates at the physical disk level, as opposed to deleting individual files. It overwrites raw disk content, removes partition metadata, and then reboots the system using Windows shutdown functionality with restart and zero-delay.

The second sample is the more interesting one. It includes the same disk-wiping functionality, but that’s just one component of the backdoor. This malware also establishes persistence and sets up C2 communication using RabbitMQ over AMQP for receiving commands from the C2 server, and Redis for updating command status and output.

GigaWiper also organizes its commands into different categories, including “always run” for tasks such as continuous screen recording, “manage command” for system management functions, and separate “special command” and “shell command” modes for executing additional functionality.

These include the standalone wiper command, along with another command that disables Windows recovery, triggers a blue screen of death (BSOD), and leaves the device unable to boot.

It also has a destructive command based largely on Crucio ransomware. It encrypts files with randomly generated keys that are never saved, which means victim organizations will never be able to decrypt these files.

Another command bulk encrypts or decrypts files with AES-256 in Cipher Block Chaining (CBC) mode, while a different command uses MinIO Client (mc) to upload stolen files to remote storage.

The malware also runs PowerShell commands, takes screen shots and recordings of the compromised device, collects system info, clears Windows event logs, and allows remote control over the system along with keyboard and mouse control – among other capabilities that attackers can use at will.

According to Redmond, GigaWiper combines components from at least three previously separate malware families, including Crucio ransomware, a Go reimplementation of FlockWiper, and a standalone disk wiper.

“Overall, these findings show the evolution of the actor’s tooling over time,” the security sleuths wrote. “Functionality was merged into a single robust backdoor, granting the actor more ways to control and destroy infected systems.” ®

If you still doubted it, a new Samsung Galaxy Z foldable looks like a sure thing for the company’s upcoming Galaxy Unpacked event this month — a Spider-Man tie-in teaser posted on X on Wednesday pretty much confirms it. And it’s likely the Z Fold 8 or one of the expected variants, as rumors indicate.

Samsung’s been playing up its tie-in with new movie Spider-Man: Brand New Day for a while, including its launch of a functional Spider-Man tracking site that mimics the one appearing in the upcoming movie.

While the tracker promotion showed the site running on the screen of a foldable model, in the latest teaser, we can see a bit of the outside, including the profile of the phone’s folded halves when closed. Because it’s Spider-Man, the phone is shown being snatched out of the air by one of his web shooters.

The Galaxy Z Fold 8, or whatever it will be called, is rumored to feature a new, wider passport-style chassis. The teaser image suggests that might be true, but it also masks the width of the phone with a cleverly placed flare.

The post also links to Samsung’s site, where you can reserve a mystery phone (“your next galaxy device”) before Unpacked in exchange for a chance to win a $500 Samsung gift card and a $30 “gift” that can only be applied to a second device you purchase at the same time.

That may not be enough to make a dent in the potentially high price of upcoming models. Phone prices are rising along with those of many electronics, including consumer laptops, external storage devices, gaming consoles and more, thanks to the current memory- and component-supply shortage caused by RAM resources being reallocated toward more lucrative AI-related sales.

Whatever their cost, the new foldables are expected to be unveiled at Samsung Galaxy Unpacked on July 22 in London.

The Echo Dot (5th generation) is small enough to fit anywhere in your home, and loud enough that you’ll actually want to listen to music through it.

Right now, you can get that balance in the Echo Dot (5th generation) at £44.99, down from an RRP of £54.99, which represents a saving of 18%, which makes the choice to finally try smart home obvious.