The parties that discovered CVE-2026-97631—Alex Matrosov of Anthropic and Dan Holmes of Google—had arranged for it to stay under wraps until a coordinated disclosure that was scheduled for January. AMI, a maker of motherboards and other hardware, published this pull request last month that detailed the vulnerability and included a code fix. Once the post came to the attention of the discovering parties, TianoCore Project members published a public advisory last week.
Hot take: botched disclosures like this should open a company to criminal liability. We need to start treating SWE with the same level of scrutiny we do other engineering fields and not “oopsie poopsie, I accidentally just disclosed an attack that endangers global infrastructure.”
Edit: Also, just of fucking course it’s a buffer overflow in C code. “No way to prevent this, says only nation where this regularly happens” vibes.
So I posted this quote as well but for a different reason. Google and Anthropic chose responsible disclosure, unlike OpenAI with the lovely weekend fiasco for PR.
In this one, AMI made a mistake. I don’t think making a mistake should be punishable to the extent that ignoring responsible disclosure should. Some dev pushed a PR out of habit, sucks but I’ll take the last minute patch requirement on that. Some business lead once to see if they can push the stock? No thanks.
I’ve been advocating for years that international legislation needs to be put in place to enforce responsible disclosure practices.
The NSA has made both Microsoft and Apple withhold security patches to make their enemies vulnerable, but also makes the general populace vulnerable to these issues, which can or even has been continuously exploited by hacker groups under nation state actors who considers the US enemy.
So yes, they should be held liable and sued for not disclosing vulnerabilities to the world at large, because keeping it secret is inherently stupid and self defeatist.
Sure, that may be true. But I am not an international lawyer, so I can’t really speak to that point.
CVEs should be taken with an approach that the cve does matter, but that adding your own exposure to it is the only way to measure its impact on you.
This is a PXE boot environment vuln, so most of the self-hosting community itself probably doesn’t have this enabled at all. A person who does is likely very aware that PXE is already dangerously easy to misconfigure, especially in the days of remote init methods over https, which can at least be layered with other security solutions.
Hey now, C isn’t the only language with this problem, I’m a proud c++ dev and I assure you we get it regularly too. You just find our freedoms uncomfortable because they cause so much destruction and harm, but if you only understood the pure bliss of being allowed to do any terrible thing we can think of, you’d understand that it’s worth all the problems it causes!
Hot take: botched disclosures like this should open a company to criminal liability. We need to start treating SWE with the same level of scrutiny we do other engineering fields and not “oopsie poopsie, I accidentally just disclosed an attack that endangers global infrastructure.”
Edit: Also, just of fucking course it’s a buffer overflow in C code. “No way to prevent this, says only nation where this regularly happens” vibes.
So I posted this quote as well but for a different reason. Google and Anthropic chose responsible disclosure, unlike OpenAI with the lovely weekend fiasco for PR.
In this one, AMI made a mistake. I don’t think making a mistake should be punishable to the extent that ignoring responsible disclosure should. Some dev pushed a PR out of habit, sucks but I’ll take the last minute patch requirement on that. Some business lead once to see if they can push the stock? No thanks.
I’ve been advocating for years that international legislation needs to be put in place to enforce responsible disclosure practices.
That is indeed a hot take. The cve involves crafting a PXE packet, so just… Don’t use PXE in your environment.
If you do, you already know of the dangers of signing exploits in boot images, DNS shenanigans, and all that.
I’m not saying this isn’t serious, but it’s not really the end of the world.
The NSA has made both Microsoft and Apple withhold security patches to make their enemies vulnerable, but also makes the general populace vulnerable to these issues, which can or even has been continuously exploited by hacker groups under nation state actors who considers the US enemy.
So yes, they should be held liable and sued for not disclosing vulnerabilities to the world at large, because keeping it secret is inherently stupid and self defeatist.
Sure, that may be true. But I am not an international lawyer, so I can’t really speak to that point.
CVEs should be taken with an approach that the cve does matter, but that adding your own exposure to it is the only way to measure its impact on you.
This is a PXE boot environment vuln, so most of the self-hosting community itself probably doesn’t have this enabled at all. A person who does is likely very aware that PXE is already dangerously easy to misconfigure, especially in the days of remote init methods over https, which can at least be layered with other security solutions.
How do you craft a PXE packet? I’m using a crafting table but I don’t see the option anywhere.
5 gunpowder, 4 sand, and 1 broadcast domain.
Seriously, though, tools like metasploit and python itself are a great place to start if you actually want to get into it.
Hey now, C isn’t the only language with this problem, I’m a proud c++ dev and I assure you we get it regularly too. You just find our freedoms uncomfortable because they cause so much destruction and harm, but if you only understood the pure bliss of being allowed to do any terrible thing we can think of, you’d understand that it’s worth all the problems it causes!