TL;DR Apache has fixed five security flaws in Apache IoTDB, an industrial IoT time-series database. The Apache Software Foundation rated all five as “important.” The bugs range from pr…

Home cameras rarely stray beyond the local network. Nevertheless, vulnerabilities in the TP-Link Kasa EC70 and EC71 allow an attacker already inside that network to intercept administrator credent…

Robot vacuums have long roamed our homes unattended. Yet on certain Shark models, the cleaning came bundled with an unnoticed doorway for strangers. A security researcher uncovered a critical vuln…

Router teardown, a UART port, a botched solder job, and a root shell later, I ended up with something I didn’t expect: a stranger’s real…

At a glance Malware family TuxBot v3 Evolution (also tracked as Akiru) Threat actor Suspected link to the Keksec ecosystem; no confirmed named actor Target / victims IoT devices across 30+ device …

The hardware gets you in. The firmware — and the cloud, app, and network wrapped around it — is where the real bugs hide. Here’s how to do…

Originally published at sshlab.eu

In a mere span of months, the nascent Dysphoria botnet has amassed an army of approximately 200,000 compromised devices, pioneering a sophisticated technique to obscure its command and control (C2…

TL;DR A critical OpenRemote vulnerability, CVE-2026-66013, carries a CVSS score of 9.3. It lets an unauthenticated attacker hijack an existing console asset through the public registration API. Th…

At a glance Malware family Tengu (Mirai-derived IoT botnet) Threat actor Unattributed; no operator named Target Internet-facing embedded Linux devices, such as routers, cameras, and DVRs Delivery …