TL;DR Apache IoTDB has patched three flaws in its time-series database. The worst is a critical path traversal bug, CVE-2026-24014, scored 9.8. A second flaw allows an authentication bypass, and a…

Malicious firmware can seize control of a device before Linux starts. It can remain nearly invisible to security software running at the OS level. Researchers at Binarly discovered six vulnerabili…

Disclaimer: This research was performed on a device that I personally own and in a controlled environment. The purpose of this article is…

1. Introduction

Lol, this is funny

TL;DR TP-Link has patched two information disclosure flaws in Kasa EC70 v4 and EC71 v4 cameras. The more severe TP-Link Kasa vulnerability, CVE-2026-9770 (CVSS 8.6), stems from a hardcoded cryptog…

TL;DR Apache has fixed five security flaws in Apache IoTDB, an industrial IoT time-series database. The Apache Software Foundation rated all five as “important.” The bugs range from pr…

Home cameras rarely stray beyond the local network. Nevertheless, vulnerabilities in the TP-Link Kasa EC70 and EC71 allow an attacker already inside that network to intercept administrator credent…

Robot vacuums have long roamed our homes unattended. Yet on certain Shark models, the cleaning came bundled with an unnoticed doorway for strangers. A security researcher uncovered a critical vuln…

Router teardown, a UART port, a botched solder job, and a root shell later, I ended up with something I didn’t expect: a stranger’s real…