Organization

University of Birmingham

0 mentions in 7 days · 0 in 30 days · 2 total · first seen Aug 11, 2026 · last Aug 17, 2026

Timeline2 articles

Windows 11’s strongest security defenses can be bypassed without a screwdriver

Researchers found a script-only attack, 'Download More RAM', that rewrites DIMM configuration chips to bypass Windows 11 VBS and HVCI security boundaries.

Researchers at the University of Birmingham and Durham University showed that overwriting configuration data on unprotected DDR4/DDR5 module chips creates memory aliases that let attackers with existing privileged access defeat Virtualisation-based Security and HVCI, re-enable blocklisted drivers, kill EDR, and bypass group policy. Microsoft assigned CVE-2026-23670 and shipped mitigations in its April 2026 updates; systems with Secure Boot enabled are protected. Affected unprotected product lines are estimated at more than half of the high-performance consumer memory market and over 70% of the gaming segment.

Help Net SecurityAug 17, 00:00 UTC · Aug 17, 2026Vulnerability CVE-2026-236701

A Malicious SIM Card Can Run Attacker Code Inside the Modems Behind Cellular IoT Devices

Researchers showed malicious SIM cards can issue RUN AT commands to execute code on Qualcomm modems, compromising Quectel-based cellular IoT devices like EV chargers.

Researchers at the University of Birmingham and Fuzzware found 9 of 26 tested devices accept SIM proactive commands, including six Qualcomm-based cellular modules, five of them Quectel. They achieved code execution on a commercial Autel EV charger via the Quectel EC25's atfwd_daemon unsafe format string, and demonstrated an irreversible 2G downgrade, modem power-off, and arbitrary file reads via a root TFTP daemon on a Quectel EG25-G. Attacks require a hostile SIM already in the slot or an interposer; no attacks have been reported in the wild. Qualcomm has built a hardened configuration disabling the interface by default and Quectel mitigated the file-access flaw; the paper was presented at USENIX WOOT.

The Hacker NewsAug 11, 12:12 UTC · Aug 11, 2026Vulnerability CVE-2025-48618

Related CVEsby mentions

CVE-2025-486186.8<1%
In processLaunchBrowser of CommandParamsFactory.java, there is a possible browser interaction from the lockscreen due to improper locking.
In processLaunchBrowser of CommandParamsFactory.java, there is a possible browser interaction from the lockscreen due to improper locking. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
· google android—
CVE-2026-236705.7<1%
Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feature locally.
Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feature locally.
· microsoft windows 10 1607 · microsoft windows 10 1809—

Appears with

organization Durham University 1 organization Fuzzware 1 organization USENIX WOOT 1 product Autel MAXI US AC W12-L-4G 1 product CATana 1 product HVCI 1 product Quectel EC25 1 product Quectel EG25-G 1 product VBS 1 product Windows 11 1 vendor ASUS 1 vendor Autel 1 vendor Google 1 vendor Microsoft 1 vendor OPPO 1 vendor Qualcomm 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.