30
30
45
VU#718077: UEFI Shell module embedded in SPI Flash can be used to bypass Secure Boot
CERT/CC details VU#718077: UEFI Shell embedded in SPI flash lets attackers bypass Secure Boot and execute pre-boot code; patches issued.
CERT/CC's VU#718077, reported by Eclypsium researcher Stas Lyakhov, describes how a UEFI Shell embedded in SPI flash can be abused by attackers who can modify UEFI boot configuration, creating multiple boot entries that bypass controls preventing the Shell from launching under Secure Boot. The Shell's dmem and mm commands allow arbitrary physical memory read/write, letting attackers overwrite Secure Boot values and execute unauthorized pre-boot code that can persist across reboots and OS reinstalls while degrading EDR effectiveness. AMI confirmed its Aptio UEFI BDS module is affected (CVE-2026-33197), and Cisco published an advisory for a variation affecting UCS Servers and UCS-based appliances (CVE-2026-20293). Firmware patches are being rolled out through OEM and IBV BIOS build pipelines.
55
30
45
30
50
30
35
35
30
30
35
30
30
30
30
45
30
30
30
30
Massachusetts school district, city hall shutter after cyber incidents
Springfield Public Schools (23,000 students) and Everett city hall in Massachusetts closed after weekend cyber incidents disrupted essential systems.
Springfield Public Schools, serving 23,000 students across more than 60 schools, closed buildings on Tuesday to investigate a cyber incident that disrupted systems needed for essential operations, including phones and attendance reporting. Separately, Everett, Massachusetts (population over 50,000) closed City Hall to the public after a cyberattack discovered Sunday evening impacted its internal network, though police, fire, public works and schools operate normally. The article notes multiple universities and K-12 districts have announced cyberattacks in recent weeks as hackers exploit the new school year for ransom leverage.
55
New Cryptographic Context Injection Attack Could Let Web Pages Steal Grok Chat Data
Adversa AI demonstrated 'Cryptographic Context Injection' making xAI's Grok leak chat history and session data to attacker-controlled servers via encrypted web payloads.
Adversa AI disclosed a technique where a web page carries an encrypted JSON object (PBKDF2 and AES-256-GCM) that Grok's code-execution runtime decrypts, letting attacker instructions bypass content classifiers and reach the model's context. The decrypted instructions direct Grok to embed the user's name, approximate location, subscription tier and ongoing conversation into a URL it fetches, exfiltrating the data without confirmation. Testing targeted grok.com running Grok 4.5 Fast on August 19, 2026, with a reported 40% success rate over 20 attempts since June; no CVE, patch, or in-the-wild exploitation is reported. A related demonstration reproduced Gemini 3 Flash system instructions via a fabricated Python traceback, while GPT-5 failed to parse the payload and Claude Sonnet 4.5 flagged it as prompt injection.
62
A stranger has been reading Salesforce and ServiceNow portals worldwide for 17 months
Reco tracks City-Forum, an actor abusing Salesforce and ServiceNow guest-user access from one IP for 17 months to enumerate portal data.
Reco's City-Forum investigation found one IP address, tied to a dormant 2002 domain, anonymously enumerating Salesforce Experience Cloud and ServiceNow portals across telecoms, banks, enterprise software vendors, and public sector since at least March 2025. No vulnerability was exploited and no credentials were used; the actor abused over-permissioned guest users, including a previously undocumented ServiceNow portal search endpoint, with the busiest single target logging over 560,000 events. Audit logs show what was requested but not which records or fields were returned, so defenders must replay anonymous requests to assess exposure.
62
30
30
45
30
30
30
30
30
30
30
30
30
45
30