10 min read
NVLinkSideLink
Blog
Thoughts, tutorials, and insights on IT infrastructure, cybersecurity, and systems administration.
Browse by topic
Thoughts, tutorials, and insights on IT infrastructure, cybersecurity, and systems administration.
Researchers at IIT Jodhpur turned ordinary wire contention on NVIDIA's NVLink into a working covert channel and a workload fingerprinting attack that hits 93% accuracy on a shared DGX A100. NVLink was engineered for bandwidth, not isolation, and it shows.
AS62390 hijacked a Hetzner /24 for 33 hours, used the diversion to mint a real Let's Encrypt certificate, and pushed a backdoored Virtualizor update straight to hypervisor root. Here's how the routing data proves it, step by step.
Two chained RouterOS bugs let an attacker log into a MikroTik router as an existing user without their private key, then escalate straight to root. CERT Polska confirmed exploitation a day before patches existed, and 122,500+ internet-facing routers are still exposed.
An attacker exploited how Brevo's SAML SSO handles organization invitations to reach 138 customer accounts, including Trezor and BitBox, then used Trezor's own newsletter list to push a fake hardware vulnerability alert to 347,000 subscribers.
CVE-2026-21902 (CVSS 9.8) hands root on Juniper PTX routers to anyone who can reach port 8160 — because a service meant to stay internal was bound to 0.0.0.0 with zero authentication, no memory corruption required.
A TOCTOU race in CrowdStrike Falcon's Office macro remediation lets a local attacker hijack the sensor's own privileged cleanup routine for DLL side-loading straight to SYSTEM — no patch yet, only a policy workaround.
Kestra's auth filter whitelisted /configs with a suffix match instead of an exact one, so any API path ending in "configs" skipped authentication — and since Kestra runs shell and Python scripts by default, that one line is unauthenticated root RCE. CISA confirms it's already being used for reverse shells and cryptomining.
CVE-2026-20079 lets an unauthenticated attacker get root on Cisco Secure Firewall Management Center, the box that manages your entire firewall fleet. CISA gave federal agencies one day to patch it.
DPRK-linked STARDUST CHOLLIMA hijacked a dormant Mastra maintainer account and mass-published a poisoned dependency across 131+ npm packages in 88 minutes, stealing credentials from AI developers before they ran a single line of their own code.
A command injection bug that needed an API key stopped needing one the moment researchers chained it with a one-character Host header trick — and Qilin ransomware affiliates are already using the combo to drop cryptominers on AI gateways.
Espressif's Trusted Execution Environment for the ESP32-C5/C6/C61/H2 shipped with an unchecked-pointer bug (CVE-2026-45328, CVSS 9.3) that lets ordinary application code corrupt memory inside the very boundary the TEE exists to protect.
SonicWall's SMA 1000 remote access gateways were hit by two separate unauthenticated RCE chains in 2026, both built on the same confused-deputy design flaw. Here's the kill chain, the ransomware fallout, and what it means if you run one of these boxes.
Microsoft quietly removed the price tag on Azure Arc hotpatching for Windows Server 2025 in May 2026. After a decade of scheduling maintenance windows around Patch Tuesday, here's why I think this is one of the most underrated changes to hit Windows Server infrastructure in years.
Espressif's new ESP-TEE framework brings hardware-isolated secure storage, attestation, and rollback-safe OTA to the RISC-V ESP32-C6 — a serious security upgrade for a chip family that used to rely on trust, not isolation.
A ransomware crew compressed a two-week breach into 10 hours using AI agents. Days later, CrowdStrike launched a product built to stop exactly that. Here's what changed and what to actually do about it.
A BBC reporter's laptop was compromised without a single click — through an AI coding platform called Orchids. No malicious download, no phishing link, no user error. This is what happens when AI agents get deep system access before anyone secures them properly.
In early February 2026, researchers discovered a live attack campaign where hackers embedded DeepSeek and Claude directly into their intrusion workflow — automating FortiGate SSL VPN attacks across 2,516 targets in 106 countries. This is a breakdown of exactly how the tooling worked, and what infrastructure teams need to do right now.