We desperately need to get rid of big tech. It's all trash. Of course some standard made by corporate types is going to be shiftily made enough to have a buffer overflow

Does this one have any piracy implications? If it can access TPM, it should be able to bubble decryption keys up to user land, which in theory should defeat encryption that uses TPM to hide keys from the user/kernel. Might also defeat denuvo.

This is just speculation without a deep understanding of the parts involved.

I have a motherboard with a botched bios I can’t restore stuck in a boot loop over secure boot issues. I can’t even reach the bios config screen to clear it out or reflash. I wonder if this would rescue it.

The parties that discovered CVE-2026-97631—Alex Matrosov of Anthropic and Dan Holmes-Mitra of Google—had arranged for it to stay under wraps until a coordinated disclosure that was scheduled for January. AMI, a maker of motherboards and other hardware, published this pull request last month that detailed the vulnerability and included a code fix. Once the post came to the attention of the discovering parties, TianoCore Project members published a public advisory last week.

Dear OpenAI: This is responsible disclosure. Please take note as to not ruin peoples weekends so you can say "look what our API did!"

These are all the US and Chinese backdoors being finally discovered and everyone is in a panic when they should be celebrating lol Good. Bring the corporate internet down, it was better when it wasn't full of normies and post-iPhone users anyway. When the demographics skewed technical and not performative. And bring the banks down too please. I literally don't give one shit if the world burns because it'll burn cooler than this hell we're already subjected to. For once, we have a chance to enact change that isn't "just vote lmaoo i'm so smart! i'm radical chic!" so bring it on

So am I correct in understanding that this could be used to make a tool to unlock any encrypted disk that relies on the tpm whilst something like luks or indeed any solution that doesn't rely on the bios being secure would be fine.

Note I'm talking about a stolen laptop not an evil maid situation.

CVE-2026-97631 doesn’t affect home and small office users, or any other users who boot their devices solely from disk drives. Instead, it applies only to organizations with machines that boot from local networks, or conceivably from Internet-connected resources.

In the PXE boot code. Very low risk for the vast majority of people.

Do we have a server in ISS?

FELLOW INVDERS OF THE GLORIOUS PERPETUAL LEIGION OF CALAMITY OF THE NINTH ETERNAL GLACTIC EMPIRE MAY REJOICE FOR THE HEADLINE CONFIRMS THAT OUR MIGHTY THOUGHTCUBES AND CALCULAMATORS ARE UNAFFECTED AS THEY ARE PRODUCTS OF THE PLANET ZILZOG

any humans reading this you're crazy why are you so crazy

The parties that discovered CVE-2026-97631—Alex Matrosov of Anthropic and Dan Holmes of Google—had arranged for it to stay under wraps until a coordinated disclosure that was scheduled for January. AMI, a maker of motherboards and other hardware, published this pull request last month that detailed the vulnerability and included a code fix. Once the post came to the attention of the discovering parties, TianoCore Project members published a public advisory last week.

Hot take: botched disclosures like this should open a company to criminal liability. We need to start treating SWE with the same level of scrutiny we do other engineering fields and not "oopsie poopsie, I accidentally just disclosed an attack that endangers global infrastructure."

Edit: Also, just of fucking course it's a buffer overflow in C code. "No way to prevent this, says only nation where this regularly happens" vibes.

Somewhere in the NSA someone is going "damnit! They found that one too!?"

Whew, at least my severs on planet Saturn are okay

But what about all the other planets?

Ok so just don’t turn computers on anymore. Got it 👍

Legacy bios ftw

This one appears to be sensationalist, but seeing bugs coming out of the woodwork in every layer of the stack makes you realize how vulnerable our giant tech stack is and always was. I think it's time to hit reset and nuke the stack. Surely there is a way to create a low level, generic execution environment that doesn't rely on this bloated ass stack. I don't see why an application's entire stack could not be auditable down to the machine instructions. Then, we wouldn't all need access to super computers like today.

Neat. So are legacy BIOS actually more secure at the moment? Weird to think about but very reminiscent of that one time almost every Gigabyte™ brand mobo had an exploit tied to its online update capability.