Eclypsium, Inc.

A perfect CVSS 10. Mythos missed one. Citrix Bleed (again). A new take on cold boot attacks. In Episode 78 of Below the Surface, Paul Asadoorian, Chase Snyder, and Vladislav Babkin examine why vulnerability discovery and exploit development are moving faster than many enterprises can patch. The conversation covers: • A CVSS 10 vulnerability in Ubiquiti UniFi Connect and the operational tradeoffs of automatic firmware updates • What the Bad Epoll vulnerability shows about the limits and potential of AI-assisted vulnerability research • Why Citrix Bleed should be treated as a recurring class of exposure, not a one-time patching problem • A lightweight RAM dumping tool that revisits cold boot attacks through legacy BIOS behavior • Why version checks alone cannot determine whether a device is exposed • How configuration, enabled services, firmware state, and package provenance affect actual risk The core problem is not simply patch speed. Security teams need enough device-level context to determine which vulnerabilities are reachable, which systems are exposed, and whether compensating controls are working. Listen to Episode 78, “Patching: The Race Against Time”: https://lnkd.in/gNk2KYjQ And maybe wear sunglasses to protect your eyes from the VERY loud shirt Chase is wearing.

The latest joint advisory from the NSA, CISA, and international partners reinforces a pattern we've been tracking for years: attackers continue to target network infrastructure because it remains one of the least monitored parts of many enterprise environments. As Eclypsium Principal Security Researcher Paul Asadoorian noted: "Attackers have long understood the easiest path in is through under-monitored device hardware controls at the network edge... These well-known flaws remain effective initial access vectors because routers and other foundational devices are less monitored, more stealthy, and allow persistence even through updates." This advisory is not about a new exploit. It is about adversaries continuing to succeed with weaknesses that have existed for years because foundational infrastructure is difficult to inventory, verify, and continuously monitor. Security teams need evidence that their network devices are running authentic firmware, remain in a known-good state, and have not drifted from approved configurations. Traditional endpoint tools were not designed to answer those questions Read the article: https://lnkd.in/gZ-a9aWj

In case you are a new listener of the BTS podcast, this is your friendly reminder to revisit the oldies such as episode 34 with Wade Baker, Ph.D. and Jay Jacobs, discussing the origin story of The Exploit Prediction Scoring System (EPSS). https://lnkd.in/gU3ATKUp

What are you doing on July 30 besides packing your bag for Las Vegas? Join us for a virtual briefing on Network Edge Infrastructure Risk where we'll be discussing: - How threat actors gather and use network device information during real-world attack paths, using a practical demo of a real attack chain. - Why firewalls, VPNs, routers, and other edge infrastructure create blind spots for traditional security tools. - How to monitor network devices, validate firmware and configuration state, and prioritize remediation based on risk. Register here: https://lnkd.in/gQpbJZrN

Dell has disclosed a BIOS vulnerability (CVE-2026-40639) affecting multiple client platforms that allows an attacker with physical access to recover BIOS administrator passwords from SPI flash due to weak password encoding. Dell has released BIOS updates for affected systems. For security teams, this is another reminder that firmware deserves the same continuous attention as operating systems and applications. BIOS vulnerabilities can undermine platform trust and create opportunities for attackers to bypass security controls or establish persistence. The Eclypsium platform helps organizations identify systems affected by firmware vulnerabilities, continuously monitor device and firmware integrity, and prioritize remediation across enterprise endpoints, servers, and other infrastructure. It also validates firmware components against known-good baselines, helping teams detect unauthorized changes and reduce hardware supply chain risk that traditional OS-focused tools often cannot see. If you're responsible for managing Dell systems at scale, now is a good time to identify affected devices, apply Dell's BIOS updates, and verify firmware integrity across your environment. https://lnkd.in/g6hivwrw

Many organizations configure a BIOS password and assume the job is done. The problem is that "BIOS password" often refers to two different controls that serve different purposes. Confusing them can leave systems more exposed than expected or create unnecessary operational headaches. Our latest blog explains: • The difference between Supervisor and User BIOS passwords • What each password actually protects • When each control makes sense in an enterprise environment • Common deployment mistakes to avoid Understanding these differences is a small change that can improve the integrity of your device security baseline and help ensure firmware settings are protected as intended. Read the blog: https://lnkd.in/gV_BNsC6

Black Hat 2026 is coming up fast in only 17 business days! Are you planning to be there? We'd love to schedule time to discuss how we're helping our customers trust their IT infrastructure. https://lnkd.in/gfUfYYES

The latest reporting by Ravie Lakshmanan in HackerNews on FortiBleed reinforces what many organizations are now discovering: stolen firewall credentials are only the beginning. Researchers have now linked the campaign to the Lynx and INC ransomware operations, showing how credential theft can become the first stage of a broader intrusion. In our recent blog, we made the case that FortiBleed is not a problem you can solve with patching alone. A patched device may still contain unauthorized modifications or persistence that traditional security tools cannot verify. Security teams should assume exposed devices require more than credential resets. Verifying firmware integrity, establishing a trusted baseline, and checking for unauthorized changes are critical steps before returning these systems to production. Full article: https://lnkd.in/gciQ6dnT #FortiBleed #Ransomware #HardwareSecurity #ThreatDetection #CyberSecurity

Anthropic's #Mythos and other frontier AI models are changing how security teams decide whether to build or buy. AI can accelerate reporting, investigations, scripting, and workflow automation which will change how organizations evaluate certain parts of their security tech stack. But infrastructure assurance is a different beast. AI can only make sound security decisions when it has access to reliable, validated evidence. Hardware and firmware integrity, device configuration, management controllers, and network infrastructure require specialized telemetry that many organizations cannot collect or verify on their own. When a capability depends on authoritative device state, continuous monitoring, and evidence that can withstand incident response or audit, generating code is the easy part. Operating that capability safely is much harder. As organizations evaluate what #Mythos and similar models mean for their security programs, the question is becoming less about whether something can be built and more about whether it can be operated with trusted evidence. Our latest blog examines where AI is likely to replace security workflows, where enterprise tools continue to provide durable value, and why infrastructure trust remains a prerequisite for AI-driven security. Read more: https://lnkd.in/gxvx_Niw

Anthropic's #Mythos and other frontier AI models are changing how security teams decide whether to build or buy. AI can accelerate reporting, investigations, scripting, and workflow automation which will change how organizations evaluate certain parts of their security tech stack. But infrastructure assurance is a different beast. AI can only make sound security decisions when it has access to reliable, validated evidence. Hardware and firmware integrity, device configuration, management controllers, and network infrastructure require specialized telemetry that many organizations cannot collect or verify on their own. When a capability depends on authoritative device state, continuous monitoring, and evidence that can withstand incident response or audit, generating code is the easy part. Operating that capability safely is much harder. As organizations evaluate what #Mythos and similar models mean for their security programs, the question is becoming less about whether something can be built and more about whether it can be operated with trusted evidence. Our latest blog examines where AI is likely to replace security workflows, where enterprise tools continue to provide durable value, and why infrastructure trust remains a prerequisite for AI-driven security. Read more: https://lnkd.in/gxvx_Niw