Researchers Bypass RP2350 Secure Debug Lock with Laser Fault Injection and Photon Emission Microscopy
Security researchers have successfully bypassed the permanent Secure Debug lock on the RP2350 microcontroller (revision A4) by combining photon emission microscopy with targeted laser fault injection.
The Raspberry Pi RP2350 is a dual-core device that can run either Arm Cortex-M33 or RISC-V Hazard3 cores. Its security architecture includes secure boot, TrustZone, permanent debug disable fuses stored in OTP memory, and active glitch detectors. After the first Hacking Challenge, Raspberry Pi released revision A4 with several fixes; the new research targeted this hardened silicon.
The team first used differential photon emission microscopy (PEM) to locate the physical transistors corresponding to the DEBUGEN register bits. By repeatedly toggling specific bits from secure-mode software and subtracting averaged infrared frames, they produced high-resolution maps that narrowed the target area to a few square micrometers.
With the locations identified, they performed laser fault injection using a 980 nm pulsed laser at approximately 1.2 W focused through a 50× objective. Two adjacent spots were found that respectively set the PROC1 and PROC1_SECURE bits. An automated script alternated between the two locations until both bits were correctly asserted, restoring full Secure Debug access through the Mem-AP port.
The attack works because the DEBUGEN register has no hardware redundancy or parity protection, unlike the OTP security fields. Once the bits are flipped, they remain set without further intervention, allowing an external debugger full read/write access to protected memory regions before firmware can re-apply soft locks.
Researchers note that the technique requires backside decapsulation, a high-end laser setup, and roughly $250,000 worth of laboratory equipment. It is therefore relevant primarily to sophisticated physical attackers rather than remote threats.
Related articles
Negative Specifications: How Bug History Strengthens AI Agent Code for Ginux Kernel
The article explores how incomplete positive specifications lead to vulnerabilities and compatibility gaps when AI agents develop complex systems like the Ginux kernel. Author sgordey describes discovering memory limit bypasses, domain controller takeover via infinite loops, and ineffective SO_REUSEADDR flags during security audits of the Rust-written Linux-compatible kernel created by Gregory Kurtzer using HDAE methodology. It argues for building negative specifications drawn from historical vulnerabilities such as SACK Panic and SACK Slowness to define what must never happen and how to test it. The piece details practical integration of past bug data into frameworks including BMAD, OpenSpec, Kiro, and Superpowers, recommending dedicated steps like failure-history and challenge-spec tasks before coding begins. Tools rust-in-peace and reproof already apply similar multi-angle searches combining threat modeling, unaided discovery, and CVE history. The author stresses that requirements derived from real failures must enter both specifications and test plans to prevent agents from repeating known mistakes.
Proving Vulnerability Management Works: MTTR Metrics, Maturity Models, and Real-World Testing
This article explains how organizations can measure the effectiveness of their vulnerability management programs using key metrics like MTTR, coverage, and maturity levels. It emphasizes that without proper measurement, even advanced scanners and skilled teams cannot confirm whether the process is functioning or stalling. The piece highlights MTTR as the primary metric for executive discussions because it directly correlates with real-world exploit timelines. Industry benchmarks from Verizon DBIR 2026, Edgescan 2025, Bitsight 2024, and Qualys show that remediation often takes months, far exceeding regulatory requirements such as FSTEC Order 117. A five-level maturity ladder is presented, ranging from chaos to continuous CTEM, to help teams assess progress. The article concludes that simulated attacks and red team exercises provide the most honest validation of VM effectiveness beyond dashboard numbers.
WordPress Core Update RCE Vulnerability CVE-2026-119977 Actively Exploited, CISA Adds to KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical remote code execution flaw in WordPress to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild. The vulnerability, tracked as CVE-2026-119977, resides in the core update mechanism and allows attackers to predict temporary file paths created during package updates, enabling unauthorized code execution from external sources. Wordfence assigned the flaw a CVSS v3.1 base score of 8.1 and reported blocking over 13,000 exploitation attempts targeting its customers within a single 24-hour period. The issue was addressed in the WordPress 7.1.4 release on October 28, 2026, with backports now being rolled out to all branches from version 4.7 onward. CISA has set a three-day remediation deadline of November 6, 2026, for U.S. federal agencies and instructed them to investigate potential compromises. Security researchers note that the attack leverages predictable temporary file locations during the update process, making it particularly dangerous for unpatched installations.
Barracuda ESG Hit by High-Severity Vulnerabilities Allowing Chained Root Access
Barracuda Networks has released patches for multiple products after disclosing two high-severity vulnerabilities that affect the Email Security Gateway (ESG). CVE-2026-116606 is a pre-authentication authorization bypass in ESG that permits an attacker with network access to the management interface to import a malicious backup file and alter device configuration without credentials. CVE-2026-111560 is an OS command injection flaw in timezone configuration handling that requires administrator login but grants root-level command execution. The command injection issue also impacts Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway. The vendor published its advisory on November 2, 2026, and urges immediate application of the fixes to prevent potential full system compromise through chained exploitation.