On Tue, 20 Oct 2026 14:37:20 +0000, Sascha Hauer wrote Hi All, Here comes barebox-2026.10.0 This release brings us Raspberry Pi 5 support along with a new Broadcom SDHCI driver. Also new drivers: ...

With Barebox as an alternative bootloader, you get early display support on RK3588 Pocket Reform thanks to the work of ailurux and @minute and with just a few workarounds you can boot OpenBSD: First Barebox Boot Loader release for RK3588 Pocket Reform, OpenBSD Since MNT is about “Open Computing Autonomy” and since Linux/Linus seem to go further and further into slop-land, I wanted to try out alternatives like NetBSD which have a strong stance against machine-generated contributions on my MNT ha...

On Wed, 16 Sep 2026 13:07:54 +0000, "Sascha Hauer" wrote Hi all, We have a barebox Release for September, I just released barebox-2026.09.0. This release fixes vulnerabilities in the FIT image cod...

Learn about CVE-2024-57260, CVE-2024-57261, & CVE-2024-57262 and their impact on Barebox bootloader vulnerabilities affecting embedded systems' security

Microsoft ha utilizado su herramienta de IA llamada Security Copilot para descubrir 20 vulnerabilidades previamente desconocidas en los bootloaders de código

Microsoft used its AI-powered Security Copilot to discover 20 previously unknown vulnerabilities in the GRUB2, U-Boot, and Barebox open-source bootloaders.

Microsoft used its AI-powered Security Copilot to discover 20 previously unknown vulnerabilities in the GRUB2, U-Boot, and Barebox open-source bootloaders. [...]

Microsoftが独自のAIツールであるSecurity Copilotを活用した新たな分析手法で、GRUB2・U-Boot・bareboxなどのオープンソースのブートローダーに新たな脆弱(ぜいじゃく)性を発見したと報告しています。この取り組みは、セキュリティ分野でのAI活用の一環で、特にファームウェアやブートローダーのような、通常のセキュリティスキャンでは見落とされがちな低レベルソフトウェアの分析に焦点を当てています。

Microsoft used its AI-powered Security Copilot to discover 20 previously unknown vulnerabilities in the GRUB2, U-Boot, and Barebox open-source bootloaders.

Microsoft used its AI-powered Security Copilot to discover 20 previously unknown vulnerabilities in the GRUB2, U-Boot, and Barebox open-source bootloaders.

Security Copilot has helped Microsoft identify critical flaws in open-source bootloaders, including GRUB2, that could undermine Secure Boot protections.

Microsoft used its AI-powered Security Copilot to discover 20 previously unknown vulnerabilities in the GRUB2, U-Boot, and Barebox open-source bootloaders.

Slashdot reader zlives shared this report from BleepingComputer: Microsoft used its AI-powered Security Copilot to discover 20 previously unknown vulnerabilities in the GRUB2, U-Boot, and Barebox open-source bootloaders. GRUB2 (GRand Unified Bootloader) is the default boot loader for most Linux distributions, including Ubuntu, while U-Boot and Barebox are commonly used in embedded and IoT devices. Microsoft discovered eleven vulnerabilities in GRUB2, including integer and buffer overflows in filesystem parsers, command flaws, and a side-channel in cryptographic comparison. Additionally, 9 buffer overflows in parsing SquashFS, EXT4, CramFS, JFFS2, and symlinks were discovered in U-Boot and Barebox, which require physical access to exploit. The newly discovered flaws impact devices relying on UEFI Secure Boot, and if the right conditions are met, attackers can bypass security protections to execute arbitrary code on the device. While exploiting these flaws would likely need local access to devices, previous bootkit attacks like BlackLotus achieved this through malware infections. Miccrosoft titled its blog post "Analyzing open-source bootloaders: Finding vulnerabilities faster with AI." (And they do note that Micxrosoft disclosed the discovered vulnerabilities to the GRUB2, U-boot, and Barebox maintainers and "worked with the GRUB2 maintainers to contribute fixes... GRUB2 maintainers released security updates on February 18, 2025, and both the U-boot and Barebox maintainers released updates on February 19, 2025.") They add that performing their initial research, using Security Copilot "saved our team approximately a week's worth of time," Microsoft writes, "that would have otherwise been spent manually reviewing the content." Through a series of prompts, we identified and refined security issues, ultimately uncovering an exploitable integer overflow vulnerability. Copilot also assisted in finding similar patterns in other files, ensuring comprehensive coverage and validation of our findings... As AI continues to emerge as a key tool in the cybersecurity community, Microsoft emphasizes the importance of vendors and researchers maintaining their focus on information sharing. This approach ensures that AI's advantages in rapid vulnerability discovery, remediation, and accelerated security operations can effectively counter malicious actors' attempts to use AI to scale common attack tactics, techniques, and procedures (TTPs). This week Google also announced Sec-Gemini v1, "a new experimental AI model focused on advancing cybersecurity AI frontiers." Read more of this story at Slashdot.

Bill Toulas / BleepingComputer: Microsoft says it used its AI-powered Security Copilot to discover previously unknown vulnerabilities in the GRUB2, U-Boot, and Barebox open-source bootloaders  —  Microsoft used its AI-powered Security Copilot to discover 20 previously unknown vulnerabilities in the GRUB2, U-Boot, and Barebox open-source bootloaders.

Microsoft is reporting that its AI systems are able to find new vulnerabilities in source code: Microsoft discovered eleven vulnerabilities in GRUB2, including integer and buffer overflows in filesystem parsers, command flaws, and a side-channel in cryptographic comparison. Additionally, 9 buffer overflows in parsing SquashFS, EXT4, CramFS, JFFS2, and symlinks were discovered in U-Boot and Barebox, which require physical access to exploit. The newly discovered flaws impact devices relying on UEFI Secure Boot, and if the right conditions are met, attackers can bypass security protections to execute arbitrary code on the device...

Microsoft used its AI-powered Security Copilot to discover 20 previously unknown vulnerabilities in the GRUB2, U-Boot, and Barebox open-source bootloaders.