Critical flaw in EDK2 allows attackers to execute code early in the boot process.

TL;DR Supermicro has disclosed eight Supermicro BMC vulnerabilities that affect 392 motherboard and module SKUs. The worst IPMI flaw, CVE-2026-18450, carries a critical CVSS score of 9.8. It lets an unauthenticated attacker run IPMI commands on an active session. Researchers at runZero found and reported all eight bugs. Eight flaws hit the IPMI and KVM features of Supermicro BMC firmware. Three of them need no login, and one is rated critical.

In this conversation, Giuseppe Compare CEO of Mindstorm security discusses the inception and development of Macobox, a revolutionary tool designed for hardware penetration testing. He shares insights into the challenges faced during its creation, the importance of team dynamics, and the integration of AI to enhance functionality. Giuseppe also highlights the subscription model for ongoing updates and the future of hardware security testing, providing valuable advice for aspiring developers in the field. Don’t wait – learn more and grab your MACOBOX at LAB401.com, the official global distributor: https://lab401.com/products/macobox-hardware-pentest-platform 00:00 - Teaser 00:36 - INTRODUCTION 01:43 - The story behind MACOBOX 05:13 - Identifying Market Needs 07:15 - The Team Behind Mindstorm security 09:12 - Technical Challenges in Development 11:46 - Integrating AI into MakoBox 22:25 - Future Developments and Features 23:58 - Subscription Model and Community Impact 27:15 - The Future of Hardware Security Testing 32:05 - Advice for Aspiring Developers 33:51 - Outro

The MACOBOX is an all-in-one solution for hardware auditing and firmware vulnerability analysis. Power supply, interface, connection, dumping and automated tasks and firmware analysis: the MACOBOX does everything. Rapid, reliable, repeatable, portable hardware pentests are now possible with just one tool. Exclusively available at LAB401.COM

*Some features shown are in beta and will be fully functional soon. Stop fighting cables. Macobox gives you a step-by-step process: FCCID OSINT, AI Photo Scan, smart connect (UART/SPI/I²C/SWD/JTAG/eMMC), one-click dumps, AI log analysis (“Chat with the Target”), deep scans, clean exports, and one-click reports. It’s faster, deeper, and repeatable—every job. 👉 Get MACOBOX at LAB401.com: https://lab401.com/products/macobox-hardware-pentest-platform 👍 Like, share, and subscribe for more hardware security content. What you’ll learn in this video Problem → solution: From cable chaos to a clean, repeatable workflow. OSINT first: Enter FCCID to pull filings, photos, and docs; use AI Photo Scan to ID chips and fetch datasheets. Smart connect: Auto-detect UART, SPI, I²C, SWD, JTAG, eMMC; safe voltages; built-in multimeter info. One-click dump: Reliable SPI/eMMC extraction—no guesswork. Chat with the Target: AI explains boot logs, maps memory, highlights entry points. Project workflow: Auto-organized artifacts; export bundles with binaries, logs, notes, photos. One-click reports: Generate clean, professional vulnerability reports. Chat with Project: Ask about risks, coverage, next steps—AI answers from your project context. Portable lab: 1.5 GHz Cortex-A53, 4 GB RAM, 256 GB storage, USB/LAN/Wi-Fi/Bluetooth; battery powered. In the box: Macobox, PCBite with SQ10 probes, eMMC reader, SPI clips, SOP sockets, jumpers, pen-style multimeter, precision screwdriver + opening kit, PSU, spare plate. Plans: Basic (free), Premium (€2k/yr), Pro (contact us). Chapters 00:00 Cable chaos vs. results 00:32 The problem every pentester knows 01:04 From tool-driven to method-driven 01:21 What Macobox covers end-to-end 01:52 OSINT: FCCID + AI Photo Scan 02:38 Smart Connect: UART/SPI/I²C/SWD/JTAG/eMMC + safe voltages 03:08 One-Click Dump: SPI/eMMC firmware 03:38 Chat with the Target: AI log + memory analysis 04:27 Project Organization & Export 04:55 One-Click Reports 05:09 Chat with Project (context-aware AI) 06:17 Why it matters: speed, depth, repeatability 06:46 Portable specs (A53/4 GB/256 GB, I/O, battery) 07:14 What’s in the case 07:42 Standardized, shareable workflow 08:22 Consistency = success 09:14 Built by field researchers (Giuseppe, Matteo, Luca) 09:51 Plans: Basic / Premium / Professional 11:21 Core platform + annual plan tip 11:43 Call to action: streamline now 12:38 Like • Share • Subscribe Plan details (quick) Basic (free): Core workflow, lifetime updates, community help. Premium (~€2,000/yr): AI component + firmware tools, priority support, adapter upgrades, replacement probe boards. Pro (CONTACT US): All Premium + cloud vuln scans, reporting for teams, dashboards, SLA support. Why Macobox Cut setup time Go deeper with AI Keep everything organized Deliver client-ready reports, fast Roadmap: Macobox keeps evolving. New functionalities roll out regularly, and the roadmap is packed. Follow our official channels to catch new features as they drop.

Hey pentesters! Need to spot hidden bugs in a board in minutes? In this video I sit down with Giuseppe Compare, the maker of MACOBOX, and run firmware v1.2 through its new AI tools: AI Photo Finder – snap one pic, get every chip labeled. Cloud Scanner – push a dump, pull deep results. AI Chat & Agent – ask questions, let the bot guide your next move. You’ll see a full workflow: take a photo, dump firmware, hit scan, read clean logs. 👉 Grab your own MACOBOX here: https://lab401.com/products/macobox-hardware-pentest-platform and add 1 month for FREE to your yearly subscription! 👍 Like the video, 🔔 subscribe, and share with your team so they can work faster too ;)

In this conversation, Giuseppe Compare CEO of Mindstorm security discusses the inception and development of Macobox, a revolutionary tool designed for hardware penetration testing. He shares insights into the challenges faced during its creation, the importance of team dynamics, and the integration of AI to enhance functionality. Giuseppe also highlights the subscription model for ongoing updates and the future of hardware security testing, providing valuable advice for aspiring developers in the field. Don’t wait – learn more and grab your MACOBOX at LAB401.com, the official global distributor: https://lab401.com/products/macobox-hardware-pentest-platform 00:00 - Teaser 00:36 - INTRODUCTION 01:43 - The story behind MACOBOX 05:13 - Identifying Market Needs 07:15 - The Team Behind Mindstorm security 09:12 - Technical Challenges in Development 11:46 - Integrating AI into MakoBox 22:25 - Future Developments and Features 23:58 - Subscription Model and Community Impact 27:15 - The Future of Hardware Security Testing 32:05 - Advice for Aspiring Developers 33:51 - Outro

The MACOBOX is an all-in-one solution for hardware auditing and firmware vulnerability analysis. Power supply, interface, connection, dumping and automated tasks and firmware analysis: the MACOBOX does everything. Rapid, reliable, repeatable, portable hardware pentests are now possible with just one tool. Exclusively available at LAB401.COM

*Some features shown are in beta and will be fully functional soon. Stop fighting cables. Macobox gives you a step-by-step process: FCCID OSINT, AI Photo Scan, smart connect (UART/SPI/I²C/SWD/JTAG/eMMC), one-click dumps, AI log analysis (“Chat with the Target”), deep scans, clean exports, and one-click reports. It’s faster, deeper, and repeatable—every job. 👉 Get MACOBOX at LAB401.com: https://lab401.com/products/macobox-hardware-pentest-platform 👍 Like, share, and subscribe for more hardware security content. What you’ll learn in this video Problem → solution: From cable chaos to a clean, repeatable workflow. OSINT first: Enter FCCID to pull filings, photos, and docs; use AI Photo Scan to ID chips and fetch datasheets. Smart connect: Auto-detect UART, SPI, I²C, SWD, JTAG, eMMC; safe voltages; built-in multimeter info. One-click dump: Reliable SPI/eMMC extraction—no guesswork. Chat with the Target: AI explains boot logs, maps memory, highlights entry points. Project workflow: Auto-organized artifacts; export bundles with binaries, logs, notes, photos. One-click reports: Generate clean, professional vulnerability reports. Chat with Project: Ask about risks, coverage, next steps—AI answers from your project context. Portable lab: 1.5 GHz Cortex-A53, 4 GB RAM, 256 GB storage, USB/LAN/Wi-Fi/Bluetooth; battery powered. In the box: Macobox, PCBite with SQ10 probes, eMMC reader, SPI clips, SOP sockets, jumpers, pen-style multimeter, precision screwdriver + opening kit, PSU, spare plate. Plans: Basic (free), Premium (€2k/yr), Pro (contact us). Chapters 00:00 Cable chaos vs. results 00:32 The problem every pentester knows 01:04 From tool-driven to method-driven 01:21 What Macobox covers end-to-end 01:52 OSINT: FCCID + AI Photo Scan 02:38 Smart Connect: UART/SPI/I²C/SWD/JTAG/eMMC + safe voltages 03:08 One-Click Dump: SPI/eMMC firmware 03:38 Chat with the Target: AI log + memory analysis 04:27 Project Organization & Export 04:55 One-Click Reports 05:09 Chat with Project (context-aware AI) 06:17 Why it matters: speed, depth, repeatability 06:46 Portable specs (A53/4 GB/256 GB, I/O, battery) 07:14 What’s in the case 07:42 Standardized, shareable workflow 08:22 Consistency = success 09:14 Built by field researchers (Giuseppe, Matteo, Luca) 09:51 Plans: Basic / Premium / Professional 11:21 Core platform + annual plan tip 11:43 Call to action: streamline now 12:38 Like • Share • Subscribe Plan details (quick) Basic (free): Core workflow, lifetime updates, community help. Premium (~€2,000/yr): AI component + firmware tools, priority support, adapter upgrades, replacement probe boards. Pro (CONTACT US): All Premium + cloud vuln scans, reporting for teams, dashboards, SLA support. Why Macobox Cut setup time Go deeper with AI Keep everything organized Deliver client-ready reports, fast Roadmap: Macobox keeps evolving. New functionalities roll out regularly, and the roadmap is packed. Follow our official channels to catch new features as they drop.

Hey pentesters! Need to spot hidden bugs in a board in minutes? In this video I sit down with Giuseppe Compare, the maker of MACOBOX, and run firmware v1.2 through its new AI tools: AI Photo Finder – snap one pic, get every chip labeled. Cloud Scanner – push a dump, pull deep results. AI Chat & Agent – ask questions, let the bot guide your next move. You’ll see a full workflow: take a photo, dump firmware, hit scan, read clean logs. 👉 Grab your own MACOBOX here: https://lab401.com/products/macobox-hardware-pentest-platform and add 1 month for FREE to your yearly subscription! 👍 Like the video, 🔔 subscribe, and share with your team so they can work faster too ;)