InfoSecBulletin Cybersecurity for mankind
A critical flaw with how Dell saves BIOS passwords lets anyone quickly recover these passwords from a flash dump without guessing. The flaw, known as CVE-2026-40639 (DSA-2026-197), comes from a faulty XOR encryption method instead of a real cryptographic hash.
Dell keeps BIOS passwords in a special area of the SPI flash chip called DVAR. These passwords are locked with a 20-byte XOR key applied to a 32-byte space. The first letter of the password is saved without any encryption.
NetamLoader malware to attack Win10: Customized for Gov.t in Asia
‘SMS of Death’ Zero-Click Flaw Disrupting Android Phones With a Single Text
NIST Unveiled Guidance for Post-Quantum Cryptography Transition
Daily Cyber security update for 29.10. 2026
Rapid7 Unveils 17 Zimbra Collaboration Suite Flaws Breaking Identity Boundaries
CISA launched two free tools Identify Security Misconfig in Microsoft 365 and Google Workspace
Apple iOS 27.2 Released Fixes 163 Flaws, Including Critical WebKit RCE
CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw
Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw
Daily Cyber security update for 26.10. 2026
For a password that is 12 characters or less, the extra part of the 32-byte field is X-Or’d with zero, showing the key bytes clearly. The key is 20 bytes, but the field is 32 bytes, so this gap exposes the whole key from the record, allowing attackers to figure out the password right away.
Longer passwords have a small weak spot, but the researchers discovered a solution: Dell’s method uses just one fixed seed for each device, a GUID, and the first character of the password, which is not encrypted.
Researchers told Dell about the problem in March 2026. Dell confirmed the results and released DSA-2026-197 on June 9, 2026. This update fixed some devices (Edge Gateway, Embedded PC, Precision, and Rugged Latitude). More fixes are planned for the end of July 2026. However, the advisory does not include the Wyse 5070 or other known vulnerable devices.
The researchers and Dell have a small difference in CVSS scores: Dell gives it 5.7, but the researchers say it should be 6.1, because they see Attack Complexity.
The researchers suggest Dell use salted, repeated password hashing everywhere and safely delete old DVAR records. They also tell defenders not to depend only on BIOS passwords to keep encrypted boot chains safe.
Zimbra urges customers to patch
Zimbra is asking customers to update their systems to fix a serious security issue in the Classic Web Client that could allow harmful code to run.
The vulnerability is a type of stored cross-site scripting (XSS). It could let bad emails run harmful scripts in a user’s session. It does not have a CVE identifier yet.
“The update fixes a security issue in the Classic Web Client where a specially crafted email could run malicious code when the email is opened,” Zimbra said. “If exploited, it could allow access to mailbox information, session data, or account settings.”
Zimbra does not say that the vulnerability has been used in real attacks, but XSS problems in Zimbra have been targeted by hackers for years, with bad actors trying to use these issues as early as December 2021.
The company launched Zimbra 10.1.19 this Tuesday to fix a security flaw called cross-site scripting (XSS). This issue doesn’t have a CVE ID yet for tracking. Bad actors can misuse this Classic Web Client problem using special emails that run harmful code when opened.
“Any customer using the Classic Web Client should upgrade to ZCS v10.1.19 as soon as possible, as this issue only impacts the users of Classic Web Client,” Zimbra warned. “We strongly recommend upgrading to this version to keep your environment secure.”
