InfoSecBulletin Cybersecurity for mankind
A critical flaw with how Dell saves BIOS passwords lets anyone quickly recover these passwords from a flash dump without guessing. The flaw, known as CVE-2026-40639 (DSA-2026-197), comes from a faulty XOR encryption method instead of a real cryptographic hash.
Dell keeps BIOS passwords in a special area of the SPI flash chip called DVAR. These passwords are locked with a 20-byte XOR key applied to a 32-byte space. The first letter of the password is saved without any encryption.
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Cl0p Ransomware Listed 40+ Victims of PTC Windchill Campaign
For a password that is 12 characters or less, the extra part of the 32-byte field is X-Or’d with zero, showing the key bytes clearly. The key is 20 bytes, but the field is 32 bytes, so this gap exposes the whole key from the record, allowing attackers to figure out the password right away.
Longer passwords have a small weak spot, but the researchers discovered a solution: Dell’s method uses just one fixed seed for each device, a GUID, and the first character of the password, which is not encrypted.
Researchers told Dell about the problem in March 2026. Dell confirmed the results and released DSA-2026-197 on June 9, 2026. This update fixed some devices (Edge Gateway, Embedded PC, Precision, and Rugged Latitude). More fixes are planned for the end of July 2026. However, the advisory does not include the Wyse 5070 or other known vulnerable devices.
The researchers and Dell have a small difference in CVSS scores: Dell gives it 5.7, but the researchers say it should be 6.1, because they see Attack Complexity.
The researchers suggest Dell use salted, repeated password hashing everywhere and safely delete old DVAR records. They also tell defenders not to depend only on BIOS passwords to keep encrypted boot chains safe.
Zimbra urges customers to patch
Zimbra is asking customers to update their systems to fix a serious security issue in the Classic Web Client that could allow harmful code to run.
The vulnerability is a type of stored cross-site scripting (XSS). It could let bad emails run harmful scripts in a user’s session. It does not have a CVE identifier yet.
“The update fixes a security issue in the Classic Web Client where a specially crafted email could run malicious code when the email is opened,” Zimbra said. “If exploited, it could allow access to mailbox information, session data, or account settings.”
Zimbra does not say that the vulnerability has been used in real attacks, but XSS problems in Zimbra have been targeted by hackers for years, with bad actors trying to use these issues as early as December 2021.
The company launched Zimbra 10.1.19 this Tuesday to fix a security flaw called cross-site scripting (XSS). This issue doesn’t have a CVE ID yet for tracking. Bad actors can misuse this Classic Web Client problem using special emails that run harmful code when opened.
“Any customer using the Classic Web Client should upgrade to ZCS v10.1.19 as soon as possible, as this issue only impacts the users of Classic Web Client,” Zimbra warned. “We strongly recommend upgrading to this version to keep your environment secure.”
