Qubes Dom0 RCE, AirMAX Exploits, and DDR5 Fault Injection

QSEE to EL3, Predator’s kernel machinery, and a €30 EMFI injector.

ZeroDayCommission is a security briefing by OrbitCurve, covering fault injection, MCU exploitation, microarchitecture, hypervisors, compilers, embedded systems, and hardware reverse engineering.

This issue moves from a file-copy error path that reaches Qubes dom0 to wireless kernel exploitation and physical attacks on DDR5. There is plenty for the lab, too: firmware decryption, inexpensive EMFI, servo reverse engineering, and talks on the internals behind modern exploitation.

Byte Brief

Qubes OS: A File-Copy Error Reaches Dom0

QSB-118 traces arbitrary code execution in dom0 to error reporting in qvm-copy-to-vm. When a user copies a file from dom0 into a compromised qube, the destination can return a malicious filename that survives sanitization and reaches a shell invocation. VM-to-VM copies use a different error-dialog path and are unaffected. The Qubes team has published an update. A sharp reminder to audit error messages crossing isolation boundaries as carefully as the successful data path. Read the bulletin.

Root From Kilometers Away: Ubiquiti AirMAX

Gaston Aznarez and Federico Kirschbaum reverse Ubiquiti’s proprietary wireless protocol and follow vendor-specific 802.11 management-frame parsing into unauthenticated kernel code execution. The attacker needs line-of-sight radio reachability to vulnerable equipment, but no credentials or membership of the target network. The work covers CVE-2026-21638 and CVE-2026-21639; the research team’s follow-up lists fixes by product family. Useful reading on the distance hidden inside an “adjacent” attack classification and the kernel attack surface exposed before authentication. Black Hat slides · Research and patched versions.

DDRop: Dropping DDR5 Writes Against Confidential VMs

DDRop uses a physical DDR5 interposer to selectively suppress writes, preserving stale encrypted memory contents. The researchers examine freshness guarantees in Intel TDX, Scalable SGX, and AMD SEV-SNP, with TDX demonstrations including debug access and forged attestation measurements under the configurations detailed in the paper. The attack requires physical installation and privileged host software control. Intel and AMD place physical memory-bus attacks outside their published threat models. The research makes the distinction between confidentiality, integrity, and freshness concrete. Research, paper, and artifacts.

Google Nest Wifi Pro: From QSEE Primitives to EL3

Niek Timmers and Cristofaro Mune examine Qualcomm QSEE on the Nest Wifi Pro’s IPQ5018. Starting from hardware access, a secure-boot bypass, and normal-world root, they develop secure-memory disclosure and constrained writes into EL3 execution. The interesting progression runs through secure-memory validation tables and memory-controller protections: which addresses are accepted, which protections can be changed, and what each primitive makes possible next. Raelize reports that the issues were disclosed and, to the authors’ knowledge, fixed. Read the OffensiveCon slides.

Inside Predator’s iOS Kernel Engine

Jamf Threat Labs’ Nir Avraham analyzes the machinery that turns an established compromise into reusable kernel access: NEON-register communication with a kernel component, JavaScriptCore PAC-signing gadgets, cached signed pointers, and transfer of kernel read/write capabilities between processes. The analyzed implementation targets pre-iOS-17 systems and devices through A16; the initial kernel payload is outside this article’s scope. Read it for the reliability and integration work behind a spyware implant’s primitives. Read Jamf’s analysis.

Reads and Resources

Salty Firmware: Adventures in Firmware Encryption Reversing

Quentin Kaiser follows firmware decryption through bootloaders, kernel drivers, update programs, and custom filesystems, with cases spanning Dahua, Alcatel-Lucent, Stormshield, Yealink, and a printer manufacturer. The value is methodological: identify where the device must obtain plaintext, then trace the implementation and key handling that make that possible. A useful collection for anyone building a firmware-analysis workflow around encrypted images. Pass the SALT slides · Recording.

Getting into EMFI for €30

Guillaume Quéré documents a low-cost entry into electromagnetic fault injection, including probe quality, trigger reliability, positioning, and the different fault effects a target can exhibit. The €30 figure covers the injector, not an entire lab. Its constraints are part of the lesson: understanding a known target and measuring repeatable behavior matter as much as getting a pulse onto the board. Read the article.

Failure Is Not an Option: Reliable STM32F2/F4 Extraction

Joe Grand and Lennert Wouters turn years of STM32 fault-injection work into a documented extraction process, with notebooks, test code, hardware designs, and a REcon talk. Their development and testing covered STM32F205 and STM32F427 devices. The emphasis on characterization, repeatability, and avoiding corruption makes this especially valuable when the contents of the target matter more than a successful demonstration. Project and artifacts · Watch the REcon talk.

The $15 Servo Rabbit Hole

Enigma tackles a deceptively awkward robotics problem: assigning individual IDs to default-configured STS3215 servos already sharing a bus. Undocumented reboot behavior and timing differences create a way forward; moving timing-sensitive work to the adapter improves reliability. The resulting writeup connects protocol assumptions, bus collisions, and host jitter to a real engineering problem, with additional lessons about calibration and protection handling. Read the investigation.

Archive Pick: MITMing the Xbox 360 Dashboard

Lander’s 2024 retrospective revisits Xbox 360 research from around 2010–2011. Plaintext delivery, signatures accepted across retail and internal environments, and Preview Tool staging behavior opened a path to arbitrary dashboard Lua scripting. The result remained within the dashboard scripting environment. A useful case study in separating content authenticity from its intended audience, and in the production consequences of debug and staging features. Read the writeup.

Prism Internals: Reversing Microsoft’s Binary Translator

Hugo Guillaume examines Prism’s x86/x64-to-ARM64 translation pipeline, hybrid PE loading, and undocumented .jc translation cache. The research follows differences in cache-integrity handling into translation-cache poisoning, with supporting analysis tools released alongside it. A strong REcon pick for readers interested in binary translation and the security assumptions introduced when executable code gains another on-disk representation. Watch the talk · Paper, slides, and tools.

FAME: Recovering ROM Contents from the Circuitry

Olivier Thomas presents the Fully Analytical MEthod: reconstruct ROM circuitry from silicon imagery, model its logic in HDL, and simulate it to recover contents through scrambling and modeled decryption logic. “RE only” still involves access to images of the relevant chip layers. The appeal is the systematic treatment of decoding and control logic instead of relying on guesses about the memory layout. Watch the REcon talk.

OFFZONE Watchlist

Six talks for the queue, please use English dubbing:

Harmony OS Next security. Igor Krivonos examines how the mobile OS differs from Android, its research tooling, emulator rooting, and dynamic code loading. Useful context for researchers moving into a different mobile platform. Watch.
Chinese STM32 clones. Aleksandr Belov investigates readout protection in Puya Semiconductor microcontrollers and a firmware-extraction flaw that avoids complex fault injection. The target is Puya’s implementation, so keep the vendor distinction in mind. Watch.
Realtek protections under FI and SCA. Pavel Ivannikov and Yuriy Mishchenko combine fault injection and side-channel analysis, examining what inexpensive measurement equipment can reveal about an initially opaque target. Watch.
Glitching Secure Boot on Rockchip RK3588. Vladimir Kononovich presents work on the Orange Pi 5 Max, including practical preparation for power-fault attacks and lessons that can inform experiments on other chips. Watch.
Let The World Burn: VMware vCenter. Andrey Chizhov traces a route to unauthenticated remote code execution and root privileges in vCenter. A software-exploitation detour for readers following attacks against virtualization management infrastructure. Watch.
Bombini: eBPF and Rust for host security. Georgiy Savidov and Andrey Fedotov introduce an agent for hosts and Kubernetes, covering rule-based filtering in the Linux kernel, LSM hooks, and comparisons with Falco and Tetragon. Watch.

Tooling and More

Local AI with Strix Halo & R9700

xct pairs a 128 GB Strix Halo mini PC with a 32 GB Radeon AI PRO R9700 over OCuLink for local research workloads. The useful part is the follow-up: an unreliable adapter needed replacing, and splitting models across both GPUs often lost performance at long context because communication crossed the PCIe x4 link. Read this for the measured tradeoffs between memory capacity, bandwidth, and usable inference speed before copying the build. Read the build log.

Onur Mutlu: Digital Design and Computer Architecture

The Spring 2026 opening lecture starts with fundamentals, transistors, and gates. For researchers who regularly encounter hardware behavior through an exploit writeup, this is a good route back to the underlying design principles. The course schedule provides the progression into logic, processor design, and memory systems. Watch Lecture 1 · Course schedule.

Archive Pick: Vanderbilt’s Computer Security Reading List

Vanderbilt’s Spring 2024 CS8395 schedule doubles as a structured self-study syllabus: binary analysis, ARM debugging, Spectre and Rowhammer, GPU security, LLVM, and fuzzing. The value is the sequence of papers and assignments, which connects individual techniques to the systems assumptions behind them. Some linked recordings and course services require access. Browse the syllabus.

SecEngAI: Applied AI for Security Engineering

Muh. Fani “Rama” Akbar’s archive collects material on semantic code review with Claude Code and grepAI, MCP integrations, security CLI development, and research knowledge management. A useful bookmark for researchers building repeatable tooling around their analysis work; start with the code-review setup if navigating large repositories is your bottleneck. Browse the archive.

Reading Shelf: Platform Engineering at Google

James Brookbank, Leah Hargreaves, and Salim Virji examine coupling, shared responsibility, efficiency, and reliability in internal platforms. Adjacent to our usual coverage, but relevant when a research environment grows into infrastructure other people depend on. O’Reilly currently lists December 2026, with a table of contents that is not yet final, so treat this as a forthcoming title to follow. View the publisher’s listing.

Until Next Time

Thanks for reading ZeroDayCommission. If you have research, tools, or talks worth sharing, send them to hussein@orbitcurve.com.

— Hussein, OrbitCurve