Vacuum RCE, KVM Escapes, and Kyber Side Channels
ZeroDayCommission is a weekly, high-signal security briefing by OrbitCurve, focused on niche offensive and research-heavy domains: fault injection, MCU exploitation, µarch, hypervisors, compilers, embedded systems, and hardware reverse engineering. We curate material you can use: new primitives, reproducible PoCs, practical lab setups, and techniques that transfer across targets. No fluff, just this edition's best links, what changed, and why it matters.
Byte Brief
No Shark Is Safe: Millions of Shark Vacuums Are Vulnerable to RCE - A device certificate extracted from one vacuum could be used against other units through the shared AWS IoT MQTT infrastructure, eventually reaching a command-execution path. The writeup moves from UART and firmware analysis to cross-device RCE, camera access, motor control, floor-plan exposure, and plaintext Wi-Fi credentials. SharkNinja says the issue was fixed on July 20, 2026.
-> https://tokay0.com/posts/millions-of-shark-vacuums-vulnerable-to-rce.html
Januscape: A KVM Guest-to-Host Escape - CVE-2026-53359 is a shadow-MMU bug that turns a misfiled reverse-map entry into a host-kernel use-after-free and guest-to-host escape. The same trigger works across Intel and AMD virtualization paths, making this especially relevant to multi-tenant compute, nested virtualization, and GPU cloud environments.
-> https://www.stealthium.com/blog/januscape-kvm-guest-to-host-escape
TAPOcalypse Now: Exploiting TP-Link Smart Devices From Anywhere - TASZK Labs documents a broad security review of TP-Link Tapo cameras, including pre-authentication RCE, authentication bypasses, post-authentication memory-corruption chains, and a cloud-account compromise path. The post is particularly useful for its end-to-end treatment of firmware extraction, physical rooting, attack-surface discovery, and exploit development.
-> https://labs.taszk.io/articles/post/tapocalypse/
Dell BIOS Passwords: Weak XOR Encryption Allows Recovery from SPI Flash - Dell stored BIOS passwords as XOR-encrypted plaintext in the DVAR region of SPI flash rather than as one-way hashes. Short-password padding leaks the key, turning password recovery from a flash dump into a deterministic operation that completes without brute force.
Realtek SD Card Reader DMA from User Mode - A Realtek driver exposed enough device-register access for an unprivileged user-mode process to program the card reader's DMA path. The final proof of concept can write into the first 4 GB of physical memory, making this a strong case study in peripheral trust, driver attack surfaces, and undocumented hardware behavior.
-> https://zwclose.github.io/2026/07/08/rtsper2.html
Let Me Cook You a Vulnerability: Exploiting the Thermomix TM5 - Synacktiv tears down the Thermomix TM5, maps its i.MX28-based hardware and NAND layout, analyzes its recipe modules, and develops a firmware-downgrade chain that can lead to arbitrary code execution and persistence on affected firmware versions.
A Second-Order Side-Channel Attack on Masked Kyber768 - First-order masking successfully hides the secret from ordinary CPA, but the physical leakage remains split across the shares. Ledger Donjon combines the two leakages with a second-order model and recovers the target coefficient after roughly 200 traces once the points of interest are known.
-> https://donjon.ledger.com/blog/second-order-side-channel-attack-masked-kyber768/
Roblox Adds Android Remote Attestation - Selected Roblox experiences can now require device-backed checks that verify a real physical device, an unmodified client, and a trusted operating-system state. Rooted devices, unlocked bootloaders, emulators, and unsupported ROMs may fail the check, making this a useful real-world example of hardware-backed anti-cheat moving into mobile games.
-> https://en.help.roblox.com/hc/en-us/articles/49648939984916-Android-Remote-Attestation
Reads and Resources
Black-Box Probing Xiaomi's MJA1 Secure Chip - With no public datasheet available, Quarkslab identifies the chip on two Xiaomi camera products, probes its pins, recovers the I2C transport, dumps host flash through both a programmer and Raspberry Pi, and reverses the software protocol used to communicate with the secure element.
-> https://blog.quarkslab.com/black-box-probing-a-security-analysis-of-xiaomis-mja1-secure-chip.html
AI-Assisted Vulnerability Research on Embedded Targets - Quentin Kaiser gives an agent a real Netgear cable modem, serial access, Ghidra automation, a custom eCos GDB stub, and a constrained NixOS environment. Static reversing became largely autonomous, while live exploit development remained collaborative; the author reports both rediscovered bugs and additional unauthenticated RCE and denial-of-service findings.
-> https://quentinkaiser.be/security/2026/07/18/ia-assisted-vuln-research/
VReaves: Eavesdropping on VR Activity Through Electromagnetic Side Channels - This paper uses an SDR, a directional antenna, signal processing, and machine-learning models to infer which application a VR headset is running and what activity is taking place. The experiments cover commercial headsets and show how unintended electromagnetic emanations can become a practical privacy side channel.
-> https://arxiv.org/pdf/2506.17570
SoK: A Beginner-Friendly Introduction to Fault Injection Attacks - A structured introduction to voltage glitching, clock glitching, laser fault injection, EMFI, and Rowhammer. The paper combines a taxonomy, cost-versus-precision discussion, replication analysis, and a useful argument that hardware fault models and software-level fault analysis need to be studied together.
-> https://arxiv.org/pdf/2509.18341v1
UEFI Is the New BIOS, Parts 0 and 1 - Leviathan's series lays out a roadmap from UEFI fundamentals through static analysis, dynamic analysis, fuzzing, and exploit development. The lab-setup installment then moves from theory into a reproducible environment for extracting, inspecting, and testing platform firmware.
-> https://www.leviathansecurity.com/blog/uefi-is-the-new-bios
-> https://www.leviathansecurity.com/blog/uefi-is-the-new-bios-lab-setup
Lelouch: Reverse Engineering an SJCAM Action Camera and Rewriting Its Firmware - A deep reverse-engineering project around an Allwinner V3-based SJCAM SJ4000 Air, covering proprietary Android-based firmware, custom parsers and tooling, a fully open-source replacement firmware effort, and an arbitrary-code-execution flaw involving crafted FEX data.
What Is LG Monitor App Manager Actually Doing? - A clean .NET reversing walkthrough that unpacks a modern Eazfuscator-protected binary and traces how LG's monitor utility reads EDID data, fetches remote software catalogs, silently installs selected packages, and handles an affiliate-driven McAfee path. Good material on consumer-device software distribution and trust chains.
-> https://xusheng.dev/posts/reversing/lg_monitor_app_manager/readme/
A SIM Hacking Odyssey: Can a SIM Hack You? - The presentation treats the SIM as an active computing platform rather than passive storage. It covers custom SIM emulation and interface hardware, hostile-SIM testing, baseband fuzzing, lock-screen bypass research, and SIM-originated AT commands across phones, modems, automotive systems, and IoT targets.
-> https://troopers.de/downloads/troopers26/TR26_A_SIM_Hacking_Odyssey_QADSVY.pdf
Dreamcast Architecture: A Practical Analysis - Rodrigo Copetti's architecture deep dive covers the SH-4 CPU, memory organization, PowerVR2 tile-based rendering, audio, boot flow, I/O, networking, anti-piracy, and homebrew. It is not a vulnerability writeup, but it is excellent systems material for console and embedded reverse engineers.
-> https://www.copetti.org/writings/consoles/dreamcast/
How Far Can $20 Get You in Hardware Hacking with GPT-5.6 Sol? - An AI-assisted assessment of an ESP-12F-based PainStation moves from safe wiring and passive UART capture to firmware acquisition, Binary Ninja analysis, proof-of-concept generation, and manual validation. The final model spend was $6.23, but the experiment also shows exactly where hardware judgment and human validation remain mandatory.
-> https://www.linkedin.com/pulse/how-far-can-20-get-you-hardware-hacking-gpt-56-edxrc/
Exploring Cybersecurity Attack Vectors in Rocket Propulsion - Paul Coggin applies security threat modeling to rocket propulsion and its surrounding control architecture. A useful cyber-physical talk for researchers interested in safety-critical embedded systems, time-triggered networks, and attack-tree reasoning outside conventional IT targets.
-> https://www.youtube.com/watch?v=vLPYyz8G0-g
Tooling and More
Bluetooth Security Timeline - Xeno Kovah's large TiddlyWiki maps Bluetooth research across protocols, attack surfaces, implementation flaws, pairing failures, relay attacks, firmware, side channels, tooling, and historical disclosures. An unusually dense reference for anyone beginning or expanding Bluetooth research.
-> https://darkmentor.com/bt.html
SELECT * FROM Binary: Vibe Reversing Across IDA, Ghidra, and Binary Ninja - Slides and supporting material from REcon 2026 on applying the same SQL-style query model across multiple reverse-engineering platforms. Useful for researchers interested in portable analysis logic, automation, and querying binary artifacts as structured data.
Hardwear.io USA 2026 Playlist - The full conference playlist is now available, collecting technical talks across hardware implants, fault injection, firmware security, TPM key extraction, wireless devices, embedded exploitation, and hardware-assisted attacks.
-> https://www.youtube.com/playlist?list=PLWAG1Gbib488
Reverse Engineering a Ledger Nano X Hardware Implant - Joe Grand walks through the reverse engineering of a real hardware implant discovered inside a Ledger Nano X. The investigation crosses PCB analysis, firmware reverse engineering, RF work, and physical supply-chain threat modeling.
-> https://www.youtube.com/watch?v=WNpW52x-EWY
BadUSB Forensics - A compact practical guide for checking whether a USB cable is malicious using an old Raspberry Pi, Wi-Fi and Bluetooth dongles, USB power measurements, kernel logs, packet capture, and RF observation. Both the slides and recording are available.
-> Slides: https://archives.pass-the-salt.org/Pass%20the%20SALT/2026/slides/PTS2026-RUMP-01-BadUSB-forensic.pdf
-> Presentation: https://archives.pass-the-salt.org/Pass%20the%20SALT/2026/videos/PTS2026-Rump-01.mp4
Embedded Software Engineering 101 - An old but evergreen series that starts with basic microcontroller architecture and builds through MSP430 development, memory, GPIO, interrupts, timers, assembly, and C. Useful foundational reading for software researchers moving toward physical devices.
