Primary-source analysis on embedded Linux, firmware security, long-term support, and EU Cyber Resilience Act regulation for device manufacturers. https://firmdura.com/news/ 2026-11-15T00:00:00Z https://firmdura.com/assets/icon.png https://firmdura.com/assets/logo.png © 2026 Firmdura UG (haftungsbeschränkt) Firmdura https://firmdura.com/ info@firmdura.com https://firmdura.com/news/openssl-november-2026-advisory.html 2026-11-10T00:00:00Z 2026-11-15T00:00:00Z

OpenSSL has published Git commits for five low-severity vulnerabilities ahead of its 1 December point releases. Four of the five do not affect OpenSSL 3.0, while the fifth reaches only specific CMS encryption paths.

https://firmdura.com/news/openssh-musl-authentication-bypass.html 2026-11-09T00:00:00Z 2026-11-15T00:00:00Z

An OpenSSH password authentication bypass affecting certain musl-based Linux configurations is listed in CISA's KEV catalog. Assessing exposure requires reviewing build settings, account configuration, and daemon restarts.

https://firmdura.com/news/post-quantum-vendor-readiness.html 2026-11-05T00:00:00Z 2026-11-15T00:00:00Z

Joint guidance from CISA, the NSA, and Australia's cybersecurity agency helps buyers assess vendors' plans for post-quantum cryptography, including support for long-lived industrial and IoT devices.

https://firmdura.com/news/eu-connected-refrigeration-incidents.html 2026-11-04T00:00:00Z 2026-11-15T00:00:00Z

ENISA, the European Commission, Europol, and national CSIRTs report ongoing compromises of internet-exposed refrigeration controllers across Europe and remind manufacturers of mandatory CRA reporting.

https://firmdura.com/news/curl-http2-upload-fix.html 2026-10-14T00:00:00Z 2026-11-15T00:00:00Z

A use-after-free vulnerability in HTTP/2 uploads can allow remote code execution under specific conditions. Assessing its impact requires checking the firmware's build configuration, enabled features, and applied patches.

https://firmdura.com/news/mikrotik-routeros-incomplete-fix.html 2026-10-06T00:00:00Z 2026-11-15T00:00:00Z

An updated RouterOS advisory asks some customers to upgrade again after an incomplete security fix. The correction highlights the importance of testing whether a patch fully resolves a vulnerability.

https://firmdura.com/news/cra-reporting-platform-live.html 2026-09-11T00:00:00Z 2026-11-15T00:00:00Z

ENISA's Single Reporting Platform is operational. Manufacturers may need to submit an initial notification within 24 hours, while the investigation and firmware repair are still in progress.

https://firmdura.com/news/cip-decade-long-kernel-support.html 2026-08-06T00:00:00Z 2026-11-15T00:00:00Z

CIP's anniversary review describes the security backports, configuration-specific vulnerability assessments, and hardware testing needed to maintain selected industrial Linux kernels into the 2030s.

https://firmdura.com/news/sbom-minimum-elements-2026.html 2026-07-29T00:00:00Z 2026-11-15T00:00:00Z

Final joint guidance updates the minimum elements for a software bill of materials. Firmware teams should review their inventories and ensure each one describes the exact image they maintain.

https://firmdura.com/news/cra-implementation-guidance.html 2026-07-27T00:00:00Z 2026-11-15T00:00:00Z

The European Commission's guidance covers open-source software, substantial modifications, support periods, and reporting. It includes 67 practical examples to help manufacturers understand how the rules apply.

https://firmdura.com/news/yocto-wrynose-lts.html 2026-05-13T00:00:00Z 2026-11-15T00:00:00Z

Wrynose offers support until April 2030 and changes how SBOM and CVE information is generated. Manufacturers need to update their build and reporting tools as part of the migration.

https://firmdura.com/news/openwrt-apk-transition.html 2026-03-05T00:00:00Z 2026-11-15T00:00:00Z

OpenWrt 25.12 replaces opkg with apk and includes tools for attended firmware upgrades. The transition also requires a review of provisioning scripts, saved settings, and configuration migration.