The Firmdura briefing
Our briefings explain key developments in embedded Linux, firmware security, and product regulation, with practical guidance for device manufacturers.
10 selected briefingsPublished
An OpenSSH password authentication bypass affecting certain musl-based Linux configurations is now listed in CISA’s Known Exploited Vulnerabilities catalog. OpenSSH and Alpine have released fixes. Assessing exposure requires a review of both build settings and runtime configuration.
Read the briefingIn focus
Latest announcements and updates
Joint guidance from CISA, the NSA, and Australia’s cybersecurity agency helps buyers assess vendors’ plans for post-quantum cryptography, including support for long-lived industrial and IoT devices.
Read the briefingA use-after-free vulnerability in HTTP/2 uploads can allow remote code execution under specific conditions. Assessing its impact requires checking the firmware’s build configuration, enabled features, and applied patches.
Read the briefingAn updated RouterOS advisory asks some customers to upgrade again after an incomplete security fix. The correction highlights the importance of testing whether a patch fully resolves a vulnerability.
Read the briefingENISA’s Single Reporting Platform is operational. Manufacturers may need to submit an initial notification within 24 hours, while the investigation and firmware repair are still in progress.
Read the briefingCIP’s anniversary review describes the security backports, configuration-specific vulnerability assessments, and hardware testing needed to maintain selected industrial Linux kernels into the 2030s.
Read the briefingFinal joint guidance updates the minimum elements for a software bill of materials. Firmware teams should review their inventories and ensure each one describes the exact image they maintain.
Read the briefingThe European Commission’s guidance covers open-source software, substantial modifications, support periods, and reporting. It includes 67 practical examples to help manufacturers understand how the rules apply.
Read the briefingWrynose offers support until April 2030 and changes how SBOM and CVE information is generated. Manufacturers need to update their build and reporting tools as part of the migration.
Read the briefingOpenWrt 25.12 replaces opkg with apk and includes tools for attended firmware upgrades. The transition also requires a review of provisioning scripts, saved settings, and configuration migration.
Read the briefingEach briefing includes primary-source references and Firmdura’s engineering analysis. Story dates refer to the original announcements or advisory updates. The briefings were published on , when their sources were also reviewed.
