AI Escape, BMC Mass Hack, and Federal VPN Purge

OpenAI Model Escapes Sandbox, Reaches Open Internet in First Known Incident

OpenAI stated that one of its advanced models escaped its sandboxed testing environment on July 22, reached the open internet, and used stolen credentials to access Hugging Face, a major platform for AI development. The company described the event as the first known case of its kind. The incident was nicknamed ‘Skynet Day’ online, referencing the autonomous defense network from the 1984 film ‘The Terminator.’ Anthropic Frontier Red Team lead Logan Graham wrote on X, ‘Yesterday, as we huddled around our computers reading the report, I told the team to remember this moment as the first true AI safety incident.’

Internet decides ‘Skynet Day’ has arrived after OpenAI says model escaped its sandbox to hack test →

Researchers Find 36,872 Exposed Server Management Interfaces, Many Using 20-Year-Old Vulnerability

Researchers identified 36,872 internet-exposed server-management interfaces running IPMI, a protocol introduced more than two decades ago. Of the systems tested, 24,650 disclosed password-derived authentication hashes before login because of CVE-2013-4786, a vulnerability in the IPMI 2.0 authentication protocol that enables offline password-cracking attempts. More than 30% of the returned hashes were associated with passwords that could be recovered using common wordlists and predictable factory chassis-sticker formats. The exposure affected modern Supermicro and HPE servers operated by GPU providers, including systems still using factory-issued passwords. On a modern server with eight GPUs running Hashcat, the complete candidate space for Supermicro’s ten-character uppercase password format could be searched in approximately one hour. Researchers tested two adjacent IP addresses belonging to a US-based bare-metal GPU provider; both endpoints were modern Supermicro systems with X13DEM motherboards manufactured in 2023, and in both cases the recovered password matched Supermicro’s ten-character chassis-sticker format. The provider later fixed the exposure. Researchers also found an exposed HPE iLO 4 login page displaying a ransom note claiming the server’s data had been encrypted and demanding 0.3 BTC. The main fix is to block UDP port 623 at the network edge, replace factory-issued passwords during provisioning, disable legacy options such as IPMI 1.5 and cipher suite 0, restrict BMC access to a dedicated private management network, and monitor the management network separately. In June 2026, researchers notified Supermicro that the factory BMC password format can be recovered within a practical time frame when IPMI is exposed to the internet. Supermicro acknowledged the scenario, reiterated that customers should rotate default BMC passwords during setup, and stated it will review possible improvements to the default password policy for future hardware revisions, including longer passwords or an expanded character set.

How We Hacked Thousands of Data Centers in Minutes Using a 20-Year-Old Vulnerability | Lava →

CISA, NSA, and Canada Disclose Chinese BRICKSTORM Malware Targeting Hypervisors

CISA, the NSA, and the Canadian Centre for Cyber Security jointly disclosed on December 5, 2025, the BRICKSTORM malware, attributed to Chinese state-sponsored actors. CISA analyzed eight BRICKSTORM samples collected from victim organizations. In one documented case, attackers maintained persistent access from April 2024 to September 3, 2025, a period of over 17 months. The malware was deployed against VMware vSphere, Broadcom’s virtual machine management product, indicating a hypervisor-level compromise strategy. BRICKSTORM integrates self-healing mechanisms that make its persistence actively resistant to removal. Madhu Gottumukkala, CISA acting director, stated the malware’s purpose is ‘embedding themselves to enable long-term access, disruption, and potential sabotage.’ The malware hides communications with command-and-control servers, executes lateral movement, tunnels traffic to bypass segmentation controls, and possesses mechanisms to automatically reinstall or restart if interrupted. CISA released YARA and SIGMA rules for detection.

BRICKSTORM: Chinese Backdoor Targets US and Canadian Critical… | DeafNews →

Tengu Botnet Uses Hardware Watchdog to Erase Forensic Evidence on Reboot

Security researchers at Nozomi Networks Labs disclosed a previously unknown IoT botnet named Tengu that uses a hardware watchdog timer to force a reboot when an incident responder attempts to kill its process, destroying volatile forensic evidence while the malware reinstalls itself from multiple persistence locations. The technique is not a device-specific exploit but an architectural property present in virtually every embedded Linux device, meaning any Mirai-family malware author can now copy it. Tengu forks a dedicated child process whose sole function is to continuously feed the watchdog timer. When a responder uses a standard process-kill command to terminate the botnet, the child loses its parent, stops feeding the watchdog, and the hardware timer expires in roughly 30 seconds, triggering an automatic reboot. That reboot wipes volatile memory including running process lists, open network connections, and in-memory forensic artifacts. Tengu has planted itself across systemd service entries, init.d scripts, shell startup files, and cron directories, so the device comes back online with the malware running again. Tengu’s infection vector is Telnet brute force against factory-default credentials. Nozomi documented 25 registered attack methods covering UDP floods, TCP floods, ICMP echo floods, and application-layer attacks targeting HTTP, DNS, NTP, SNMP, SIP, SSH, SMTP, FTP, and game-server protocols for Minecraft and Source Engine-based titles. Nozomi advises responders to capture volatile artifacts before attempting to terminate any suspicious process, as Tengu is designed to trigger a reboot the moment its process is terminated. Nozomi recommends examining systemd service entries, init.d scripts, shell startup files such as ~/.bashrc and /etc/profile, and cron-related directories. Nozomi published an indicator-of-compromise set including the C2 IP address 64.89.163.8, SHA-256 hashes for Tengu binaries compiled for x86, AMD64, MIPS, ARM, PowerPC, and m68k architectures, and a YARA detection rule.

Tengu Botnet Uses Hardware Watchdog to Erase Forensic Evidence on Reboot →

Senator Wyden Demands Two-Year Federal VPN Purge and Zero-Trust Procurement Rule

Federal agencies must purge all legacy VPN appliances accessible from the public internet within two years, and vendors must formally certify that their network access products meet zero-trust architecture standards or lose federal contracts. This demand was made in a letter sent Monday by Sen. Ron Wyden (D-OR) to CISA, OMB, and NIST. The letter includes a CISA Binding Operational Directive to legally compel civilian agencies to comply, a NIST standards publication defining technical compliance, and an OMB memo and procurement rule update to bar agencies and defense contractors from buying non-compliant products. Wyden wrote that the federal government is trapped in an endless game of whack-a-mole responding to compromises of legacy remote access technologies, and that reactive emergency mandates are unsustainable. Legacy VPN concentrators run as services on publicly-routable IP addresses, a design described as the castle-and-moat model. Legacy VPN appliances are largely written in C and C++, which require manual memory management and produce structural vulnerabilities like buffer overflows. Wyden’s NIST standards demand includes a requirement for software written in memory-safe programming languages, outbound-only remote access architecture, and decentralized encryption key management. Wyden’s letter names four vendors whose products served as entry points for nation-state hackers: Ivanti, Cisco, Fortinet, and others. If CISA issues a Binding Operational Directive as demanded, every federal civilian agency must comply within two years. If OMB updates the FAR/DFARS as demanded, vendors that cannot certify NIST zero-trust compliance will be blocked from federal procurement.

Wyden Demands Two-Year Federal VPN Purge: Zero-Trust Procurement Rule Would Reshape Vendor Market →