[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"public-config":3,"i-flag:ph-4x3":14,"i-flag:us-4x3":19,"i-flag:de-4x3":21,"i-flag:hk-4x3":23,"i-tabler:lifebuoy":25,"i-tabler:timeline":28,"i-tabler:apps":30,"i-tabler:package":32,"i-tabler:circle-half-2":34,"i-tabler:sun":36,"i-tabler:moon":38,"i-tabler:menu-2":40,"i-tabler:user":42,"i-tabler:notebook":44,"i-simple-icons:forgejo":46,"i-tabler:shield-lock":48,"i-tabler:tools":50,"i-tabler:calendar":52,"i-tabler:x":54,"$f39gtl1kk2uimx":56,"i-tabler:arrow-left":122,"i-tabler:tag":124},{"matomo":4,"booking":7,"site":9,"blog":11,"newsletter":12},{"enabled":5,"siteId":6},true,"7",{"enabled":5,"url":8},"https:\u002F\u002Fcal.com\u002Fjdbungart",{"url":10},"https:\u002F\u002Fjdneer.com",{"enabled":5},{"enabled":13},false,{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":18},0,640,480,"\u003Cpath fill=\"#0038a8\" d=\"M0 0h640v240H0z\"\u002F>\u003Cpath fill=\"#ce1126\" d=\"M0 240h640v240H0z\"\u002F>\u003Cpath fill=\"#fff\" d=\"M415.7 240L0 480V0\"\u002F>\u003Cpath fill=\"#fcd116\" d=\"M26.7 42.4L41 55l16.6-9.2l-7.4 17.5l14 13l-19-1.6l-8.1 17.2l-4.3-18.5L14 71l16.3-10zm323.8 172.3l.4 19l18 6.3l-18 6.2l-.4 19l-11.5-15.1l-18.2 5.5l10.8-15.6l-10.8-15.6l18.2 5.5zM37.2 388.1l8 17.2l19-1.6l-13.9 13l7.4 17.5l-16.6-9.1l-14.4 12.4l3.6-18.7L14 409l18.9-2.4zm114.2-249l-6.2 6.2l3.1 47l-3 .3l-5.7-42.9l-5.1 5l7.6 38.4a48 48 0 0 0-17.2 7.1l-21.7-32.4H96l26.4 34.3l-2.4 2l-31.1-35.5h-8.8v8.8l35.4 31l-2 2.5l-34.3-26.3v7.1l32.5 21.7q-5.2 7.8-7.1 17.2L66.3 223l-5.1 5l42.9 5.7q-.3 1.6-.3 3.1l-47-3l-6.2 6.2l6.2 6.2l47-3.1l.3 3.1l-42.9 5.7l5 5l38.4-7.6a48 48 0 0 0 7.1 17.2l-32.5 21.7v7.2l34.3-26.3l2 2.4l-35.4 31v8.8H89l31-35.4l2.5 2L96 312.2h7.2l21.7-32.5q7.8 5.2 17.2 7.1l-7.6 38.4l5 5l5.7-42.9q1.5.3 3.1.3l-3 47l6.1 6.2l6.3-6.2l-3.1-47l3-.3l5.7 43l5.1-5.1l-7.6-38.4a48 48 0 0 0 17.2-7.1l21.7 32.5h7.2l-26.4-34.3l2.4-2l31.1 35.4h8.8v-8.8l-35.4-31l2-2.4l34.3 26.3v-7.2l-32.5-21.7q5.2-7.8 7.1-17.2l38.3 7.6l5.1-5l-42.9-5.7q.3-1.5.3-3.1l47 3l6.2-6.1l-6.2-6.2l-47 3l-.3-3l42.9-5.7l-5-5l-38.4 7.5a48 48 0 0 0-7.1-17.2l32.5-21.7v-7.1l-34.3 26.3l-2-2.4l35.4-31v-8.9H214l-31 35.5l-2.5-2l26.4-34.3h-7.2L178 200.2q-7.8-5.2-17.2-7.1l7.6-38.3l-5-5l-5.7 42.8l-3.1-.3l3-47z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":20},"\u003Cpath fill=\"#bd3d44\" d=\"M0 0h640v480H0\"\u002F>\u003Cpath stroke=\"#fff\" stroke-width=\"37\" d=\"M0 55.3h640M0 129h640M0 203h640M0 277h640M0 351h640M0 425h640\"\u002F>\u003Cpath fill=\"#192f5d\" d=\"M0 0h364.8v258.5H0\"\u002F>\u003Cmarker id=\"SVGEq3dreKJ\" markerHeight=\"30\" markerWidth=\"30\">\u003Cpath fill=\"#fff\" d=\"m14 0l9 27L0 10h28L5 27z\"\u002F>\u003C\u002Fmarker>\u003Cpath fill=\"none\" marker-mid=\"url(#SVGEq3dreKJ)\" d=\"m0 0l16 11h61h61h61h61h60L47 37h61h61h60h61L16 63h61h61h61h61h60L47 89h61h61h60h61L16 115h61h61h61h61h60L47 141h61h61h60h61L16 166h61h61h61h61h60L47 192h61h61h60h61L16 218h61h61h61h61h60z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":22},"\u003Cpath fill=\"#fc0\" d=\"M0 320h640v160H0z\"\u002F>\u003Cpath fill=\"#000001\" d=\"M0 0h640v160H0z\"\u002F>\u003Cpath fill=\"red\" d=\"M0 160h640v160H0z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":24},"\u003Cpath fill=\"#ec1b2e\" d=\"M0 0h640v480H0\"\u002F>\u003Cpath id=\"SVG5tfvBPpj\" fill=\"#fff\" d=\"M346.3 103.1C267 98 230.6 201.9 305.6 240.3c-26-22.4-20.6-55.3-10.1-72.4l1.9 1.1c-13.8 23.5-11.2 52.7 11.1 71c-12.7-12.3-9.5-39 12.1-48.9s23.6-39.3 16.4-49.1q-14.7-25.6 9.3-38.9M307.9 164l-4.7 7.4l-1.8-8.6l-8.6-2.3l7.8-4.3l-.6-8.9l6.5 6.1l8.3-3.3l-3.7 8.1l5.6 6.8z\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(72 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(144 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(216 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(288 312.5 243.5)\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":27},24,"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0\"\u002F>\u003Cpath d=\"M3 12a9 9 0 1 0 18 0a9 9 0 1 0-18 0m12 3l3.35 3.35M9 15l-3.35 3.35m0-12.7L9 9m9.35-3.35L15 9\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":29},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"m4 16l6-7l5 5l5-6\"\u002F>\u003Cpath d=\"M14 14a1 1 0 1 0 2 0a1 1 0 1 0-2 0M9 9a1 1 0 1 0 2 0a1 1 0 1 0-2 0m-6 7a1 1 0 1 0 2 0a1 1 0 1 0-2 0m16-8a1 1 0 1 0 2 0a1 1 0 1 0-2 0\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":31},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 5a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1zm0 10a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1zm10 0a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1h-4a1 1 0 0 1-1-1zm0-8h6m-3-3v6\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":33},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"m12 3l8 4.5v9L12 21l-8-4.5v-9zm0 9l8-4.5M12 12v9m0-9L4 7.5m12-2.25l-8 4.5\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":35},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M3 12a9 9 0 1 0 18 0a9 9 0 1 0-18 0m9-9v18m0-7l7-7m-7 12l8.5-8.5M12 9l4.5-4.5\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":37},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0m-5 0h1m8-9v1m8 8h1m-9 8v1M5.6 5.6l.7.7m12.1-.7l-.7.7m0 11.4l.7.7m-12.1-.7l-.7.7\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":39},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M12 3h.393a7.5 7.5 0 0 0 7.92 12.446A9 9 0 1 1 12 2.992z\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":41},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 6h16M4 12h16M4 18h16\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":43},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 7a4 4 0 1 0 8 0a4 4 0 0 0-8 0M6 21v-2a4 4 0 0 1 4-4h4a4 4 0 0 1 4 4v2\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":45},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M6 4h11a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H6a1 1 0 0 1-1-1V5a1 1 0 0 1 1-1m3 0v18m4-14h2m-2 4h2\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":47},"\u003Cpath fill=\"currentColor\" d=\"M16.777 0a2.9 2.9 0 1 1-2.529 4.322H12.91a4.266 4.266 0 0 0-4.265 4.195v2.118a7.08 7.08 0 0 1 4.147-1.42l.118-.002h1.338a2.9 2.9 0 0 1 5.43 1.422a2.9 2.9 0 0 1-5.43 1.422H12.91a4.266 4.266 0 0 0-4.265 4.195v2.319A2.9 2.9 0 0 1 7.222 24A2.9 2.9 0 0 1 5.8 18.57V8.589a7.11 7.11 0 0 1 6.991-7.108l.118-.001h1.338A2.9 2.9 0 0 1 16.778 0M7.223 19.905a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.389m9.554-10.464a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.39m0-7.735a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.389\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":49},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M12 3a12 12 0 0 0 8.5 3A12 12 0 0 1 12 21A12 12 0 0 1 3.5 6A12 12 0 0 0 12 3\"\u002F>\u003Cpath d=\"M11 11a1 1 0 1 0 2 0a1 1 0 1 0-2 0m1 1v2.5\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":51},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M3 21h4L20 8a1.5 1.5 0 0 0-4-4L3 17zM14.5 5.5l4 4\"\u002F>\u003Cpath d=\"M12 8L7 3L3 7l5 5M7 8L5.5 9.5M16 12l5 5l-4 4l-5-5m4 1l-1.5 1.5\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":53},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 7a2 2 0 0 1 2-2h12a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2zm12-4v4M8 3v4m-4 4h16m-9 4h1m0 0v3\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":55},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M18 6L6 18M6 6l12 12\"\u002F>",{"slug":57,"title":58,"excerpt":59,"image":60,"publishedAt":61,"topics":62,"readMinutes":69,"html":70,"metaTitle":58,"metaDescription":71,"shareImage":72,"updatedAt":76,"author":77,"related":80},"a-16-year-old-broadcom-wi-fi-bug-lets-attackers-root-isp-gateways-from-across-the-street","A 16-Year-Old Broadcom Wi-Fi Bug Lets Attackers Root ISP Gateways From Across the Street","Researcher Quentin Kaiser has shown that a WPS bug in Broadcom's Wi-Fi code, present since at least 2010, gives attackers in radio range root on ISP gateways without the Wi-Fi password. Broadcom refused to assign a CVE, and the Belgian ISP boxes he tested are still unpatched.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fbroadcom_wps_advisory.png","2026-10-18T18:33:27.000+08:00",[63,66],{"key":64,"label":65},"advisories","Advisories",{"key":67,"label":68},"security","Security",4,"\u003Cp>A memory corruption bug in Broadcom's own Wi-Fi software lets an attacker within radio range take full control of affected home gateways without knowing the Wi-Fi password, security researcher Quentin Kaiser disclosed on October 16, 2026. He presented the work at \u003Ca href=\"https:\u002F\u002Fwww.hexacon.fr\u002Fconference\u002Fspeakers\u002F?ref=ghost.jdneer.com#one_parser_two_bugs\">Hexacon\u003C\u002Fa> in Paris the same day and published a \u003Ca href=\"https:\u002F\u002Fquentinkaiser.be\u002Fsecurity\u002F2026\u002F10\u002F16\u002Fone-parser-two-bugs\u002F?ref=ghost.jdneer.com\">long-form write-up\u003C\u002Fa> and \u003Ca href=\"https:\u002F\u002Fquentinkaiser.be\u002Fassets\u002Fqkaiser-broadcom-wps-hexacon-2026.pdf?ref=ghost.jdneer.com\">slides\u003C\u002Fa>.\u003C\u002Fp>\u003Cp>The flaw sits in how Broadcom's proprietary 802.11 stack reassembles fragmented WPS (Wi-Fi Protected Setup) EAP messages. Kaiser traces the vulnerable code in Broadcom's SDK back to at least 2010. According to his write-up, it can be triggered over the air without the network key and without completing a normal WPS enrollment, and exploitation gives both controlled information disclosure and arbitrary code execution.\u003C\u002Fp>\u003Ch2 id=\"no-cve-and-a-fix-that-never-reached-many-devices\">No CVE, and a fix that never reached many devices\u003C\u002Fh2>\u003Cp>There is no CVE for this bug, and there is no public Broadcom advisory. Kaiser reported it to Broadcom's PSIRT in July 2026. Broadcom replied that it has known about the issue for a long time, that other researchers had reported it too, and that the old WPS Monitor based code was replaced starting in 2018 by an implementation built on hostapd and wpa_supplicant. Kaiser describes the 2018 change as an incomplete patch released silently. Broadcom declined to register a CVE or share the notice it sent to device makers, and CERT\u002FCC closed his case the same day it was opened because Broadcom is its own CVE Numbering Authority.\u003C\u002Fp>\u003Cp>His slides show the affected chips span cable (DOCSIS) and DSL gateway families:\u003C\u002Fp>\n\n\u003Ctable>\u003Cthead>\u003Ctr>\u003Cth>Platform\u003C\u002Fth>\u003Cth>Chip families\u003C\u002Fth>\u003Cth>Kaiser's verdict\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd>eCos\u003C\u002Ftd>\u003Ctd>BCM3380, BCM3383, BCM33834\u003C\u002Ftd>\u003Ctd>\"Forever day\"\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd>Linux\u003C\u002Ftd>\u003Ctd>BCM3390, BCM65xx, BCM68xx\u003C\u002Ftd>\u003Ctd>\"Potential forever day\"\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\n\n\u003Cp>On the Linux platforms, the fix is for the device maker to move to the hostapd-based Wi-Fi stack. Because there is no fix for the eCos platforms, owners of those gateways depend on the ISP or manufacturer replacing the hardware or the software stack.\u003C\u002Fp>\u003Ch2 id=\"belgian-isp-gateways-shown-vulnerable\">Belgian ISP gateways shown vulnerable\u003C\u002Fh2>\u003Cp>Kaiser says he confirmed the bug is present and exploitable on gateways from three of Belgium's four major ISPs: Proximus, VOO and Orange Belgium. Telenet may be affected through Sagemcom F@st devices, but he could not test one. As of October 15, 2026, none of the affected devices had been patched, he writes. His demo videos show unauthenticated code execution on an Orange Belgium Askey TCG3000, where the payload reads the Wi-Fi key from memory and sends it back over the air, and a reverse shell over 802.11 frames on a Proximus BBOX 3V+. He says the attack works over long distances, not only when the antennas are close.\u003C\u002Fp>\u003Cp>Using public subscriber figures, Kaiser estimates at least 1.5 million affected gateways in Belgium alone, with what he calls medium confidence:\u003C\u002Fp>\n\n\u003Ctable>\u003Cthead>\u003Ctr>\u003Cth>ISP\u003C\u002Fth>\u003Cth>Models named\u003C\u002Fth>\u003Cth>Est. affected\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd>Proximus\u003C\u002Ftd>\u003Ctd>BBOX 3, BBOX 3V+\u003C\u002Ftd>\u003Ctd>850,000\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd>VOO (legacy fleet)\u003C\u002Ftd>\u003Ctd>Netgear CG3100, CG3700, Technicolor TC7210, CGA4233\u003C\u002Ftd>\u003Ctd>500,000\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd>Orange Belgium\u003C\u002Ftd>\u003Ctd>Askey TCG3000\u003C\u002Ftd>\u003Ctd>210,000\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd>Telenet\u003C\u002Ftd>\u003Ctd>Sagemcom F@ST3896LG, F@ST5685LGB (not confirmed)\u003C\u002Ftd>\u003Ctd>Unknown\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\n\n\u003Cp>The problem is not limited to Belgium. The affected-device list in Kaiser's \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fqkaiser\u002Fbroadcom-wps?ref=ghost.jdneer.com\">toolkit repository\u003C\u002Fa> names products from ARRIS, Arcadyan, Askey, CastleNET, Cisco, Comtrend, Huawei, MitraStar, Netgear, Nokia, Sagemcom, TP-Link, Zyxel and ZTE, among others, deployed by ISPs including KPN, Movistar, SFR and Türk Telekom. In a passive scan in Paris, his slides list some Orange and Bouygues boxes on newer chips as patched, while an Orange Sagemcom Fast5656 and SFR NB6VAC units were not. No vendor or ISP advisory for the bug could be found at the time of writing.\u003C\u002Fp>\u003Cp>Kaiser has not released exploit code. What he did publish is a detection toolkit: a fingerprinting script for live access points and YARA rules for firmware images. He also warns that bugs like this suit attackers who use nearby Wi-Fi networks to get in, pointing to Volexity's \u003Ca href=\"https:\u002F\u002Fwww.volexity.com\u002Fblog\u002F2024\u002F11\u002F22\u002Fthe-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access\u002F?ref=ghost.jdneer.com\">\"Nearest Neighbor Attack\"\u003C\u002Fa> report and Microsoft's report on \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F07\u002F31\u002Fcaptivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft\u002F?ref=ghost.jdneer.com\">Midnight Blizzard targeting travelers\u003C\u002Fa> through hotel networks.\u003C\u002Fp>\u003Ch2 id=\"are-you-affected\">Are you affected?\u003C\u002Fh2>\u003Cp>\u003Cstrong>1. Identify your gateway.\u003C\u002Fstrong> Check the label on the box or the admin page for the brand and model, then compare it with the affected-device table in the \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fqkaiser\u002Fbroadcom-wps?ref=ghost.jdneer.com\">broadcom-wps repository\u003C\u002Fa> and the ISP table above. A match, especially an ISP-supplied cable or DSL gateway, means the device is likely exposed.\u003C\u002Fp>\u003Cp>\u003Cstrong>2. Fingerprint your own access point.\u003C\u002Fstrong> Kaiser's script needs a Wi-Fi adapter that supports monitor mode. Only run it against networks you own or are authorized to test. Put the adapter in monitor mode (replace \u003Ccode>wlan0\u003C\u002Fcode> with your interface):\u003C\u002Fp>\u003Cpre>\u003Ccode>sudo ip link set dev wlan0 down\nsudo iw dev wlan0 set monitor none\nsudo ip link set dev wlan0 up\u003C\u002Fcode>\u003C\u002Fpre>\u003Cp>Then run the script against your SSID:\u003C\u002Fp>\u003Cpre>\u003Ccode>sudo uv run --with scapy \\\n  broadcom_fingerprint.py \\\n  --interface wlan0 \\\n  --ssid YOUR-SSID\u003C\u002Fcode>\u003C\u002Fpre>\u003Cp>An \u003Ccode>Assessment: LIKELY_VULNERABLE\u003C\u002Fcode> result means the access point appears to run the vulnerable Broadcom WPS code.\u003C\u002Fp>\u003Cp>\u003Cstrong>3. Scan firmware (for researchers and vendors).\u003C\u002Fstrong> On an extracted firmware tree, run:\u003C\u002Fp>\u003Cpre>\u003Ccode>yara -w -r broadcom_wps_monitor.yar \\\n  extracted_firmware_dir\u003C\u002Fcode>\u003C\u002Fpre>\u003Cp>A hit on \u003Ccode>VULN_BRCM_WPS_EAP_Fragment_Reassembly_ELF\u003C\u002Fcode> points to the vulnerable reassembly path. The README calls these rules triage aids: a patched binary can still match, so confirm by manual review.\u003C\u002Fp>\u003Cp>\u003Cstrong>4. Check the firmware and ask the ISP.\u003C\u002Fstrong> Note the firmware version on the gateway's admin page and ask the ISP or manufacturer whether it has been fixed or moved to the hostapd-based Wi-Fi stack. As of October 15, no fix had reached the Belgian devices Kaiser tested, and eCos-based gateways may never get one, so ask about a replacement.\u003C\u002Fp>\u003Cp>\u003Cstrong>5. Reduce exposure until there is a fix.\u003C\u002Fstrong> Kaiser does not document a workaround, and he does not say whether switching off WPS in the settings blocks the bug, so that should not be treated as a fix. Since the attack arrives over the gateway's own Wi-Fi, turning off the gateway's built-in Wi-Fi and using a separate, unaffected access point removes that path, if the ISP allows it.\u003C\u002Fp>\u003Cp>\u003Cstrong>6. Report what you find.\u003C\u002Fstrong> Kaiser asks for affected devices to be reported through a pull request on the repository, with vendor, product, firmware version and ISP.\u003C\u002Fp>\u003Cp>\u003Cem>Sources: \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Fquentinkaiser.be\u002Fsecurity\u002F2026\u002F10\u002F16\u002Fone-parser-two-bugs\u002F?ref=ghost.jdneer.com\">\u003Cem>Quentin Kaiser's write-up\u003C\u002Fem>\u003C\u002Fa>\u003Cem>, \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Fquentinkaiser.be\u002Fassets\u002Fqkaiser-broadcom-wps-hexacon-2026.pdf?ref=ghost.jdneer.com\">\u003Cem>Hexacon 2026 slides\u003C\u002Fem>\u003C\u002Fa>\u003Cem>, \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fqkaiser\u002Fbroadcom-wps?ref=ghost.jdneer.com\">\u003Cem>qkaiser\u002Fbroadcom-wps toolkit\u003C\u002Fem>\u003C\u002Fa>\u003Cem>, \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Fwww.hexacon.fr\u002Fconference\u002Fspeakers\u002F?ref=ghost.jdneer.com#one_parser_two_bugs\">\u003Cem>Hexacon talk page\u003C\u002Fem>\u003C\u002Fa>\u003Cem>.\u003C\u002Fem>\u003C\u002Fp>","Researcher Quentin Kaiser has shown that a WPS bug in Broadcom's Wi-Fi code, present since at least 2010, gives attackers in radio range root on ISP...",{"src":60,"width":73,"height":74,"type":75},1600,900,"image\u002Fpng","2026-10-18T18:34:46.000+08:00",{"name":78,"url":79,"owner":13},"Aiko Tanaka",null,[81,91,102,113],{"slug":82,"title":83,"excerpt":84,"image":85,"publishedAt":86,"topics":87,"readMinutes":90},"http2shell-cve-2026-111497-brotli-decoder","HTTP2Shell (CVE-2026-111497): What the Brotli Decoder Bug Really Hits, and How to Patch","CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, 1.0.3 through 1.2.0. Fixed in 1.0.10, 1.1.1 and 1.2.1, plus Node.js, Bun, Python, Envoy and .NET updates. You are exposed if you decode untrusted Brotli data. Not in CISA KEV.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fhttp2shell_cve_2026_111497_v2.png","2026-10-26T20:51:27.000+08:00",[88,89],{"key":64,"label":65},{"key":67,"label":68},1,{"slug":92,"title":93,"excerpt":94,"image":95,"publishedAt":96,"topics":97,"readMinutes":90},"package-cooldowns-github-package-firewall-npm-pnpm-bun-pip-uv-poetry","Package Cooldowns Compared: GitHub Package Firewall vs. What npm, pnpm, Yarn, Bun, pip, uv and Poetry Already Do","GitHub now offers an install-time firewall for npm, free in preview and metered later. Most package managers already ship a free cooldown. Here is what each tool does, the copy-paste config, and where cooldowns stop helping.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fpkg-cooldowns-conveyor-alberto-rodriguez-unsplash.jpg","2026-10-26T14:00:00.000+08:00",[98,101],{"key":99,"label":100},"guides","Guides",{"key":67,"label":68},{"slug":103,"title":104,"excerpt":105,"image":106,"publishedAt":107,"topics":108,"readMinutes":90},"tailscale-ssh-tailworm-mesh-vpn-agent-risk","Your Mesh VPN Agent Is Root on Every Box. Tailworm Is the Reminder.","A researcher showed one hacked Tailscale node reaching root on other servers through Tailscale SSH forwarding. No patch yet. Here is why mesh VPN agents deserve the same suspicion as any privileged daemon.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Ftailworm-padlock-light-trails-flyd-unsplash.jpg","2026-10-26T12:00:00.000+08:00",[109,112],{"key":110,"label":111},"opinion","Opinion",{"key":67,"label":68},{"slug":114,"title":115,"excerpt":116,"image":117,"publishedAt":118,"topics":119,"readMinutes":90},"emudhra-ca-weak-keys-chain-of-trust","eMudhra Broke Almost Nothing, and Still Dented the Chain of Trust","Eight eMudhra intermediate CA keys turned out to be numbers under 256. Browsers blocked them within hours, almost no site broke, and eMudhra is leaving the TLS business. The service impact was tiny. The lesson for the chain of trust is not.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Femudhra-keys-iolandino-baiano-unsplash.jpg","2026-10-25T16:00:00.000+08:00",[120,121],{"key":110,"label":111},{"key":67,"label":68},{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":123},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M5 12h14M5 12l6 6m-6-6l6-6\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":125},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M6.5 7.5a1 1 0 1 0 2 0a1 1 0 1 0-2 0\"\u002F>\u003Cpath d=\"M3 6v5.172a2 2 0 0 0 .586 1.414l7.71 7.71a2.41 2.41 0 0 0 3.408 0l5.592-5.592a2.41 2.41 0 0 0 0-3.408l-7.71-7.71A2 2 0 0 0 11.172 3H6a3 3 0 0 0-3 3\"\u002F>\u003C\u002Fg>"]