Loading story…
Security experts and hardware hackers are emphasizing the need for closer engagement between device vendors and the security research community to improve hardware security. At the Hardware.io conference in Amsterdam, leaders such as Alex Guzman, CISO for Cisco Network Devices, highlighted that hardware vulnerabilities are often the result of business decisions and trade-offs, such as prioritizing speed to market over security. The importance of bug bounty programs and providing researchers with access to devices was underscored as a way to uncover and address vulnerabilities before they can be exploited in the wild.
The discussion also addressed the challenges of supply chain security, side channel attacks, and the need for organizations to act on vendor-provided mitigation advice. Security teams are encouraged to communicate risks in business terms to drive better decision-making, and the OWASP Internet of Things Project was cited as an initiative to foster improved understanding of IoT security. Ultimately, the consensus is that proactive collaboration between vendors and the security community is essential for addressing the evolving landscape of hardware threats.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Recent research from Bugcrowd has revealed a dramatic increase in hardware, API, and network vulnerabilities, prompting cybersecurity professionals to reevaluate their defense strategies. The proliferation of Internet of Things (IoT) devices has contributed to an 88% rise in hardware vulnerabilities, as more organizations deploy connected sensors, appliances, and medical equipment. Security researchers have reported that 81% discovered new hardware flaws over the past year, highlighting the scale of the problem. Network vulnerabilities have doubled, and API bugs have increased by 10%, further expanding the attack surface for enterprises. Critical vulnerabilities, particularly those involving broken access control and sensitive data exposure, have seen significant growth, with payouts for these flaws rising by 32%. Broken access control alone has increased by 36%, while sensitive data exposure vulnerabilities have grown by 42%, underscoring persistent foundational security issues. The rapid adoption of AI-assisted software development is accelerating release cycles but also introducing new security gaps, especially in access control and data protection. As applications become more complex and agentic AI systems gain autonomy, managing access control becomes increasingly challenging. IoT security remains a major concern, as many devices are not designed to receive timely vulnerability patches or updates, leaving them exposed to attacks such as distributed denial-of-service (DDoS) and data theft. Attackers are exploiting the remote control capabilities of IoT devices, targeting everything from smart office lighting to advanced medical equipment and agricultural machinery. Efforts to improve IoT security include legislative initiatives and voluntary programs like the US Cyber Trust Mark, which aims to encourage device-makers to adopt better security practices. However, progress on these initiatives has been slow, and it remains uncertain when or if they will have a significant impact. The expanding use of nonhuman identities, such as API keys and machine accounts, further complicates the security landscape, as these digital identities often have broad access and are difficult to monitor. Security leaders are increasingly aware that agentic AI and the growing complexity of interconnected systems are likely to accelerate existing vulnerability trends. As a result, organizations are being urged to rethink their security strategies, focusing on foundational issues like access control, data protection, and the secure management of digital identities. The convergence of these trends signals a need for more robust, adaptive, and proactive security measures to address the evolving threat landscape.
Jun 29, 2026
Recent discussions in the cybersecurity community have highlighted the evolving landscape of vulnerability disclosure, particularly focusing on the legal and contractual restrictions imposed by managed bug bounty programs. Experts warn that confidentiality agreements required by some platforms can prevent researchers from publicly sharing their findings, undermining the original intent of coordinated vulnerability disclosure (CVD) and potentially allowing software vulnerabilities to remain unaddressed. This shift has sparked debate about the balance between responsible disclosure, researcher rights, and vendor interests, as well as the broader impact on software security. At the same time, bug bounty programs are increasingly recognized as a strategic solution for organizations seeking to enhance their security posture. These programs offer economic efficiency by leveraging external expertise and paying only for validated vulnerabilities, allowing organizations to redirect resources toward remediation and proactive security initiatives. However, the rise of such programs also brings new challenges, including the need to ensure that legal frameworks do not stifle the open exchange of critical security information or hinder the overall effectiveness of vulnerability management efforts.
Jun 29, 2026
A recent ISC2 survey of over 1,000 cybersecurity professionals highlights growing concern about the risks introduced by expanding vendor ecosystems and supply chain sprawl. Nearly 70% of organizations are worried about third-party supplier risks, with the highest concern in enterprises and sectors handling sensitive data such as finance and government. Lack of visibility into vendor and subcontractor security practices remains a critical challenge, with many organizations relying on trust rather than verification. One in three respondents reported experiencing a vendor-related security incident in the past two years, yet almost half did not feel a direct impact, raising questions about continuity and the reliability of vendor security claims. Compounding these risks, a Sonatype analysis reveals that the vulnerability scoring infrastructure, particularly the NVD and CVE programs, is failing to keep pace with modern software development practices. In 2025, 64% of open source CVEs lacked a CVSS score in the NVD, forcing security teams to make risk decisions with incomplete data. Discrepancies in severity ratings and significant delays—averaging six weeks between disclosure and scoring—undermine the effectiveness of automated security tools and response cycles. These gaps in both supply chain visibility and vulnerability intelligence are eroding confidence in the data that underpins security programs, increasing the likelihood of both missed threats and wasted resources.
Jun 29, 2026