Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Apple A12/S4/S5/A13 BootROM usbliter8 authentication bypass flaw

Vulnerability
First reported
Last updated
Happening score
H score 27
1 unique sources, 1 articles

Summary

Hide ▲

Researchers disclosed usbliter8, an unpatchable BootROM flaw affecting Apple A12, S4/S5, and A13 SoCs, creating boot-chain compromise risk for devices with physical access. The issue sits in immutable BootROM/SecureROM code, so an operating system update cannot fully remove it. The proof-of-concept relies on DFU mode and specialized RP2350-based microcontroller hardware, which limits broad abuse but raises risk for seized, stolen, or unattended devices.

Related Happenings

UEFI shim Secure Boot bypass (multiple vulnerabilities)

Vulnerability
H score1 First: 14.07.2026 15:46 Last: 14.07.2026 15:46 Sources 1

About this happening: Researchers identified 11 old, Microsoft-signed UEFI shim bootloaders that can bypass Secure Boot on systems trusting the Microsoft Corporation UEFI CA 2011 certificat...

Latest development: 15.07.2026 17:00

Microsoft revoked the vulnerable Microsoft-signed UEFI shim bootloaders in the dbx update shipped with the June 9 Patch Tuesday, closing the Secure Boot bypass tracked as CVE-2026-8863 and CVE-2026-10797. Windows machines should update automatically, while Linux users can pull the revocation through the Linux Vendor Firmware Service.

Open Happening

U-Boot FIT signature-check and image-parsing flaws memory corruption flaw

Vulnerability
H score1 First: 10.07.2026 18:57 Last: 10.07.2026 18:57 Sources 1

About this happening: U-Boot has six newly disclosed flaws in its FIT signature-checking and image-parsing path, putting routers, smart cameras, and data-center server management chips...

Open Happening

Apple A12/A13 SecureROM USB DMA underflow with public usbliter8 exploit security flaw

Vulnerability
H score0 First: 19.06.2026 21:37 Last: 19.06.2026 21:37 Sources 1

About this happening: A public usbliter8 exploit now reaches arbitrary code execution in Apple's SecureROM, exposing an unpatchable USB DMA underflow flaw across A12, A13, S4, and S5*...

Open Happening

Beats Studio Buds Bluetooth BR/EDR missing-authentication security flaw (multiple vulnerabilities)

Vulnerability
H score24 First: 18.06.2026 15:23 Last: 18.06.2026 15:23 Sources 1

About this happening: Beats Studio Buds are affected by CVE-2025-20701, a missing-authentication flaw in Airoha system-on-a-chip (SoCs) and the Bluetooth BR/EDR radio that can let a...

Open Happening

Timeline

  1. 22.06.2026 17:00 2 articles · 23d ago

    Researchers disclose usbliter8 BootROM flaw affecting Apple A12, S4/S5 and A13

    Initial Disclosure

    Paradigm Shift disclosed usbliter8, a novel BootROM vulnerability affecting Apple A12, S4/S5 and Apple A13 SoCs that can let a physically present attacker compromise the boot chain through DFU mode and RP2350-based microcontroller hardware. The flaw combines a Synopsys DesignWare USB controller DMA weakness with a SecureROM configuration issue, and because BootROM code is immutable after manufacture, an operating system update cannot fully correct it; the affected devices are described as carrying the issue for their lifetime.

    Show sources
    Open in new tab