Image by İsmail Enes Ayhan, from Unsplash
Supermicro Patch Failed, Leaving Servers Open to Firmware-Level Attacks
- Written by Kiara Fabbri Former Tech News Writer
- Fact-Checked by Sarah Frazier Former Content Manager
Security researchers have identified critical vulnerabilities in Supermicro motherboards, allowing hackers to embed malware that remains active even after system restarts, as well as system cleaning.
In a rush? Here are the quick facts:
- Flaws allow hackers to install malware that persists after reboots and cleaning.
- Malware can bypass BMC security checks and replace firmware images.
- Supermicro says it released updates but patch availability remains unclear.
The baseboard management controllers (BMCs) located on server motherboards contain these security flaws since their tiny chips let admins manage machines remotely, even when powered off.
This issue, first reported by ArsTecnica , surrounds Supermicro, a U.S. company that makes servers, motherboards, and storage systems powering data centers, cloud computing, and AI. Its hardware supports large-scale computing for businesses, researchers, and tech companies worldwide.
ArsTechnica notes that the security firm Binarly discovered two new vulnerabilities in Supermicro’s January CVE-2024-10237 patch, which left an incomplete fix. The company discovered an additional security flaw which connects to the previously identified issue.
The two new defects exist as CVE-2025-7937 and CVE-2025-6198, and affect the firmware storage, which is permanently attached to the motherboard.
The researchers compared the severity of these vulnerabilities to the 2021 ILObleed attack, which enabled attackers to modify server firmware, while also making it resistant to hard-drive wipes, and operating-system reinstalls. The researchers identify this threat as having “Unprecedented persistence,” as reported by ArsTechnica.
As Alex Matrosov, founder and CEO of Binarly, put it: “Both issues provide unprecedented persistence power across significant Supermicro device fleets including [in] AI data centers,” reports ArsTechnica.
He added: “After they patched [the earlier vulnerability], we looked at the rest of the attack surface and found even worse security problems.”
The main security threat emerges from BMC signature verification mechanisms which attackers can disable to replace firmware images without detection. Binarly provides detailed information about the attack vector which shows that an attacker needs BMC administrative access to execute persistent firmware reflashing.
“If a potential attacker already has administrative access to the BMC control interface (it is possible by exploitation of other vulnerabilities, which we described in blogs 1, 2), then the exploitation is trivial—we just need to perform an update with a malicious image. In this case, an attacker benefits from exploitation of CVE-2025-7937/CVE-2025-6198 because the compromise becomes persistent,” Binarly said, as reported by ArsTechnica.
Binarly described how attackers can alter the fwmap table so signed regions are replaced. “This single element will contain all the signed regions of the image, one after the other,” the company wrote. Supermicro says it has released BMC updates to mitigate the flaws and is testing affected products. “We can’t find the patched firmware updates on their website,” Matrasov said, as reported by ArsTechnica.
“The bug is hard to fix. I assume it will take more time from them,” Matrasov concluded.
Image by Tomek Baginski, from Unsplash
UK Arrest Over Ransomware Attack That Disrupted European Airports
- Written by Kiara Fabbri Former Tech News Writer
- Fact-Checked by Sarah Frazier Former Content Manager
The UK authorities took a man into custody accused of participating in a cyberattack that caused disruptions at Heathrow Airport and three other major European airports.
In a rush? Here are the quick facts:
- A man in his forties was arrested in West Sussex over ransomware.
- The NCA called the arrest a “positive step” but said investigations continue.
- Cyberattacks on aviation rose 600% last year, according to Thales.
The National Crime Agency (NCA) confirmed that a man in his forties was arrested in West Sussex on suspicion of offences under the Computer Misuse Act. He has since been released on bail while the investigation continues.
The NCA’s deputy director Paul Foster described the arrest as “a positive step” but warned, “the investigation into this incident is in its early stages and remains ongoing”.
According to an internal Heathrow memo, engineers at Collins Aerospace tried to restart services on Monday, but eventually had to rebuild the affected systems from scratch, as noted by Cyberpress .
The company’s parent, RTX Corporation, confirmed in a notice to US regulators that ransomware was behind the disruption, though it did not specify which group was responsible, as reported by TechCrunch .
The European Union Agency for Cybersecurity (ENISA) also confirmed ransomware was used in the attack, which encrypted critical files and demanded payment in cryptocurrency, as reported by Reuters .
Such attacks are becoming more common: a report from French aerospace company Thales shows cyberattacks on aviation have risen by 600% in the past year, noted the BBC.
While Collins Aerospace has not given a timeline for recovery, it has advised airlines and ground handlers to continue using manual workarounds for at least another week.
