Post by @malwaretech@infosec.exchange

2026-05-07 18:36 UTC

I found a zero day in a security vendor's firewall software that allows you to remotely crash the entire system by sending it a single malicious packet. Since the firewall is responsible for inspecting traffic prior to the operating system handling it, no ports even need to be open for it to work.

Replies (11)

@alister@hachyderm.io 2026-05-07 18:40

@malwaretech@infosec.exchange Yep, @jerry@infosec.exchange is right again... https://www.youtube.com/shorts/IlptuY-0qpA #ThoughtLeader #Cyber

Open ##2191802
@rgsteele@toque.town 2026-05-07 18:41

@malwaretech@infosec.exchange WinNuke 2026! ☢️

Open ##2191808
@erik@mastodon.infrageeks.social 2026-05-07 18:41

@malwaretech@infosec.exchange The ping of death is back!

Open ##2191809
@bontchev@infosec.exchange 2026-05-07 18:44

@malwaretech@infosec.exchange You should have waited till Friday. That's the Vulnerability Disclosure Day, isn't it?

Open ##2191812
@jamesmarshall@sfba.social 2026-05-07 18:49

@malwaretech@infosec.exchange reminds me of the 1990s (?) dirt-simple exploit whereby you could crash a Windows machine merely by sending it any OOB packet. Yes, I tried it and it worked. I later saw code for it in an exhibit of various exploits at Madrid's Reina Sofia art museum. Cool exhibit. Edit: Found it-- it was called WinNuke. https://en.wikipedia.org/wiki/WinNuke

Open ##2191814
@Elmar_Iachi@chaos.social 2026-05-07 19:01

@malwaretech@infosec.exchange Fuzzy packet?

Open ##2191817
@Rimuru@s.cafe 2026-05-07 19:12

@malwaretech@infosec.exchange Get yourself paid for your discovery. Microsoft pays people who finds exploits. Often people report this in the wild, and lose out being paid. — edit — I am clearly not sleeping well. I thought this had to do with Windows firewall and not a 3rd party vendor. Oops! https://www.microsoft.com/en-us/msrc/bounty

Open ##2191818
@dalias@hachyderm.io 2026-05-07 20:28

@malwaretech@infosec.exchange It's 1997 all over again baby!

Open ##2191819
@mrencyclopedia@retro.pizza 2026-05-07 21:31

@malwaretech@infosec.exchange Reminds me of the good old days of Winnuke

Open ##2191821
@robloblaw@mastodon.social 2026-05-07 21:43

@malwaretech@infosec.exchange The latest darknet diaries podcast has a wild story of Chinese state sponsor APT attacks on firewall makers. https://darknetdiaries.com/episode/174/ The response from Sophos was even wilder.

Open ##2191823
@hitem@infosec.exchange 2026-05-08 07:18

@malwaretech@infosec.exchange lol.py

Open ##2207968