Binarly to Unveil “Broken Trust” Research: Firmware Bypass Chains, BMC Persistence, and EDR Evasion

This section is Partnership Content suppliedThe content in this section is supplied by Business Wire for the purposes of distributing press releases on behalf of its clients. Postmedia has not reviewed the content. by Business Wire Binarly Unveils Broken Trust Research: Firmware Bypass, BMC Persistence Business WireArticle contentSANTA MONICA, Calif. — Binarly, the industry leader in software and firmware supply-chain security, today announced an upcoming DistrictCon presentation “Broken Trust: Firmware Bypass Chains, BMC Persistence, and EDR Evasion.” The session will detail how firmware-level attack chains observed in shipped enterprise devices can effectively undermine modern endpoint defenses, enabling stealthy compromise and long-lived persistence.Sign In or Create an AccountEmail AddressContinueor View more offersArticle contentArticle contentAt DistrictCon, Binarly will reveal firmware bypass chains that can blind EDR and disclose two new Supermicro BMC vulnerabilities (CVE-2025-12006, CVE-2025-12007) with implications for enterprise and AI infrastructure security.Article contentWe apologize, but this video has failed to load.Try refreshing your browser, ortap here to see other videos from our team.Article contentIn this presentation, the Binarly REsearch team will dismantle the assumption of hardware trust by presenting multiple real-world firmware bypass chains. Alex Matrosov and Fabio Pagani will provide a deep dive into the specific vulnerability classes and exploitation primitives that make these attacks reliable in practice.

The team will also deliver a live demonstration compromising a fully patched system, illustrating how Endpoint Detection and Response (EDR) solutions can be blinded long before kernel drivers are even initialized.Article contentTop StoriesGet the latest headlines, breaking news and columns.There was an error, please provide a valid email address.Sign UpBy signing up you consent to receive the above newsletter from Postmedia Network Inc.Thanks for signing up!A welcome email is on its way. If you don't see it, please check your junk folder.The next issue of Top Stories will soon be in your inbox.We encountered an issue signing you up. Please try againInterested in more newsletters? Browse here.Article contentThe DistrictCon research will detail CVE-2025-12006 and CVE-2025-12007, two new high-impact Supermicro BMC vulnerabilities that enable attackers to install malicious firmware images and maintain persistent, difficult-to-remove implants inside server infrastructure. Binarly will outline the underlying technical root causes and discuss mitigation implications for platform vendors, enterprise defenders, and incident response teams.Article contentCrucially, the research highlights the growing security debt in the rapidly expanding AI infrastructure sector. As organizations race to deploy high-density compute clusters to power generative AI, the reliance on bare-metal performance often outpaces hardware security verification. Binarly’s findings demonstrate how firmware-level persistence can survive standard server re-provisioning, potentially allowing attackers to breach tenant boundaries to access proprietary data and models.Article content“Firmware is the layer where trust is assumed, not continuously verified, and attackers take full advantage of that,” said Alex Matrosov, CEO and Head of Research at Binarly. “In Broken Trust, we’ll show how bypass chains we found in shipped firmware, including CVE-2025-12006 and CVE-2025-12007, make the case for supply-chain scale monitoring. Because in the real world, a small mistake in validation logic doesn’t stay small, it turns into persistence, and enterprise-wide risk.”Article contentBinarly’s ongoing mission is to provide actionable intelligence and scalable transparency into software and firmware supply chains by helping organizations detect weaknesses early and reduce systemic risk across global device and software vendor ecosystems.Article contentAbout BinarlyArticle contentBinarly is a U.S.-based firmware and software supply chain security company founded in 2021. The flagship Binarly Transparency Platform helps device manufacturers, OEMs and enterprise product security teams to detect vulnerabilities, misconfigurations, secrets, and malicious code in devices and software supply chains. Leveraging decades of research and program analysis expertise, we secure businesses, critical infrastructure, and consumers, while also assisting organizations in transitioning to a post-quantum cryptography (PQC) environment. Visit https://binarly.io for more information.Article contentArticle contentArticle contentArticle contentView source version on businesswire.com: Article content https://www.businesswire.com/news/home/20260115834965/en/Article contentArticle contentContactsArticle contentMedia Contact: Article contentArticle contentigor@binarly.ioArticle content#distroArticle contentTrending Trudeau's former defence minister launches tech startup that could bolster Arctic sovereignty Innovation Cyberattack affected 750,000 Canadian investors, CIRO says Cybersecurity China, Canada reach energy pact that could boost Chinese investment Energy 5 ways to unlock RRSP tax savings Personal Finance Canadian real estate poised for a spring rebound, Royal LePage says Real Estate Share this article in your social networkCommentsYou must be logged in to join the discussion or read more comments.Create an AccountSign in Join the Conversation Postmedia is committed to maintaining a lively but civil forum for discussion. Please keep comments relevant and respectful. Comments may take up to an hour to appear on the site. You will receive an email if there is a reply to your comment, an update to a thread you follow or if a user you follow comments. Visit our Community Guidelines for more information. Trudeau's former defence minister launches tech startup that could bolster Arctic sovereignty Innovation Cyberattack affected 750,000 Canadian investors, CIRO says Cybersecurity China, Canada reach energy pact that could boost Chinese investment Energy 5 ways to unlock RRSP tax savings Personal Finance Canadian real estate poised for a spring rebound, Royal LePage says Real Estate