GNU InetUtils leaves estimated 800,000 telnet servers vulnerable #36

A critical vulnerability in the GNU InetUtils telnet daemon has surfaced, leaving an estimated 800,000 servers worldwide open to a trivial remote authentication bypass. The flaw, tracked as CVE-2026-24061, allows an attacker to gain full root-level access without a password by simply supplying a crafted "USER" environment variable during the login process. By passing the string "-f root", the daemon is tricked into invoking the system login process with a flag that skips all security checks.
The scale of the exposure is particularly alarming because, while Telnet is considered an obsolete and insecure protocol, it remains deeply embedded in legacy infrastructure, industrial control systems, and Internet of Things devices. Data from the Shadowserver Foundation and Censys shows that the highest concentrations of these vulnerable systems are in China and Brazil, followed by the United States and Japan. Because many of these devices are no longer supported by their manufacturers, they may never receive the necessary firmware updates.
The risk is not theoretical; cybersecurity firms like GreyNoise have already detected active exploitation attempts in the wild, with some honeypots being compromised in under an hour. Attackers are currently using the flaw to deploy Python-based malware, establish persistence via SSH keys, and conduct reconnaissance for lateral movement within networks. Organizations are urged to immediately update to GNU InetUtils version 2.8, or, if patching is not an option, to disable Telnet entirely and migrate to the encrypted SSH protocol.
Welcome to episode 36 of the Crystal Carrier Wave, on today's show I discuss a critical emergency patch from Microsoft for an Office zero-day vulnerability that is seeing active exploitation in the wild, while Google introduces a new feature to remind Gemini users to take a break from their AI assistants.
I look into the shadowy PeckBirdy framework used by China-linked hackers and a simple command error that temporarily knocked NASA’s TESS satellite offline. Apple has set a new record for longevity by updating the twelve-year-old iPhone 5S, contrasting sharply with a ruling in Austria that found Microsoft illegally tracked students through educational software.
The security world is reeling from a massive SoundCloud data breach affecting nearly thirty million users and a staggering 1.4 terabyte data theft at Nike, all while TikTok users flee to privacy-first apps as the platform faces a new US venture crisis.
I explore the Linux kernel’s new continuity plan for a post-Linus era and France’s decision to ban US videoconferencing tools in favor of national sovereignty. In hardware news, AMD is looking to bundle CPUs with RAM to fight rising prices, over six thousand SmarterMail servers face hijacking risks, and we question the nature of trust in AI-generated search results.
I also cover the persistent threat of WinRAR flaws and Google’s latest aggressive theft protections for Android. Moving into the maker space, we review the larger Prusa Core One L and a brilliant project turning a shoebox into an autonomous robot.
There is major aerospace news with a new European FPGA for space missions, and we look at the technical wizardry of running Arduino code on bare-metal hardware or converting a Commodore 64 keyboard for USB use without damaging the original casing.
I discuss why audiophiles are finding Raspberry Pi units inside multi-thousand dollar streamers and how one clever maker converted vintage telephone lines into a gigabit home network.
Finally, I wrap up with a look at growing IoT interest in professional kitchens, new development tools for Renesas microcontrollers, upcoming funding opportunities for hams through the ARDC, and a technical deep dive into the engineering history of PAL and NTSC video standards.
Become a supporter of the podcast and help me grow the podcast and studio by becoming an Insider, every little bit helps and is greatly appreciated.
If you have anything you’d like to share or comment on, email podcast .at. zl4kj .dot. nz, I would love to hear from you. Alternatively you can Send a Voice Message
Microsoft Office Zero-Day (CVE-2026-21509) - Emergency Patch Issued for Active Exploitation
Love Gemini? Google doesn't want you to get too attached
China-Linked Hackers Have Used the PeckBirdy JavaScript C2 Framework Since 2023
NASA confirms TESS temporarily felled by command error
Apple once again puts Android to shame – it just updated the 12-year-old iPhone 5S to set a new record
Ruling: Microsoft illegally placed cookies on child's tech
Have I Been Pwned: SoundCloud data breach impacts 29.8 million accounts
Nike investigating mega security breach as hackers claim to have stolen 1.4TB of data
TikTok’s new US venture is in trouble – here are the 3 privacy-first apps people are flocking to instead
Linux kernel gets continuity plan for post-Linus era
France says au revoir to US videoconferencing software
AMD could be working on a way to minimize RAM price hike pain — by bundling Ryzen CPUs and DDR5 memory
Over 6,000 SmarterMail servers exposed to automated hijacking attacks
Trust In AI Search Results
WinRAR path traversal flaw still exploited by numerous hackers
Google just made it even harder for thieves to access your Android device
3D Printer Review: Prusa Core One L — Bigger and Better
From Shoe Box to Smart Robot: A Maker’s Journey to Autonomy
NanoXplore and STMicroelectronics deliver European FPGA for space missions
An Arduino Without the Arduino?
No Commodores Were Harmed in the Making of This USB Keyboard
Audiophiles keep finding Raspberry Pi inside Hi-Fi streamers selling for thousands
Clever Brit successfully repurposes telephone wiring for gigabit internet throughout his vintage home — Lad converts "incomprehensible mess of wires" into high-speed ethernet links
Growing IoT interest for restaurant operations - MachineQ survey
Mikroe to provide development tools for Renesas MCUs
ARDC Priority Areas of Funding Offer Opportunities for Hams
How Do PAL and NTSC Really Work?