A reverse-engineering investigation of a Brother MFC-L8900CDW printer finds that its firmware runs a 32-bit, little-endian ARM system using the TRON-family T-Kernel real-time operating system, not a conventional Linux distribution. The firmware also identifies Datalight Reliance Nitro storage, FlashFX Tera flash management, Lua 5.2.3, and libraries including OpenSSL and gSOAP. Its structure includes a separate kernel, compressed application code, and embedded web and interface assets; messages indicate that the main processor coordinates with a separate print-engine controller. The investigation obtained the firmware through Brother’s update service and analyzed its extracted components, while distinguishing embedded version strings from proof that particular vulnerabilities exist.
The practical finding is that a Brother network command console can expose additional debugging functions without changing firmware. With Telnet enabled, an administrator can log in using the printer’s admin password, leave the username blank, and enter “SET USER 640184.571119” at the Local> prompt to reach debug user mode. The resulting help lists functions for displaying and changing parameters, examining memory, redirecting output, and viewing debug information. Two other access modes are identified: Wireless QA and Wireless Development, entered with separate “SET USER” codes. The firmware also contains a T-Monitor prompt, but its initial command table appears limited to Help, and the analysis does not establish that this monitor is reachable over Telnet. Debug commands were not extensively tested, and incorrect parameter changes can seriously disrupt the printer.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Hackers breached DHS’s single sign-on system and exposed personal information for more than 40,000 employees, including personnel connected to undercover operations. DHS says it is responding to the breach, while activists say the searchable database can help people investigate the department and file records requests. (text.npr.org)
Attackers chained PHP2Shell with a kernel privilege-escalation flaw to root 25 firewall servers across four countries, including systems in a US government-affiliated environment. They extracted credentials and enumerated Active Directory, while evidence suggested AI-assisted tooling but did not show that AI wrote the exploits. (dreamgroup.com)
A malformed WAP Push SMS can remotely and silently crash Android’s phone process, dropping active calls - including emergency calls - and interrupting cellular service. The vulnerability stems from an unchecked integer conversion; the site says Google classified it as non-security and will not fix it. (smsofdeath.com)
Security researcher Orange Tsai chained five logic bugs and two Windows features to escape Microsoft Edge’s sandbox without memory corruption, winning $175,000 at Pwn2Own Berlin 2026. The handcrafted exploit earned a Pwnie Award for Epic Achievement. (blog.orange.tw)
Attackers attempted to exploit critical GitLab vulnerability CVE-2026-97229 on Alpine Linux’s instance, crashing worker processes, but Alpine found no evidence of successful access or tampering. Alpine rebuilt the instance, reset passwords, and warns that self-managed GitLab deployments also need patched Ruby - not just a GitLab upgrade. (alpinelinux.org)
An iPhone backup audit reportedly uncovered more than 145,000 deleted photos and videos in a thumbnail cache, including sensitive images. The claim that apps with file access could read them has not been independently verified. (twitter.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.