Risky Business · Tuesday, September 29, 2026
HD Moore expressed frustration with the slow response to critical vulnerabilities, citing an example where a zero-day bypass leading to root escalation on Open BMC took over 60 days to be patched by vendors, with no immediate customer or vendor reaction. He stated that many vendors don't care until a patch is available.
“They did not patch it. We disclosed it a couple days ago. No one even noticed. We've been reporting vulnerabilities in Run Zero for this thing for almost since 60 days ago.”
“Like we've been telling customers about it, hey, this is something you need to turn off really quickly, there's an exploit coming out for it ASAP. No one cares.”
“And more surprisingly, the vendors who are downstream from BMC, the commercial vendors that rely on Open BMC for their own stacks, they don't care until it's patched.”