24,650 internet-exposed BMCs leak password hashes before login via a 22-year-old IPMI flaw.

Research published August 5 found baseboard management controllers leaking auth hashes prior to login through CVE-2013-4786, rooted in the IPMI 2.0 spec itself. For at least a third of exposed servers, researchers recovered valid passwords using dictionaries and the default-credential patterns printed on factory chassis stickers, Supermicro units with 10-character uppercase passwords and username ADMIN being most common. BMC firmware lives independently of the host OS, so a backdoor written to BMC flash survives a full reinstall. Nothing to do with AI. Still probably the worst thing in today's set.