Critical TPM Flaw in HP ThinPro Exposes Disk-Encryption Keys Security researcher Darren McDonald has uncovered a critical design flaw in HP ThinPro versions 8 and 9 that allows attackers with physical access to extract TPM-sealed LUKS disk-encryption keys. The vulnerability stems from an incomplete measured-boot policy, which validates the GRUB bootloader but fails to measure the Linux kernel and initramfs, leaving the system exposed to tampering. The flaw affects HP t530 and t540 thin clients running ThinPro, which store the OS on a LUKS2-encrypted Btrfs partition protected by a TPM-sealed key. While the TPM policy checks PCRs 0, 2, and 4 covering firmware, option ROMs, and GRUB it does not account for the Secure Boot state, GRUB configuration, Linux kernel, or initramfs. This oversight enables attackers to modify unmeasured boot components, such as the unseal_key initramfs script, without triggering TPM policy violations. By altering the script, an attacker can intercept the LUKS key during boot, copy it to an unencrypted partition, and later use it to unlock the encrypted drive. The attack is low-complexity, requiring no privileges or user interaction, and leaves no immediate signs of compromise. Once extracted, the key grants access to configuration data, credential stores, and password hashes for local accounts. The vulnerability has been confirmed on: - HP t530 (ThinPro 8.1.0 build 22) - HP t540 (ThinPro 9.0.0 build 15) McDonald assigned the flaw a CVSS v3.1 score of 6.1 (Medium), noting that while physical access is required, the impact includes high confidentiality and integrity risks. HP’s Product Security Incident Response Team (PSIRT) was notified on February 22, 2026, and has acknowledged the issue, though no patch or CVE has been released as of August 8. Until a fix is deployed, organizations are advised that ThinPro’s full-disk encryption may not protect data once devices leave physical control. Secure disposal of storage media is recommended to mitigate risks.

Hewlett Packard Enterprise (HPE) disclosed eight critical vulnerabilities in its StoreOnce data backup and deduplication platform, with the most severe being CVE-2025-37093—an authentication bypass flaw (CVSS 9.8). This vulnerability allows unauthenticated attackers to bypass security controls, gain unauthorized system access, and potentially execute remote code (RCE), delete files, or exfiltrate sensitive data. Affected versions include all StoreOnce Virtual Storage Appliance (VSA) software prior to 4.3.11.The flaws expose organizations to data breaches, operational disruption, and full system compromise, particularly since backup systems are high-value targets for ransomware groups and APT actors. While no active exploitation has been reported, the low attack complexity and lack of user interaction required make this a prime candidate for mass exploitation. HPE has released patches in version 4.3.11, urging immediate upgrades to prevent data theft, lateral movement within networks, or sabotage of recovery operations.Failure to patch could lead to unauthorized access to backups, enabling attackers to encrypt, delete, or steal critical data, crippling disaster recovery capabilities and exposing the organization to regulatory penalties, financial loss, and reputational damage.

A critical vulnerability identified as CVE-2024-13804 was discovered in HPE's Insight Cluster Management Utility (CMU) v8.2, allowing unauthenticated attackers to execute commands with root privileges on affected servers. The flaw is due to a lack of proper server-side validation for client-side authorization checks in the application. This high-severity issue is particularly concerning because the CMU software is End-of-Life and will not receive any further security updates. Organizations using this vulnerable software face a significant risk and must rely on network-level isolation to mitigate potential exploits. This failure in security could result in complete system control by an attacker, leading to unprecedented access to sensitive computing environments managed by the CMU. The lapse in timely disclosure and patching of the vulnerability underscores systemic challenges in the vulnerability disclosure process.

Conduent Breach Ranks Among 2024’s Largest, Exposing 15.5 Million Individuals Conduent Business Services, a U.S.-based IT and business services provider, confirmed a 2024 data security incident that compromised the sensitive personal information of approximately 15.5 million people, making it one of the year’s most significant breaches. The company disclosed the incident without specifying the exact timeline or attack vector, though the scale underscores the growing threat of large-scale data exposures in enterprise environments. The breach adds to a rising trend of high-profile cyber incidents in 2024, including ransomware attacks, supply chain compromises, and state-backed espionage campaigns. While Conduent has not released further details on the nature of the exposed data, such incidents typically involve personally identifiable information (PII), financial records, or healthcare-related data, heightening risks of identity theft and fraud for affected individuals. The disclosure follows other major breaches this year, including Iron Mountain’s ransomware attack by the Everest group and allegations of a 90GB data theft from HP’s Poly Network. The incident also coincides with increased scrutiny of cybersecurity practices in critical sectors, from healthcare (e.g., Alpine ENT’s breach affecting 65,000) to government-linked software vulnerabilities, such as the exploitation of ArcGIS by state-backed hackers. As organizations grapple with evolving threats, the Conduent breach serves as a reminder of the persistent challenges in safeguarding large-scale data repositories against sophisticated adversaries.