← Signals

Note

This week in embedded: 8 November 2026

A heavy security week for RTOS users: 21 ThreadX and NetX Duo advisories, 13 for Zephyr, an OpenSSH bypass on musl systems and an ESP-IDF BLE Mesh flaw.

  • ThreadX and NetX Duo fixed 21 flaws in 6.5.2.202603b. Twelve are high. Non-secure code can read and write secure memory through the TrustZone-M ports, and the DTLS server can be locked out with spoofed datagrams. ThreadX advisories
  • Zephyr published 13 more advisories. The most exposed is an out-of-bounds read and write in the open-source Bluetooth LE controller on Nordic parts, present since 1.6.0. Update to 4.5.0 or 4.3.2. Advisory
  • OpenSSH 10.6p2 closes a critical password bypass. It affects Linux systems built with musl libc and without PAM, a common setup for small embedded Linux images. Update, or turn off password login. Release notes
  • ESP-IDF fixed a BLE Mesh stack overflow. Any device in range that can connect to the provisioning or proxy service can trigger it. Fixes are in v6.0.3, v5.5.6, v5.3.6 and v5.2.8; v5.4.5 is not out yet. Advisory
  • The Bluetooth SIG adopted High Data Throughput. A new LE PHY reaches 7.5 Mbps, nearly four times the 2M PHY. Bluetooth SIG
  • Nordic announced the nRF71 Series. The nRF7120 pairs Wi-Fi 6 with Bluetooth LE, Thread and an NPU, and is sampling with selected customers. Nordic
Esc