Five Hundred Four Bytes Before Your OS Wakes Up

Today is Thursday, October twenty-ninth, twenty twenty-six, and welcome to The Daily Reboot.

Here's what happened in tech on Wednesday.

A sixteen-year-old bug in EDK II firmware that runs before your operating system does. A new Google model that most of you can't call yet. And a folder of agent skills you can install.

Let's get into it.

Five hundred four bytes. That's the size of one field in a firmware driver, and it's the whole story.

The bug is CVE twenty twenty-six, ninety-seven six thirty-one, in EDK II, open-source UEFI code used in some server firmware. NIST describes out-of-bounds writes and a wrong buffer-size calculation, and says exploitation can lead to arbitrary code execution. WIRED traces it to the PXE Base Code driver, and to a buffer overflow that's sixteen years old.

Here's the mechanism. During network boot, that driver listens for ICMP errors and copies each message into the five hundred four byte field. The IP version four and IP version six copy loops both mishandle bounds and pointer advancement. Send an oversized message, and attacker-controlled data lands past the end.

It matters because this happens in firmware, before the operating system and before protections like Secure Boot take over. WIRED reports it runs at ring zero. The payload isn't persistent on its own, but it's a fine place to install something that is.

Now the catches. The attack has to arrive during PXE boot. The exploit has to be tailored to the target's firmware build.

Eclypsium's Jesse Michael told WIRED an attacker needs to guess specific addresses, so one exploit won't work across diverse devices. And WIRED reports no evidence this gives anyone an initial way into a network.

Then there's the argument over size. WIRED reports a severity of nine point five out of ten, but NIST says its own CVSS assessment hasn't been provided yet. WIRED's headline says most servers are vulnerable, while Intel said no currently supported commercial products are known to be affected by its reference code. NIST lists EDK2 versions through the stable tag twenty twenty-six oh eight, and patches depend on your firmware vendor.

My favorite detail. The discovery team planned coordinated disclosure for January. Then a motherboard maker published a pull request describing the flaw and the fix, months early. Coordinated disclosure, meet public git history.

Verdict: if you PXE boot servers, inventory your firmware builds and watch for vendor updates. If you don't, this is a read, not a fire drill.

Bugs like that one are the territory Google says its newest model was built for.

Gemini four Carbon landed on October twenty-eighth, two weeks after Gemini four Argon. Google calls it a model for cybersecurity and long-horizon work, meaning multi-step engineering tasks that keep going through dead ends.

Who can use it? Almost nobody yet. Access starts with a subset of cyber defenders, then trusted partners through Fairwind, and developer access has no date. There's no public API, and Google hasn't published a model ID or a context window.

Pricing is listed, though. Introductory rates are two dollars per million input tokens and ten dollars per million output, with cached input ninety-five percent off. Afterward it's four dollars and twenty dollars, and Google doesn't say when that kicks in.

Now the numbers, and note who ran them. Google reports eighty-eight point two percent on SEC-bench Pro, fifty-four point eight on ExploitGym, and seventy-one point zero on CWE-bench, all without guardrails. CellCog's summary of Google's table says Carbon leads Claude Opus five point five and GPT six Astra on fifteen of seventeen rows. Independent evaluations weren't available.

Google says internal tests show more than double Argon's success at writing secure code, and about half as many unsupported claims. On one prompt injection benchmark, the attack success rate was zero percent, against zero point seven for Argon. That's a benchmark, not a guarantee.

Verdict. Most of you can't try it, so don't switch on Google's own tables. CellCog puts the Artificial Analysis index at fifty-nine against Opus's fifty-eight, which is a thin reason to move anything. When access opens, test it against your current model on long-running coding and defensive security work.

The README says these are the agent skills T three uses every day, cleaned up so anyone can use them. That's tstack, and it works with Claude Code and Codex. It's reusable instructions, not a model.

Skills cover multi-model review, preparing a pull request, monitoring CI and review bots, rebasing old pull requests, and taking over someone else's pull request while keeping their credit. Full-send chains sol-loop, file-pr and babysit-pr. The README describes it as taking a change from a merged PR nobody is watching through proof, review, filing, CI monitoring and merging.

Install is a clone, then you copy the skills folder into the Claude Code or Codex skills directory. Some skills call other skills, so copy the dependencies too.

The limits. You need an authenticated GitHub CLI, babysit-pr needs Python three, and council and sol-loop need subagents on other providers' models. How the autonomous ones handle bad review feedback or changes that shouldn't merge is unclear. The README calls these starting points, so edit them.

To try it, git clone the tstack repo from the T three account and copy the skills in.

Also in the bin: Android Ad Cleaner, version zero point two point six, out October twenty-eighth. It switches off system ads, trending searches and marketing notifications on supported phones, no root, using ADB and device-specific scripts. It doesn't uninstall or disable system apps.

This release fixed issues reported in a hundred twenty-two error logs and added nine community device scripts. Settings vary by maker and model, so back up first. Run its devices command to see whether your phone has a script.

More than fifty apps are available across Gemini and Search, including Adobe, Experian, Localiza and Peloton. Google says so, and now it's opening a preview route for developers.

It launched a preview of the Connected Apps Platform. You build the integration one of two ways: a cloud-hosted MCP server, or Android MCP using AppFunctions APIs. Then you register, test and submit it through Google Connected Console.

The difference matters. Google's docs describe MCP as the standard path for exposing tools and authorized data. AppFunctions is client-side and can invoke your app's functions locally on the device. Either way, a user links your app once, then reaches their account data and actions through Google products.

You pick where it shows up: Search, Gemini, or both. The console reports traffic, latency and error rate. Google's pitch is build once, reach high-intent users in both places. That's a company claim, and the sources show no traffic or conversion numbers.

There's a gate, though. TechCrunch reports the preview is for US developers, by waitlist, with no date for wider access. You also go through Google's review and publishing process.

App makers may worry about depending on Google's gatekeeping. Privacy advocates will ask what account data gets shared and what an assistant can do with it. The consent, ranking and commercial rules for appearing in answers aren't clear yet.

Google also says Calm is coming to both Search and Gemini. Fitting. You'll want some while you wait on that waitlist.

To try it, apply for the preview and follow the developer docs.

Once assistants do the work, somebody gets the bill. By August, Anthropic says, interactive agent hours inside the company outnumbered employee hours six to one.

That's from Anthropic's own workplace research, which says human attention had become the bottleneck. Even non-technical employees, it says, would need half their work week to read everything their Claude agents produce.

Against that backdrop, TechCrunch reports Anthropic announced enterprise reporting tools. Using internal analytics and employee surveys, managers pick a date range and see team activity, reported work, cost and workflow breakdowns, plus recommendations. Anthropic is also creating pooled group budgets for token spending.

TechCrunch says the reporting data won't be used for model training by default. That's TechCrunch's report, and we haven't seen Anthropic's own policy text.

Why now? TechCrunch cites a Jellyfish report covering two hundred seventy-six thousand customers. Spending on agentic coding tools has grown tenfold since the start of the year, to about two percent of total engineering cost. Jellyfish's chief scientist Nicholas Arcolano said you now have to optimize it, make it work. Treat those figures as one report's estimate, not a universal rate.

Finance teams may question how productivity gets measured. Employee representatives and privacy advocates may question the analytics, surveys and monitoring.

Which brings the one question I can't answer. How does Anthropic define what a team produced, and can you set that against the cost of reviewing and fixing the output?

Vercel says its own CI had to keep up with its coding agents, so Vercel CI is now in beta. Vercel CI. Tag a Turborepo task with ci in your config and it runs on every push, limited to work affected by the change. Vercel reports two to six times faster from push to CI passed on its own repositories, so benchmark your own. Setup is an npx skill that opens a pull request.

AWS Lambda SOCI. Container images on Lambda Managed Instances can now lazy load, and AWS says SOCI can reduce startup times by up to seventy percent. That's a ceiling, not a promise. An index lets Lambda fetch files as needed instead of pulling the whole image first. Build the index, push to ECR, point the image URI at the indexed tag.

Node twenty six point thirteen point zero, Lithium. It's now LTS, supported through the end of April twenty twenty-nine, and it contains no changes from twenty six point twelve point one beyond metadata. The headline feature is a label. One catch: official Linux binaries have been linked against libatomic since Node twenty-five, so some distros may need it installed separately. Check your images first.

Android Registered App Stores. From December first, approved stores on Android seventeen QPR two or later, in select regions determined by the user's home location, can skip extra confirmation screens. It's not silent, because users still consent to each install. The Hacker News reports a ten thousand dollar annual fee. Ten thousand dollars to remove a screen, then ask permission anyway. Relevant only if you run a store.

Fast Boot, two security stories, and one very tidy attacker.

DHS data dump. WIRED reports a leak covering more than forty-one thousand Homeland Security workers. The hackers claimed it came from Okta; Okta told WIRED it had no evidence its systems or data were compromised. Two permission groups, Executive Leadership and AI Access, appear to list the same thirteen people as exceptions to DHS's web filter, which is efficient, as org charts go.

Silent Train. Lumen tracked Volt Typhoon's covert relay network for three years and found at least four confirmed zero-day campaigns. Sessions averaged about four hours, with cleanup after each one, so it was the rare tenant who got the deposit back.

Silent Train wiped its tracks every session, while the DHS dataset included permission-group records. One of them had better housekeeping.

Today we covered a sixteen-year-old firmware overflow in EDK II, Google's restricted Gemini four Carbon, T three's tstack agent skills, Google's Connected Apps preview, and Anthropic's new spending reports.

Try this today: clone tstack, then read a few skills before you let any of them run.

Sources are in the show notes. Follow The Daily Reboot wherever you get your podcasts. I'm your host, back tomorrow. Stay patched.