> TritonInfoSec News
Home / Aug 30, 2026 / Story
0
#10 The Hacker News general August 28, 2026 at 12:07 UTC

Two Unitree G1 EDU Humanoid Robot Flaws Enable Root RCE, One Starts Over Bluetooth

By [email protected] (The Hacker News)

AI Summary

Researcher Olivier Laflamme disclosed two root RCE chains in the Unitree G1 EDU humanoid robot, tracked as CVE-2026-76639 and CVE-2026-76640, with one exploit path reachable via Bluetooth Low Energy targeting the robot's Locomotion PC through chat_go and bashrunner components. Physical-adjacent attackers could gain full root control of the robot without network access, posing serious safety implications for research and industrial environments deploying humanoid robotics. These findings underscore the expanding attack surface of AI-integrated physical systems.

Read full article → https://thehackernews.com/2026/08/two-unitree-g1-e…

Relevance score: 62.0/100

# More from August 30

  1. 1
    PaperCut Zero-Day Exploited in Attacks, Affecting All NG and MF Versions The Hacker News
  2. 2
    Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication The Hacker News
  3. 3
    OpenAI Agents Exploited Linux Kernel Flaw on Company’s Own Systems SecurityWeek
  4. 4
    Shai-Hulud hackers: two men charged over TeamPCP’s global supply chain crime spree that hit OpenAI, and thousands more Graham Cluley
  5. 5
    ATF Confirms Cyber Incident After Ransomware Group Claims Attack SecurityWeek
  6. 6
    Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server The Hacker News
  7. 7
    ServiceNow warns of three max severity security vulnerabilities BleepingComputer
  8. 8
    Over 8,300 Gitea servers vulnerable to code execution attacks BleepingComputer
  9. 9
    Cosmos EVM Flaw Exploited After Cosmos Labs Knew Every Blockchain Running It Was Vulnerable The Hacker News