Thermo Fisher Patches Flaw That Could Make DNA File Tampering Nearly Undetectable
Summary: Thermo Fisher Scientific patched a flaw, tracked as CVE-2026-17583 and rated High with a CVSS v4.0 score of 8.2, that could let .fsa and .hid data files be altered before analysis software loads them, with changes the vendor's July 31 bulletin describes as nearly undetectable if laboratory controls are circumvented. Five supported Applied Biosystems human identification product lines received updates adding digital signatures, while three end-of-life data collection products will get no vendor update.
Key Takeaway: A researcher told The Wall Street Journal his first successful file modification using Anthropic's Claude took about 45 minutes, and a demonstration merged scans from two individual DNA profiles into a file that appeared untouched since 2015 and raised no warning in analysis software used by many laboratories. The researchers said the flaw likely existed in digital files from crime-lab machines since 1995 and that they had not found a way to detect prior tampering, while three end-of-life product lines remain unpatched.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-17583
- Related
- ⚡ Weekly Recap: Rogue AI Models, $88M Bitcoin Theft, Water-System Attacks and Dangling DNS Hijacks Cyber Risks ·⚡ Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router Backdoors Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026