The Wolf Is Now Vacuuming Your Living Room, And The Shepherds Are Asleep
I have seen a great many things in my years. I have watched the Flock hand their banking credentials to Nigerian princes. I have watched the Shepherds approve "password123" as a corporate standard. But this. This is something new.
A researcher, publishing under a pseudonym because apparently that is what we do now, has demonstrated that you can pull a certificate off the flash memory of a Shark robot vacuum and use it to issue root commands to other Shark vacuums across the same Sky Pasture region. Every vacuum. Same region. One certificate.
Let that settle.
The Wolf does not need to pick your lock anymore. The Wolf needs a screwdriver and a weekend.
Once inside, the attacker can drive the robot around your home like a remote-controlled toy, watch through its camera, read the floor map of your house, and collect your Wi-Fi password. In plaintext. Not hashed, not salted. Plaintext. Like a grocery list left on the kitchen counter.
I want to be very clear about something. In the Old Days, your vacuum cleaner had one job. It had a cord. It did not have an AWS region. It did not have a certificate authority. It did not have a camera. You pushed it across the carpet and that was the end of the relationship.
Now the Flock has invited a surveillance robot with root access into their homes and connected it to the Sky Pasture, and they are surprised that someone found a hole in the fence.
Shark, for their part, has not issued a patch. The fence remains open. The Shepherds have not commented. Naturally.
The researcher tested this only against his own vacuums, which is responsible disclosure and also, frankly, the most exercise a vacuum cleaner has ever caused a human being.
Remediation
First, and I cannot believe I am typing this: unplug the robot. It does not need to be on the internet. Nothing in your carpet does.
Second, if you must keep it connected, segment it onto a guest network immediately. Do not let it share a pasture with your actual machines.
Third, change your Wi-Fi password now, on the assumption that it has already been read by someone more curious than you.
Fourth, wait for Shark to issue a shearing. Apply it the moment it arrives. Do not wait. Do not "get to it later." The hole in the fence does not wait.
Fifth, consider a broom. I am not joking. A broom never phoned home.
Stay paranoid, and keep your appliances offline.
Original Report: https://thehackernews.com/2026/07/unpatched-shark-vacuum-flaw-could-let.html