Unitree Robot Flaws Could Enable Bluetooth-Range Worm; Two TeamPCP Members Charged

Summary

The video describes two Unitree robot flaws combined into Unibleed, enabling remote code execution and worm-like spread within Bluetooth range. Unitree patched a cloud ownership issue; the Bluetooth-chain fix remained unconfirmed. Two TeamPCP members were charged.

Key points

Oliver Laflamme’s write-up describes CVE-2026-76639 and CVE-2026-76640, which were combined into Unibleed.
One flaw reportedly allows arbitrary file writes through the robot’s AI chatbot and unlocks an unauthenticated connection bridge; the other allows BLE writes without pairing and access to an AES key.
The video says the combined flaws enable worm-like spread to robots within Bluetooth range. Unitree patched the cloud ownership issue, but the Bluetooth-chain firmware fix was not confirmed at disclosure.
Two people described as TeamPCP members were arrested and charged with 14 offenses after investigators linked a distinctive image across a Steam account and a TeamPCP Telegram account.
The video says TeamPCP was behind React2Shell and other compromises, but its involvement in the original Shai Hulud worms was not confirmed.
It also reports DNS-over-HTTPS and DNS-over-TLS problems for Russian internet users, which the presenter says point to possible government efforts to identify users.

Article Details

Topics: [00:30] Unibleed: two Unitree robot vulnerabilities and Bluetooth-range worm potential
[02:06] TeamPCP investigation, arrests, and charges
[03:21] DNS-over-HTTPS and DNS-over-TLS problems reported by Russian internet users
[03:34] New Zealand social-media age restrictions and the Meta settlement concerning youth use