First verified SHA-256 second-preimage collision: Structural analysis of the W-schedule vulnerability
Source Reddit NetSec
Rated by Threat Radar
Data as of 27 Dec 2025, 02:09 UTC
What to do
AI-suggested
1. Immediate cryptographic agility: Begin transitioning critical systems from SHA-256 to more secure hash functions such as SHA-3 or SHA-2 variants with larger output sizes (e.g., SHA-512) where feasible. 2. Audit and inventory: Conduct a thorough audit of all systems, applications, and protocols that utilize SHA-256, prioritizing those involved in blockchain, digital signatures, and certificate validation. 3. Implement multi-hash verification: Where possible, use multiple hash algorithms in parallel to reduce reliance on a single vulnerable hash function. 4. Monitor cryptographic research and advisories: Stay updated with developments from standards bodies (e.g., NIST, ENISA) and apply recommended patches or configuration changes promptly. 5. Increase anomaly detection: Enhance monitoring for unusual blockchain transactions or signature anomalies that could indicate exploitation attempts. 6. Engage with vendors and service providers: Ensure third-party providers are aware of the vulnerability and have plans to mitigate risks associated with SHA-256. 7. Prepare incident response plans: Develop and test response strategies for potential cryptographic compromise scenarios. 8. Avoid reliance on legacy systems that cannot be updated or patched to support stronger hashes. 9. Educate security teams about the implications of second-preimage attacks and the importance of cryptographic agility.
Description
A verified second-preimage collision has been demonstrated against the SHA-256 hashing algorithm by exploiting a structural vulnerability in the message schedule (W-schedule) of its compression function. This attack specifically targets the Bitcoin Genesis Block header, producing an alternative input that yields the same 256-bit hash output. Unlike previous theoretical attacks, this is a practical, bit-perfect collision verified by standard SHA-256 implementations. The discovery fundamentally undermines the collision resistance property of SHA-256 under certain internal state conditions, raising concerns about the integrity of systems relying on SHA-256 for cryptographic security. No known exploits are currently observed in the wild, and no patches or mitigations have been published yet. European organizations using SHA-256 in critical infrastructure, blockchain technologies, or digital signatures may face increased risk. Immediate mitigation involves transitioning to more secure hash functions and monitoring cryptographic dependencies. The threat is assessed as high severity due to the potential impact on confidentiality, integrity, and trustworthiness of digital assets without requiring user interaction or authentication.