Connect with us

NEWS

FreeBSD dhclient Bug Hands Root to Anyone on Your Wi-Fi

Published

on

The FreeBSD Project pushed an emergency patch on April 29, 2026 for a flaw in its default DHCP client that hands full root access to anyone sharing the same network. CVE-2026-42511 carries a CVSS 3.1 base score of 8.1 and lets a rogue DHCP server slip arbitrary commands into a lease file. Those commands run as root the next time the machine reboots. Every currently supported FreeBSD branch is on the patch list.

Joshua Rogers of the AISLE Research Team filed the disclosure, his third FreeBSD advisory of the same release cycle. There is no software workaround for hosts that must keep running dhclient(8). Administrators have to install the patch or block rogue DHCP servers at the switch.

  • 8.1 CVSS 3.1 base score, rated High by the NVD entry for CVE-2026-42511.
  • Four supported FreeBSD branches in scope: 13.5, 14.3, 14.4, and 15.0.
  • April 29, 2026 patch date across every fixed branch.
  • Zero working software workarounds for hosts that must keep running dhclient.
  • 24,529 companies tracked as FreeBSD users in enterprise telemetry data.

How a Quote Mark Becomes Root

Dhclient(8), FreeBSD’s default IPv4 DHCP client, is where the fault lives. When a host joins a network, it pulls down configuration data and writes part of that response, the BOOTP file field, into a local lease file at /var/db/dhclient.leases.<interface>.

The advisory describes the parser failure plainly. “The BOOTP file field is written to the lease file without escaping embedded double-quotes, allowing injection of arbitrary dhclient.conf directives,” reads the FreeBSD-SA-26:12.dhclient advisory issued April 30, 2026. Translation: a malicious DHCP server can stuff a closing quote into the filename, then append any directive it wants.

Once the lease file is re-read, dhclient hands those directives to dhclient-script(8). That script runs as root. Any shell command the attacker injected runs with it.

The weakness sits in CWE-149 Improper Neutralization of Quoting Syntax, the same general bug class that breaks SQL escapers and shell quoters. It is a 1990s-era oversight surfacing in 2026 plumbing.

Every Supported Branch Is on the Patch List

The advisory covers four release lines and three stable branches simultaneously. Anything older than 13.5 is already out of support and will not receive a fix.

Branch Vulnerable Up To Patched Version
FreeBSD 15.0-RELEASE 15.0-p6 15.0-RELEASE-p7
FreeBSD 14.4-RELEASE 14.4-p2 14.4-RELEASE-p3
FreeBSD 14.3-RELEASE 14.3-p11 14.3-RELEASE-p12
FreeBSD 13.5-RELEASE 13.5-p12 13.5-RELEASE-p13

STABLE branches received the same fix on the same day. Hosts running 14.4-STABLE, 14.3-STABLE, 13.5-STABLE, or 15.0-STABLE need a fresh build dated after April 29, 2026 to clear the bug.

Why a Coffee Shop Network Is Now a Root Shell

Exploitation is tame on paper and scary in practice. The attacker needs Layer 2 reach, meaning the same broadcast domain as the target. A shared office Wi-Fi qualifies. So does an apartment complex network, a hotel, a campus dorm, an airport lounge, or any switch where a hostile guest can plug in a laptop.

From there the steps are mechanical. Spin up a rogue DHCP server. Race the legitimate one to answer a victim’s DHCPDISCOVER. Craft a BOOTP file field that closes a quote and injects a directive. Wait.

The catalogue of consequences from a successful root execution reads like a standard worst-case set:

  • Persistent backdoors written into rc.d boot scripts.
  • Ransomware staged on local volumes with encryption keys keyed to the host.
  • SSH key exfiltration for lateral movement into a corporate VPN.
  • Silent installation of a kernel module that hides processes from ps.
  • Pivot tooling dropped into /tmp for spreading to other FreeBSD hosts.

From a threat-intelligence point of view, this maps onto MITRE ATT&CK technique T1557 for Adversary-in-the-Middle and T1059 for Command and Scripting Interpreter. Both are well-trodden by ransomware crews and targeted intrusion teams.

The CVSS vector tells the same story differently. AV:N marks it remotely reachable on the broadcast network. AC:H reflects the rogue-server requirement. PR:N and UI:N mean no privileges or user clicks needed. C:H/I:H/A:H is full compromise of confidentiality, integrity, and availability.

The Reboot Is the Real Detonator

A detail worth dwelling on: the malicious payload does not run when dhclient first picks up the lease. It runs when the lease file is re-parsed. That usually means the next reboot, the next ifconfig down/up, or a manual service restart.

Wire writeups treat this as a footnote. It is the entire risk profile. A laptop can be poisoned at a coffee shop on Tuesday, walk back into the corporate network clean, and detonate root execution on Friday morning when the user reboots after a patch cycle. There is no obvious connection between the network the attacker used and the system that fires the payload.

“You can look at a code base and even if you can’t trigger a bug or a vulnerability, you can still say it’s wrong.”

Rogers said that line on the Open Source Security podcast episode on AI-assisted vulnerability discovery in October 2025, talking about how he runs source-code analyzers across mature open-source projects. The dhclient parsing logic is exactly the kind of looks-wrong code path that survived for years because nobody could spell out a working exploit.

An AI-Assisted Hunt Cracked dhclient

Rogers, a 12-year veteran of Linux and FreeBSD security work, runs his current research through the AISLE AI-native cybersecurity platform. His personal disclosure log and services page shows three CVEs against FreeBSD in the past two release cycles, including CVE-2026-42511, CVE-2026-42512, and CVE-2026-39457.

“You’re not just some chuckle head that’s like shoveling something into AI and just dumping what comes out into GitHub issues,” said Josh Bressers, host of the Open Source Security podcast and a long-time application-security practitioner. The point matters because triage teams are already drowning in low-quality AI-generated bug reports. Rogers’ productivity, by contrast, is producing High-severity advisories that ship same-day patches.

Patch in Under Five Minutes

Updating is the priority. There are two supported paths, depending on how the system was installed.

  1. Base packages (FreeBSD 15.0 amd64/arm64): run pkg upgrade -r FreeBSD-base as root, then reboot.
  2. Binary distributions (everything else): run freebsd-update fetch, then freebsd-update install, then reboot.
  3. Source builds: sync to the appropriate stable-branch tag dated after April 29, 2026, rebuild world, install, reboot.
  4. Lease cleanup: remove existing /var/db/dhclient.leases.* files before the reboot, since a poisoned lease can fire even on patched binaries if the file already contains the injected directive.

That last step is the one most writeups skip. The patch fixes the parser, not the disk. A lease file already containing an injected directive will still load the next time dhclient starts. Deleting the file is cheap and forces a clean DHCP exchange against a trusted server.

Containers and jails inherit the host’s dhclient binary. They get the fix when the host is updated, but any container that runs its own dhclient under chroot needs the same purge of cached lease files.

Hosts that do not run dhclient at all, including most cloud images that take their network configuration from the hypervisor metadata service, are unaffected. A quick check is service dhclient status or pgrep dhclient. No process, no exposure.

DHCP Snooping Is the Network Backstop

For fleets that cannot reboot quickly, the network has the kill switch. DHCP snooping on managed switches treats every port as untrusted by default and only permits DHCP server traffic on the uplinks where real DHCP servers live. Juniper’s Junos OS configuration example for protecting against rogue DHCP server attacks walks through the trusted-port model used across Cisco, Juniper, Arista, and most modern enterprise gear.

The feature blocks rogue DHCP responses at Layer 2 before they reach the FreeBSD host. It also keeps DHCP starvation attacks and DHCP-based pivot tooling out of the picture as a side benefit. For environments where reboots are expensive, snooping is the practical mitigation while patches roll through change windows.

Who Actually Runs FreeBSD

The number of affected systems is harder to pin down than for Linux. W3Techs’ April 2026 FreeBSD usage data for the top 10 million sites measures it on roughly 0.05 percent of public-facing web servers, a small share that hides a concentrated population of high-value hosts.

FreeBSD’s installed base skews toward infrastructure. Netflix’s content-delivery edge runs on it. WhatsApp’s backend famously did. So do parts of Sony’s PlayStation network stack, Juniper’s Junos OS, and the pfSense and OPNsense firewall distributions. None of those public-facing edges are the immediate concern, since hardened CDN nodes do not run dhclient against a hostile network.

The exposed population is the workstation and developer-laptop segment. Researchers, sysadmins, BSD enthusiasts, and small operations teams who carry a FreeBSD machine onto a hotel network are the population the bug class was designed to hit. So are FreeBSD-based appliances that ship with dhclient on their WAN interface.

Higher education is the single largest FreeBSD vertical by company count, with research universities running it on lab and infrastructure hardware. A university’s open campus Wi-Fi is also one of the most generous broadcast domains a rogue DHCP attacker could ask for.

That combination makes the patch a real-world priority and not the theoretical one its low macroscopic share might suggest.

Frequently Asked Questions

Am I Affected if My Server Doesn’t Use DHCP?

No. CVE-2026-42511 fires only on hosts running dhclient(8) against an attacker-controlled DHCP server. Cloud instances on AWS, GCP, and most VPS providers pull network config from a hypervisor metadata channel, not dhclient, and are not exposed. Run pgrep dhclient on each host. If nothing returns, the bug cannot reach you. Patch anyway when you next update, since the fix ships in the base system.

Will the Fix Roll Out Through freebsd-update Automatically?

Only if you run freebsd-update on a schedule. The fix shipped April 29, 2026 across 13.5, 14.3, 14.4, and 15.0. Hosts on 15.0 amd64 or arm64 base packages need pkg upgrade -r FreeBSD-base; everything else uses freebsd-update fetch followed by freebsd-update install. Reboot after either. Then delete /var/db/dhclient.leases.* to clear any pre-poisoned lease.

Can a Hotel Wi-Fi Really Compromise My Laptop?

Yes, if the laptop runs FreeBSD with dhclient and the hotel network has no DHCP snooping. The attacker only needs a laptop on the same broadcast domain and a rogue DHCP daemon. The payload does not detonate immediately; it waits for a reboot or a network restart. Use a USB-tethered phone, a personal hotspot, or a wired upstream you control until the host is patched.

Do Jails and Bhyve VMs Need Their Own Patch?

Jails inherit the host’s dhclient binary and clear once the host is patched. Bhyve VMs running their own FreeBSD install need their own freebsd-update cycle. If a jail or VM caches its own /var/db/dhclient.leases.* file, delete that file before the next ifconfig down/up, even on a patched binary. The poisoned lease can still fire if the disk copy is unchanged.

Is There a Public Exploit Yet?

No public proof-of-concept code has been published as of May 6, 2026, six days after disclosure. Rogers has not released an exploit and the FreeBSD advisory does not include one. The bug class is well understood and the fix diff is public, so working exploits should be assumed within days. Treat the patch window as urgent rather than discretionary.

Rogers’ advisory is a tidy demonstration of how a string-handling oversight from the BOOTP era survived three decades and four major FreeBSD branches. The patch is small, the disclosure is clean, and the fix is one reboot away. Whether the lease files on disk get the same scrub is the part operations teams will quietly handle this week.

Logan Pierce is a writer and web publisher with over seven years of experience covering consumer technology. He has published work on independent tech blogs and freelance bylines covering Android devices, privacy focused software, and budget gadgets. Logan founded Oton Technology to publish clear, no nonsense tech news and reviews based on real hands on testing. He has personally tested and reviewed dozens of mid range and budget Android phones, written extensively about app privacy, and built and managed multiple WordPress publications over the past decade. Logan holds a bachelor's degree in English and studied digital marketing at a certificate level.

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

GAMING

Asha Sharma Reshuffles Xbox Leadership In Race To Project Helix

Published

on

Xbox CEO Asha Sharma reshuffled her senior team on Tuesday, importing four executives from Microsoft’s CoreAI division and elevating 20-year company veteran Jason Ronald to run Project Helix, the next-generation Xbox console. The May 5, 2026 memo, sent to Xbox staff and seen by IGN, said it had become “too hard to ship impact quickly” and that the unit “lacks the capability we need in some key areas.” Hardware revenue at Microsoft’s gaming segment fell 33% in the March quarter, the second straight quarter of 30%-plus declines, and Sharma’s runway to a Helix dev kit launch in 2027 is short.

The reshuffle pulls together CoreAI lieutenants who reported to Sharma before her February move to gaming and shifts veteran hardware leader Roanne Sones into an advisor role later this year. It also ends Kevin Gammill’s 24-year run at Microsoft.

Who’s In, Who’s Out At The New Xbox

Sharma’s note names six new appointees and two notable exits. Most picks come from people she worked with at CoreAI, the engineering group inside Microsoft that builds the Copilot stack, GitHub Copilot, and the Azure AI Foundry tools she previously oversaw as president of CoreAI Product before Microsoft’s February announcement of her appointment as gaming CEO. The full slate breaks out like this:

  • Jason Ronald moves up to lead Project Helix and the wider Xbox platform after more than two decades on Xbox hardware.
  • Jared Palmer joins from CoreAI to run platform-level developer tooling and content infrastructure; he previously served as SVP at GitHub and VP at Vercel.
  • Tim Allen takes over experience design, fusing product design, engineering, research, and creative under one fan-first mandate.
  • Jonathan McKay becomes Xbox’s head of growth, joining from CoreAI after stints at Meta and OpenAI.
  • Evan Chaki runs a new engineering group focused on cutting repetitive work and simplifying internal development.
  • David Schloss moves from Instacart, where he worked alongside Sharma, to lead Xbox subscriptions and cloud.
  • Roanne Sones, the corporate vice president overseeing Xbox devices, takes a planned leave of absence later this year and returns as an Xbox advisor.
  • Kevin Gammill, a 24-year Microsoft veteran whose career spanned Xbox user experience and game dev platforms, exits the company.

The CoreAI Imports

Four of the six new lieutenants come straight from CoreAI. Their reporting relationships at Sharma’s old org give the move a clear shape. She is importing the team that ran her previous group’s product velocity engine.

Palmer’s brief, “investing in the systems that make it easy to build, submit and scale high-quality games,” reads as a developer-tools mandate transposed from CoreAI’s GitHub Copilot work into Xbox’s certification, publishing, and live-ops pipelines. Chaki’s remit, removing repetitive work and simplifying day-to-day development, fits the same pattern. Both reflect what CoreAI shipped fast and what Xbox has not.

The Promotions And Exits

Ronald’s elevation is the load-bearing internal pick. He has worked on Xbox hardware programs since the original Xbox One generation and now owns the most consequential roadmap in Microsoft Gaming.

Gammill’s departure quietly closes a long chapter. He spent 24 years at Microsoft across two stints, most of it on Xbox user experience, gaming partner programs, and developer publishing tools. Sones, who led the Xbox Series X|S devices group, will leave for a long-planned absence and rejoin later in an advisory capacity.

The Numbers Behind The Hurry

Xbox is bleeding revenue on the hardware side. Microsoft’s FY26 Q3 segment revenue results show gaming revenue down 7% year-over-year for the quarter ending March 31, 2026, content and services down 5%, and hardware down 33%. That marks the ninth consecutive quarter of hardware declines and the second straight quarter with a 30%-plus drop, after a 32% fall in the December quarter.

Total Xbox gaming revenue slid to roughly $5.34 billion from $5.72 billion the year prior, a $380 million gap inside a single quarter. The hardware line is the most exposed, given Xbox Series X|S consoles are deep into the back end of their generation.

Sharma acknowledged the shortfall in a public note last week. “Player and revenue growth has not yet met our ambition,” she wrote, adding that Xbox still has “work to do to earn every player today and into the future.”

That admission sits awkwardly next to a Microsoft Cloud quarter that delivered $54 billion in revenue, up 29%, and an AI business now running at a $37 billion annual revenue rate. Inside Redmond, gaming is the slow lane in a company whose other lanes are sprinting.

A CoreAI Pipeline Now Plugs Straight Into Xbox

The overlap between Sharma’s old org and her new team has set off alarms with industry watchers. Joost van Dreunen, founder of analytics firm Aldora and a lecturer at NYU Stern, told the trade press the move signals a shift in priority order at Microsoft Gaming.

“Gaming might become subordinate to Microsoft’s horizontal AI ambitions rather than treated as a category with its own logic and culture.”

Sharma has tried to head off that read. She has publicly pledged no “soulless AI slop” on Xbox and framed the new appointments internally as bringing in the best talent rather than reorienting Xbox’s AI policy. IGN reported that the company’s prior stance on AI tooling and content remains unchanged.

There is also a tension inside Sharma’s own messaging. In an April 24 interview transcript with Sharma and chief content officer Matt Booty, she told independent journalist Stephen Totilo: “I want to make the right decision, not the fastest decision.” Two weeks later, her staff memo argues the opposite, that shipping speed is the bottleneck. The reshuffle is how she squares those two statements.

Project Helix Runs On A Tight Clock

Project Helix is the gun to Sharma’s head. The next-gen Xbox, previewed at GDC in March with detailed silicon specs, runs on a custom AMD SoC with RDNA 5 graphics, AMD FSR Next+ machine-learning upscaling, GPU Directed Work Graph Execution, and Deep Texture Compression. Microsoft has confirmed alpha hardware ships to developers in 2027.

From a typical 18-to-24 month dev kit window, a late 2027 or 2028 consumer launch is the only realistic read. That is the timeline Ronald inherits.

The headline feature is platform reach. Helix is being designed to play “your Xbox console and PC games,” a clear positioning shift toward Valve’s Steam Machine and Windows 11 handhelds rather than head-to-head against the PlayStation 6.

That requires new tooling, new certification flows, and a much deeper PC build pipeline. Most of that work falls to Palmer and Chaki, whose CoreAI backgrounds are precisely about developer infrastructure rather than triple-A game production. The fit is tighter than the headlines suggest.

If Helix slips, Sharma’s memo on velocity becomes an indictment of her first year. If it lands on time and runs well, the CoreAI imports will look prescient.

Game Pass Math Is The Other Squeeze

The hardware line is not the only number sliding. Xbox’s content and services revenue, which includes Game Pass, was down 5% year-over-year in the same March quarter. Microsoft’s April 21 Game Pass pricing update tried to widen the funnel by trading away day-one Call of Duty access in exchange for a sharp price drop.

  • $22.99 per month: New Game Pass Ultimate price, down from $29.99 set last year.
  • $13.99 per month: New PC Game Pass price, down from $16.49.
  • About $300 million: Estimated Call of Duty console and PC sales Microsoft gave up in the prior year by including the franchise on Game Pass at launch, per internal accounting cited in the FTC trial record.
  • Roughly 12 months: The expected delay future Call of Duty titles will see before reaching the subscription.

That concession was Sharma’s first hard pricing decision, and it hands cash flow back to the publisher side of the house. It also slows the perception that Xbox subsidies are propping up Activision Blizzard’s release calendar.

What The Memo Actually Asked For

The reshuffle lands a month after Sharma and Booty’s “We Are Xbox” mission statement, which retired the Microsoft Gaming brand and reset platform priorities to four areas: hardware, content, experience, and services. The document also acknowledged player frustration over higher prices, missing console features, and a thin PC presence.

The new appointments map almost one-to-one onto those four pillars. Schloss owns services. Allen owns experience. Palmer and Chaki own the platform plumbing under both content and hardware. Ronald sits across content and hardware via Helix.

The cultural ask in the memo is bigger than the org chart. Sharma wants less time spent inward, more time with players, and faster shipping cycles. Whether a CoreAI playbook can produce that inside the largest console publisher Microsoft has ever owned, after Activision Blizzard King added more than 30,000 employees to the unit in 2023, is the bet she has now placed in writing.

Sharma’s first ten weeks have already produced a brand reset, a Game Pass repricing, a public memo on culture, and a leadership rewrite. The next visible test is whatever Xbox shows of Project Helix later this year, with developers waiting and Microsoft’s quarterly earnings cadence ticking. The clock she described in May is the same clock everyone else can read.

Continue Reading

CRYPTO

Republic Tokenizes Animoca Brands Equity on Solana for Retail Buyers

Published

on

Republic, the global investment platform with $3 billion deployed across 2,500-plus companies, is moving Animoca Brands’ private equity onto the Solana blockchain, a tokenization push first unveiled on September 30, 2025 and still rolling out as of May 2026. Existing Animoca shareholders can already claim tokenized shares directly to their wallets through Republic, and a public waitlist for new buyers is open at republic.com/animoca. The deal lands while Animoca, the Hong Kong Web3 group with more than 600 portfolio investments, races toward a separate $1 billion Nasdaq listing through a reverse merger with Currenc Group targeted to close inside 2026.

Andrew Durgee, Co-CEO at Republic, called the structure “a precedent for how companies can structure their equity for the future” in Republic’s September 30, 2025 announcement on tokenizing Animoca equity. Pricing, the exact token standard, and the public trading start date have not yet been disclosed.

The setup is unusual. Animoca was kicked off the Australian Securities Exchange on March 9, 2020 after the ASX cited governance concerns and “involvement in cryptocurrency related activities.” Six years later, the company is using the same crypto rails it was once punished for to reach retail investors again, this time on Solana, this time with regulators watching.

How the Solana Token Actually Works

Solana hosts the mint. Republic handles distribution, identity checks, and secondary trading. The tokens represent economic exposure to Animoca’s equity rather than direct cap-table ownership, a design Republic has standardized through its Mirror Tokens program for private companies.

Existing shareholders need to register a whitelisted wallet before they can claim. New buyers join the waitlist and clear Republic’s eligibility checks, which typically split between Republic’s Regulation D explainer for accredited US investors and Regulation S for offshore participants. Republic has said the Animoca token “will comply with existing regulatory requirements” without naming a specific exemption for this offering.

The minimum buy-in for Republic’s public Mirror Token tier starts at roughly $50, with no accreditation required. That floor is what makes the offering meaningfully different from the over-the-counter secondary market where Animoca shares have traded since the ASX exit.

What’s confirmed so far:

  • Tokens minted on Solana and distributed to whitelisted wallets
  • Trading routed through Republic’s global marketplace once live
  • Compliance anchored to existing US and offshore securities exemptions
  • Existing shareholders eligible to claim tokenized representations of their holdings

What’s still blank:

  • The exact SPL token standard or custom contract structure
  • Public trading start date and any lockup or holding period
  • Per-token pricing and any cap on retail allocation
  • Whether the token survives, converts, or unwinds at the Nasdaq merger close

The $1 Billion Nasdaq Bid Running In Parallel

Animoca isn’t betting on tokens alone. On November 3, 2025, Currenc Group, a Singapore-based fintech trading on Nasdaq under ticker CURR, signed a non-binding term sheet for a reverse merger with Animoca Brands Corporation Limited. The combined entity targets a roughly $1 billion valuation, well below Animoca’s last private mark of $5.9 billion set in 2022.

Animoca shareholders would hold about 95% of the merged company under the headline terms in Animoca Brands’ November 2025 reverse merger announcement with Currenc Group. Existing Currenc holders would keep the remaining 5%. Closing requires regulatory sign-off in the US and Australia, audited financials, court authorization in Australia, and a shareholder vote on both sides.

The two tracks complement each other in a way most private companies can’t replicate. The Nasdaq listing buys institutional credibility and a real ticker. The Solana token opens fractional, 24/7 access to a global retail base that may never read a prospectus.

It also creates a regulatory question nobody has fully answered. If the Nasdaq deal closes on schedule, Animoca’s claim on its own balance sheet will exist in two parallel forms: registered common stock under SEC oversight, and tokenized economic-exposure wrappers distributed through Republic. Holders of each will track the same financial statements.

That dual structure is now a live test of the SEC Division of Corporation Finance’s January 2026 staff statement on tokenized securities, which warned that wrapping a security in token form “does not change the fundamental nature of the underlying security.” Republic and Animoca will be the first scaled issuance regulators get to grade against that line.

A Six-Year Round Trip Through Crypto

Animoca’s ASX exit is the part of this story most coverage has skipped. The ASX’s March 2020 official removal notice for Animoca Brands ended a five-year listing that started on January 23, 2015. The delisting forced the company into private fundraising, where Temasek and GGV Capital led a $110 million round in August 2022 at a $6 billion valuation. The portfolio has grown from about 540 investments at the end of 2024 to more than 600 today.

Tokenizing Animoca Brands’ equity on Solana showcases what Internet Capital Markets make possible, instant, global access to private company ownership. Solana’s high-performance infrastructure ensures that tokenized shares can move with the same speed and efficiency as the internet itself.

Those words came from Lily Liu, President of the Solana Foundation, in the joint announcement. The framing matters: the company that lost its public listing for crypto activity is now the showcase asset for crypto-native public markets. Yat Siu, Co-Founder and Executive Chairman of Animoca Brands, has been blunt about why on the speaking circuit, calling 2026 “the year of the utility token” on Jacquelyn Melinek’s December 2025 podcast and telling audiences the broader industry must “tokenize or die.”

Inside Republic’s Mirror Token Playbook

Mirror Tokens are Republic’s Mirror Tokens program documentation applied to private-company exposure at retail scale. Republic has already deployed the wrapper for SpaceX. The Animoca offering is the first tied to a Web3-native company at this size.

Each Mirror Token gives holders economic exposure that tracks the underlying equity, distributed under existing securities exemptions. They sit on-chain, transfer only between whitelisted wallets, and resolve to cash settlement at defined corporate events such as a sale, merger, or public listing.

Republic has been explicit that Mirror Tokens do not carry voting rights and are not equivalent to holding common stock on a cap table. That distinction is the operating reality even when the marketing leans into the language of ownership.

Feature Mirror Token Nasdaq Common Stock
Minimum buy-in About $50 One share at market price
Eligibility Public, no accreditation required Anyone with a brokerage account
Trading hours 24/7 once listed Nasdaq market hours
Right conferred Economic exposure Direct ownership and voting
Settlement rail On-chain, Solana DTCC, T+1

The table is the cleanest answer to the question retail investors keep asking on Republic’s interest forms: am I buying the same thing a Nasdaq investor will buy after the merger? No. You’re buying something cheaper to access, faster to trade, and structurally junior on rights.

Solana’s RWA Surge In Hard Numbers

The Animoca deal arrives with Solana already running hot in the real-world-asset segment. The chain has spent 2025 and early 2026 turning into the default settlement layer for tokenized stocks, treasuries, and private equity wrappers.

The numbers behind that shift, drawn from the Solana Foundation’s State of Solana February 2026 report and related ecosystem data:

  • $1.71 billion Solana RWA market cap, an all-time high recorded in late February 2026, up 45% in 30 days
  • 325% growth across calendar 2025, lifting the segment from roughly $200 million in January 2025 to about $873 million by January 2026
  • 55-plus tokenized equities already live on Solana through xStocks, including wrappers of Apple and Tesla
  • $18.9 trillion projected total tokenized-asset market by 2033, per the joint Ripple and BCG forecast

What Yat Siu Is Telling Markets Now

Siu has spent the past six months running a public campaign for tokenized equity. In a January 2026 Invezz interview he argued identity and intellectual-property tokenization will drive mainstream adoption. A March 2026 CoinShares conversation cast Animoca itself as “a gateway to the utility tokens of Web3.”

His framing matters because Animoca is doing both at once. The Nasdaq merger gives the company access to traditional capital and the disclosure regime that comes with it. The Solana token gives it a retail distribution channel no listed peer has at this scale.

If Republic ships the offering before the Nasdaq close, Animoca becomes the first live experiment in whether retail crypto demand can meaningfully price a private-then-public company in real time. The answer arrives this year, and the SEC will be reading the filings.

Frequently Asked Questions

Can I Buy Tokenized Animoca Shares Today?

Not yet. As of May 2026 the offering is in waitlist mode at republic.com/animoca. Existing Animoca shareholders can claim tokens directly by registering a whitelisted Solana wallet. New buyers can submit interest, get notified when the public sale opens, and clear Republic’s identity and jurisdiction checks before any allocation. Republic has not posted a public sale date, token price, or hard cap.

Do These Tokens Give Me Voting Rights At Animoca?

No. Republic’s Mirror Token structure provides economic exposure to the underlying equity but does not carry shareholder voting rights, board nomination rights, or a seat on Animoca’s cap table. If you want a voting interest, the relevant route is buying common stock in the merged Currenc-Animoca entity once it lists on Nasdaq, expected to close in 2026 under ticker CURR pending regulatory and shareholder approvals.

What Happens To My Token When The Nasdaq Merger Closes?

Republic has not published the conversion mechanics yet. Mirror Tokens typically resolve to cash settlement or a defined exchange ratio at corporate events like a merger or IPO. Watch the republic.com/animoca update page for the binding terms before the Currenc reverse merger closes, and read the offering memorandum carefully for any forced redemption, lockup, or pro-rata adjustment language.

Is This Legal Where I Live?

Eligibility depends on your country and accreditation status. Republic typically segments offerings between Regulation D for accredited US investors and Regulation S for non-US buyers, with several jurisdictions blocked entirely. The Republic platform runs a residency check during signup. If your country shows as restricted, no waitlist conversion or wallet whitelist will be possible regardless of how much capital you commit.

How Is This Different From Buying Animoca On An OTC Desk?

Three differences matter. The minimum drops from tens of thousands of dollars on OTC desks to roughly $50 on Republic. Settlement runs on Solana in seconds rather than over multi-day broker workflows. And secondary trading is concentrated on Republic’s marketplace instead of fragmented across private brokers, which should narrow bid-ask spreads once volume builds. The trade-off is the lack of voting rights.

Republic and Animoca have framed this as a precedent. The truthful read is narrower: it’s the first time a Web3 company with a real $1 billion-plus public path is using tokenization as a parallel distribution rail, and the SEC’s January 2026 staff guidance will get its first scaled stress test in the process. Whether the experiment ends as a template or a cautionary tale depends on what trades, at what price, on Solana the morning the offering finally goes live.

Continue Reading

NEWS

Hormuud Bets $19 Down Will Finally Pull Somalia Online

Published

on

Mogadishu’s biggest telecom operator just put a smartphone within reach of almost every adult in the country for the price of a chai habit. Hormuud Telecom and device financier Get-Phone launched Somalia’s first structured smartphone financing program at the Decale Hotel on May 5, 2026, opening enrollment with a $19 deposit and daily payments of $0.60. The plan targets 10,000 devices by June and 100,000 by year-end, then expands into Puntland and Somaliland.

The math is what makes this story land. The average Hormuud customer already spends roughly $0.50 per day on data and minutes. Adding a smartphone to that line item costs them another 10 cents.

Behind the simple numbers sits a quieter story: this is less a phone deal than a credit infrastructure rollout dressed up as one. The repayment engine is Hormuud’s EVC Plus mobile money platform, which the operator says serves roughly four million customers, and the underwriting layer scores eligibility from SIM-usage patterns, not bank statements.

The Deal That Costs Less Than Lunch

Customers walk into a Hormuud branch, pay $19 up front, and walk out with an internet-ready handset the same day. From that point, $0.60 lands daily on the device through EVC Plus. The fee bundles 1GB of mobile data, 40 minutes of voice calls, and the device installment in a single charge.

Repayment terms run six to 12 months. Get-Phone CEO Omar Abdi confirmed the structure is interest-free and Sharia-compliant, which lets the program reach the large share of Somalis who refuse conventional credit on religious grounds.

That is not a marketing line. Somalia’s mobile money market runs on Islamic-finance principles by default, and any device-financing model that smuggled riba into the contract would have died on contact with the Mogadishu street.

How $0.60 A Day Actually Works

The headline price hides three different things: a hardware payment, a data bundle, and a voice allowance, all settled through the same daily mobile-money debit. Strip the bundle out and the marginal cost of the smartphone over a feature phone is roughly 10 cents per day, since most customers already spend $0.50 daily on prepaid airtime and data.

Eligibility runs on a proprietary scoring engine that reads how a SIM has behaved over time. Top-up cadence, voice patterns, length of network tenure, and EVC Plus transaction history feed the model. No bank statement, no formal employment proof, no national ID requirement for most applicants.

A second layer hardens the underwriting: a family-guarantor mechanism, where a relative co-signs through their own SIM. The structure leans on Somalia’s clan and family networks rather than against them, and that detail mattered during the pilot.

Here is what the pricing block looks like in practice.

  • $19: one-time deposit at any Hormuud or Get-Phone counter
  • $0.60 per day: device installment plus 1GB data plus 40 minutes of voice
  • 6 to 12 months: repayment window, interest-free
  • 4 million: existing EVC Plus customers who can repay through the same wallet they already top up

Why EVC Plus Is The Real Engine

Mobile money in Somalia is not an alternative payment method. It is the payment method. A 2025 Frontiers study on EVC Plus and humanitarian aid delivery documented the platform’s reach at over 80 percent of the adult population in southern and central Somalia, with daily transaction volumes that dwarf the country’s banking sector.

That base is what allows daily-rate device repayment to work at all. A Kenyan or Nigerian operator running the same product would face card declines, USSD timeouts, and bank-rail friction. In Somalia, $0.60 deducts from an EVC Plus wallet in seconds.

Variable Hormuud / Get-Phone M-Kopa (Kenya)
Upfront deposit $19 ~$15 to $35
Daily payment $0.60 (bundles data and voice) ~$0.45 to $0.65 (device only)
Repayment rail EVC Plus mobile money M-Pesa
Pilot default rate Under 4% Around 10% market average
Compliance frame Sharia-compliant, interest-free Conventional interest model

The Sharia-Compliance Twist Mainstream Banks Couldn’t Crack

Conventional device financing in Muslim-majority markets has stalled for years on a single problem: interest. A standard installment plan with a stated APR is haram under most local interpretations, and households simply refuse it. Get-Phone’s contract is structured along ijarah and murabahah lines, where the financier owns the device, sells it forward at a fixed markup, and collects in known installments.

That structure is not exotic in Somalia. It is the default. Salaam Somali Bank, Premier Bank, and Kaah International Microfinance Services have all built consumer products on the same legal scaffolding, and Hormuud chose to plug into it rather than fight it.

This program is built on the belief that when you give people access to the right tools at the right price, they will do extraordinary things, said Get-Phone CEO Omar Abdi at the Decale Hotel launch.

A 4% Default Rate That Caught Lenders Off Guard

The most under-reported number from Tuesday’s launch is the pilot default rate. Hormuud said the February-to-March Mogadishu pilot recorded delinquency below 4 percent. M-Kopa, the most successful pay-as-you-go device financier in East Africa, has openly said its market default rate sits closer to 10 percent in Kenya, and the company has fought legal battles over its enforcement tactics.

Hormuud’s number is genuinely low for an unbanked-population product. Two design choices explain it.

First, the family-guarantor mechanism. A delinquent borrower drags a named relative’s SIM into the same delinquency status, which collapses voice, data, and EVC Plus access for both parties at once. Social cost replaces legal cost.

Second, the same SIM that owes money is the SIM the borrower depends on for income, banking, and family contact. There is no walking away from a Hormuud number in Somalia. The asset and the collateral are the same object.

If that 4 percent figure holds at 100,000 devices, the program crosses the threshold where international development financiers and impact funds typically step in. A loan book performing inside 4 percent loss is investment-grade by emerging-market standards.

ZTE Devices And What They Mean For Margins

Mainstream coverage skipped the supply side entirely. Get-Phone’s product page lists ZTE as the curated handset partner, which lines up with the broader pattern across low-margin African device financing: Chinese OEMs are the only ones willing to ship sub-$100 4G devices in volume with the LTE bands East African networks need.

The choice has consequences. ZTE’s bill of materials at this tier sits well under $50, leaving room inside Get-Phone’s contract for the markup that funds the financing risk. A Samsung or Xiaomi device at the same price band would have left no room for either bundled data or a 4 percent default cushion.

Vision 2060 And The GDP Math Behind The Pitch

Deputy Prime Minister Salah Ahmed Jama framed the rollout as a building block of Somalia’s Centennial Vision 2060, the long-term plan to lift the country to middle-income status by mid-century. “A smartphone today is far more than a device; it is a gateway to commerce, education, and opportunity,” Jama said at the launch.

The macro case is real. A World Bank background paper for the World Development Report found that a 10-percentage-point increase in fixed broadband penetration lifts GDP growth by roughly 1.38 percent in developing economies. GSMA’s 2025 Mobile Economy Africa report went further, projecting that closing the continent’s mobile internet usage gap by 2030 could add around $700 billion to African GDP.

Where Somalia sits today makes the upside concrete.

  • 11.5 million: active mobile connections, equal to 58.1 percent of the population
  • 27.6 percent: individual internet penetration at the end of 2025
  • 75.7 percent: share of mobile connections already on 3G, 4G, or 5G
  • 22.7 percent vs 47.1 percent: rural versus urban internet access reported in Somalia’s Digital Inclusion Policy
  • Sixth of annual income: typical upfront cost of an entry smartphone before this program

Frequently Asked Questions

How Do I Sign Up For The Get-Phone Smartphone Plan In Mogadishu?

Walk into any Hormuud branch or Get-Phone service point with an active Hormuud SIM and $19 in cash or EVC Plus balance. Staff verify your number against the SIM-usage credit score, register a family guarantor where required, and hand over the device the same day. Daily $0.60 deductions begin from your EVC Plus wallet the next morning, and the eGet customer app tracks your remaining balance in real time.

What Happens If I Miss A Daily Payment?

Short grace periods apply, then the device’s data and voice features pause until the wallet is topped up. The handset is not bricked outright in the early window. If delinquency runs longer, the family guarantor’s SIM is flagged too, which is the social pressure point that kept pilot defaults below 4 percent. Long-term non-payment can lead to device deactivation and recovery under the Sharia-compliant ijarah terms.

Is This Plan Actually Interest-Free Under Islamic Finance Rules?

Yes. Get-Phone CEO Omar Abdi confirmed at the May 5 launch that the contract is structured along Sharia-compliant lines, with the financier owning the device and selling it forward at a known markup rather than charging riba. The total amount you pay across six to 12 months is fixed at signing, and there are no late-payment interest charges added. Customers can request the contract documentation in Somali or English at any branch.

Can I Use The Phone On A Network Other Than Hormuud?

Not during the financing period. The device is tied to your Hormuud SIM, since the SIM doubles as your identity, your credit file, and your repayment rail through EVC Plus. Once you complete the six-to-12-month term, ownership transfers and the device unlocks for use on other carriers. Hormuud has not yet published a buy-out option for early settlement, but Get-Phone branches in Mogadishu are accepting written queries.

When Will The Program Reach Puntland And Somaliland?

Hormuud said the second wave starts after the 10,000-device Mogadishu phase clears in June 2026, with the 100,000-device national target running through December. Puntland’s Bosaso and Garowe and Somaliland’s Hargeisa are flagged as the first regional launches. Customers outside Mogadishu can register interest through the eGet app or at Hormuud retail outlets, and the company has committed to publishing a regional rollout calendar on its corporate updates page as zones come online.

If the pilot’s 4 percent default rate holds at scale, the program stops being a corporate social responsibility story and turns into something rarer: a viable consumer-credit business built on top of a mobile-money rail in a country where formal banking still touches under 10 percent of adults. That is the lever that turns Hormuud’s masts into smartphones, and smartphones into the GDP line that Vision 2060 has been chasing on paper for a year. The next 100,000 devices will tell whether the math survives contact with the rest of the country.

Continue Reading

Trending