WiiBrew.org said:comex has found a bug in the System Menu's banner-parsing code which can be exploited to run unsigned code, even on System Menu 4.0. His unreleased POC loads the Homebrew Channel from NAND (if installed); Video is here. If it can be extended to load a DOL off the SD card, it could replace the TP-hack.
Discuss.
PS: Get *****, Nintendo.