Nostr notes by Cybersecurity & cyberwarfare

3D Printed Einstein-Szilard Refrigerator Cools with Fire They may ...

2026-10-31T08:00:42Z

3D Printed Einstein-Szilard Refrigerator Cools with Fire

They may not deliver the highest efficiency, but absorption refrigerators have earned a persistent place in camper vans and industrial plants thanks to a few distinct advantages: they can operate using waste heat alone as an energy source, and they can be quite reliable due to their lack of moving parts. It can be a bit hard to understand their working principles, though, which is why [Ben Krasnow] built a transparent Einstein-Szilard refrigerator.

Most absorption refrigerators use ammonia and water as their working fluids; since the ammonia gas needs to condense at room temperature, the refrigerator requires pressures above what can be comfortably held in a glass or plastic enclosure. The Einstein-Szilard design, by contrast, uses a third liquid as its refrigerant. A strong solution of ammonia in water is separated by boiling, and the ammonia gas induces the refrigerant to evaporate by decreasing its partial pressure. The refrigerant and ammonia gasses then mix with water, in which the ammonia dissolves, leaving the refrigerant vapor to condense and start the cycle again. The newly reformed water-ammonia solution flows back into the boiler.

The refrigerant is usually butane, but since [Ben] was powering this pressurized system with an open flame, he opted instead for nonflammable perfluoropentane. The refrigerator body itself was 3D printed in clear resin, with a copper block transferring heat from the flame to the boiler chamber; ammonia solutions do dissolve copper, so this isn’t a long-term solution, but it works for a demonstration. The single internal path of the refrigerator presented some difficulties: since almost no pressure builds up between different parts of the system, a bubble in the wrong place can easily airlock it. In the end, [Ben] managed to get it working well enough to reach five degrees Celsius below the ambient temperature. Conveniently, he notes that, for alcohol at a sufficiently high concentration, you could cool your drink by burning a portion of it.

Ammonia-based refrigerators are a tough build for most hackers, but we have seen a salt-water-based absorption refrigerator before. For more less-known refrigerators, check out our article on strange cooling methods.

youtube.com/embed/doZ5e4YVdEs?…

Thanks to [spacedog] for the tip!

hackaday.com/2026/10/31/3d-pri…

Novelty Camera To USB Camera The Godox C100 is a cheap camera ...

2026-10-31T05:00:23Z

Novelty Camera To USB Camera

The Godox C100 is a cheap camera that’s best described as a toy, its party trick being a large clear viewfinder with a head-up-display light meter. It’s by no means a high quality device, being little more than a dashcam in a fancy case, but like many others of its kind it offers opportunity for the camera hacker. [Holofermes] has one, and has given it a suite of patches that, among other things, convert it to a USB webcam and give it a Pi Zero dock.

It takes the standard firmware and adds the patches on top, so while they’re installed it can only act as USB drive and webcam, if a return to camera is desired then the original firmware must be flashed. There are some details on the hardware, such as that ti runs FreeRTOS on an Arm architecture with 16 megabytes of memory. The sensor has a 1920 by 1080 pixel resolution, which is a step up from the upscaled VGA of may such cameras.

Many novelty cameras are not as hackable as this one, which makes it interesting. We hope that more camera hackers will turn their attention to it. It’s not the first cheap camera we’ve taken a look at.

hackaday.com/2026/10/30/novelt…

VR Headset Ditches the Base Stations with DIY Tracking Those in ...

2026-10-31T02:00:41Z

VR Headset Ditches the Base Stations with DIY Tracking

Those in the virtual reality scene might be interested in [Prohurtz]’s add-on for the Bigscreen Beyond VR headset. BSB-SLAM adds SLAM (Simultaneous Localization and Mapping) tracking to the headset by attaching a sensor to the front of the headset, and providing the software to tie the two together. As a result, the headset can be fully tracked in 3D space with no need for external base stations. It essentially adds inside-out tracking as a DIY add-on.
An early version, shared with a brief video demo posted to X.
Just to be clear, that doesn’t mean the headset becomes wireless. The Beyond connects to a PC, essentially acting as a display, and that part is the same. But it does mean the headset is no longer tied to having to work in a room with base stations pre-installed.

[Prohurtz]’s solution does this by adding a small off-the-shelf Xvisio XR50 board, USB cable, and 3D-printed mount to the unit. The headset works as normal, just with some extra software needed to use the sensor data in lieu of the base stations.

As far as sensors go the Xvisio XR50 is a bit spendy, but the fact that a small and lightweight SLAM sensor that’s capable of delivering positioning data suitable for tracking a headset in near real-time can be bought online and so readily adapted is pretty interesting.

[Prohurtz] got the idea working back in 2025 but it’s now at the point where one can order a part, print an adapter, and be off to the races with a software package.

This isn’t [Prohurtz]’s first time with VR hardware, either. The EyeTrackVR eye tracking add-on is also their work, combining largely off-the-shelf hardware into an effective DIY solution for VR use.

hackaday.com/2026/10/30/vr-hea…

A 1982 Modem for $100 [Dave Farquhar] takes a walk down memory ...

2026-10-30T23:00:57Z

A 1982 Modem for $100

[Dave Farquhar] takes a walk down memory lane about the Commodore 1600 VICModem, perhaps the first phone modem to sell for less than $100. Commodore, of course, was famous for making cheaper computers like the VIC20, the Commodore 64, and lower-cost peripherals like disk drives. But how did they hit the $100 price point with the modem when competing 300 baud modems sold for at least twice that, and a 1200 baud unit would set you back at least $600?

First, Commodore didn’t handle the design themselves. Instead, they outsourced to Anchor Automation, a well-known modem manufacturer. It used a Motorola MC14412 modem on a chip, along with six other chips. The chip could, in theory, do 600 baud, but the modem was rated for 300. But it did make some interesting design choices.

Old-school modems were not allowed to connect to the phone lines directly, so you dialed the phone number and then shoved the handset into some padded cups known as an acoustic coupler that placed a microphone next to the phone speaker and a speaker next to the phone microphone. Modern modems didn’t have this problem (thanks, in part, to Tom Carter), and the VICModem also connected directly. But to save money, it couldn’t dial the phone for you. The idea was you’d dial the phone like you would with an old acoustic modem and then pull the handset cord and plug it into the modem yourself.

There was a problem. In those days, old phones didn’t always have a plug on the handset. Ironically, according to [Dave], the company bought phones to bundle with the modem in Canada only to find out the phones they bought had hard-wired handsets and were not usable. Not only that, if the phones had been the right kind, they would have been illegal in Canada at that time since the phone rules prohibited modular jacks for the handset.

To fix the problem, they also bundled the VIC-1605, which was essentially a Y cable for the phone. You plugged it into the wall, and then plugged the phone into an RJ-11 and the modem into an RJ-9.

There were other cost savings, too. There was a switch that determined if you were originating a call or receiving one, for example. A great example of how to design something as cheaply as possible, other than the faux pas with the phone connectors.

These days, it is hard to find a modem, but even if you do remember them fondly, it is surprising how old they really are and how little you needed to make a low-rate acoustic modem.

hackaday.com/2026/10/30/a-1982…

Yoba malware uses fake ChatGPT and Claude apps to sideload ...

2026-10-30T21:22:59Z

Yoba malware uses fake ChatGPT and Claude apps to sideload malware through signed installers and deploy a cryptocurrency miner. Check Point Research has spent two months tracking a campaign it calls Yoba, which uses the popularity of AI tools to spread a custom malware chain. The attackers build fake GitHub projects that pose as AI […]
Yoba Malware Hides a Crypto Miner Behind Legitimate OpenAI and Anthropic Binaries

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds ...

2026-10-30T20:25:14Z

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added GitLab and Cisco vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Below are the flaws added to the catalog: CVE-2026-97229 is a critical security flaw that could let attackers run code on […]
U.S. CISA adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog

Making Internal Combustion Engines Better With More Valves When ...

2026-10-30T20:00:11Z

Making Internal Combustion Engines Better With More Valves

When it comes to internal combustion engines (ICEs), it’s generally accepted that each cylinder doesn’t have more valves to let in a fresh fuel mixture and to exhaust the aftermath than absolutely necessary. You could argue in favor of this also because it reduces the amount of valve seat surface and thus the potential for leaks, but there is historical precedent for higher valve counts. Hence [Alexander’s Laboratory] had to give a ten-valve engine a shake, just to see what effect adding more valves has.

A cited historical example is the Yamaha FX750, which features a five-cylinder engine that has three inlet and two outlet valves per cylinder, making for a 20-valve design that is claimed to improve performance, also because each valve can be smaller and lighter than with a single valve per side. Other motorbike manufacturers would also try such configurations, with some fascinating examples shown in the video.

What [Alexander] tries here is to create a 10-valve version, for a symmetric five valves intake and five for exhaust. Rather than building an entire engine from scratch, the largely 3D-printed ICE that was featured in previous videos will be modified with a new cylinder head, replacing the current four-valve one.

For the custom valves large wood screws are used, after making sure that they can take the heat of the combustion. Making even ten of these small valves fit was a challenge, but ultimately got squeezed into a CNCed aluminium and nylon-printed hybrid cylinder head. The existing camshaft was reused by using an adapter that simply drives five valves at the same time.

After some troubleshooting and tuning the engine actually runs pretty well, though sadly no comparison metrics were provided versus the four-valve version of the cylinder head. Hopefully we’ll see this in an upcoming video.

youtube.com/embed/njTlfWwiXJ4?…

hackaday.com/2026/10/30/making…

Binance links a $6.3 billion crypto theft to a compromised DevOps ...

2026-10-30T18:50:26Z

Binance links a $6.3 billion crypto theft to a compromised DevOps laptop, with North Korean hackers blamed by blockchain analysts. Binance was investigating suspicious transfers that early estimates put at up to $5.8 billion. A day later, multiple media outlets reported that the largest cryptocurrency exchange had linked the theft of about $6.3 billion to […]
$6.3 Billion Stolen from Binance in Attack Attributed to North Korea

A Modern Smalltalk In the history of object-oriented (OO) ...

2026-10-30T18:30:54Z

A Modern Smalltalk

In the history of object-oriented (OO) computer languages, Smalltalk has a special place. It wasn’t the first OO language, and it hasn’t spread as well as some others. But it was the first OO language many people encountered, and it influenced many other languages you’ve probably seen. Developed at the famed Xerox PARC, it also introduced many people to the “model/view/controller” (MVC) architecture. Cuis Smalltalk is a free and portable modern Smalltalk-80 environment. It replaces the traditional MVC framework with Morphic, but otherwise, it would be very familiar to someone who used Smalltalk in the 1990s. The project’s goal is to stay simple at the core, although you can add complexity via packages.

The software has been around for a while, but it is on a rolling release model, so the install page suggests you clone the Git repo. You can, however, get a stable release, which might be important if you were deploying applications. Running the program results in a Cuis desktop where you can open various things like workspaces, help documents, and the transcript.

Smalltalk throws some people because it takes OO to an extreme. For example, you don’t add two and three using an operator. You send the object two a message that includes another object, three. You can think of sending a message as calling a method on an object. As with virtual functions in C++, different objects can respond differently to the same request. For example, an Animal class might have a speak message that causes a cow to print “moo” and a chicken to print “cluck.”

You get used to it, and there’s a very nice class browser that lets you examine classes and what you can do with them. There are even packages to work with an Arduino over a serial port. They haven’t been updated lately, so they might (or might not) need a little work.

We’ve looked at GNU Smalltalk before. We’ve also seen a version that runs directly on a Raspberry Pi.

youtube.com/embed/aoe4GN-ZmvU?…

hackaday.com/2026/10/30/a-mode…

Hackaday Podcast Episode 393: Epaper, Tamagotchi Hacks, and ...

2026-10-30T17:45:17Z

Hackaday Podcast Episode 393: Epaper, Tamagotchi Hacks, and Supercon Talks Galore

This week’s podcast comes from Europe, as Elliot Williams is joined by Jenny List, who wishes to apologies for the poor sound quality from her headset microphone. The news this week is our Supercon conference which is upcoming, we’ve released more speaker details.

We start the hacks with a follow-up to an exciting development. We’ve seen e-paper screens driven at high frame rates, but do the techniques used shorten the life of these displays? Then we have Tamagotchi hacking, re-using an old mobile phone as a flight controller, the oldest Windows app to run on Windows 11, and probably the prettiest mini TV studio rack you will ever see. Pushing Bluetooth out to 12 kilometres is the cherry on the cake.

In quick hacks there’s a swash plate-less helicopter, Commodore 64 keycaps, and the history of the mouse, before our can’t-miss look at infra-red transmission, and a forgotten Google VR headset.

Check out the links if you want to follow along, and as always, tell us what you think about this episode in the comments, or drop us a line on the mailbag.

html5-player.libsyn.com/embed/…

Download yourself a little podcast, won’t you?

Where to Follow Hackaday Podcast
Places to follow Hackaday podcasts:

iTunes
Spotify
Stitcher
RSS YouTube
Check out our Libsyn landing page

Episode 392 Show Notes:News:

2026 Hackaday Supercon: All The Speakers!

Mailbag:

[Stefan] asked us about the performance of lead-acid batteries at lower temperatures. This prompted an interesting discussion of the subject, with the discovery that they are rated for surprisingly low temperature working. Battery University remains your best bet though, as always.

BU-410: Charging at High and Low Temperatures

Interesting Hacks of the Week:

Does Running An E-Paper Display At 30 FPS Destroy It?

Tiny E-Paper Display Delivers 30 FPS Of Game Boy Fun
Behold A 60 Hz Refresh Rate E-ink Monitor
GitHub – kuslota/InkBoy · GitHub

An Analog TV Station For Anyone
Turning An Old Phone’s Motherboard Into An RC Plane Controller

Turning A Run-Over Samsung Galaxy S23 Into A Gaming PC
There’s A Whole Computer Inside This Mouse

The Oldest Windows App To Still Run On WIndows 11
Hacking The Modern Tamagotchi With UART

Using An MCU’s Own Debug Peripheral To Defeat Bootrom Protection
Classic Tamagotchi Is Reincarnated In Modern Hardware
Reverse-Engineering The Tamagotchi IR Connection
Building The Infinite Matrix Of Tamagotchis
Tamagotchi Hacking, In Depth

Pushing Bluetooth Out To 12 Kilometers

Quick Hacks:

Elliot’s Picks:

The Slurptop Is Both Drool Worthy And Practical
2026 Retrocomputing Challenge: Explore Space With A Credit Card Reader
Building A Swashplate-less Helicoper Rotor

Jenny’s Picks:

C64 Keycaps For Everybody
Where Did Your Mouse Come From?
In Praise Of A Legendary Power Transistor

Can’t-Miss Articles:

Exploring What’s Left Of Google’s VR Dreams
The Fascinating World Of IrDA And Other Infrared Protocols

YouTube: Hackaday Superconference 2017 – Michael Ossmann & Dominic Spill
Mike Ossmann And Dominic Spill: IR, Pirates!

hackaday.com/2026/10/30/hackad…

https://traffic.libsyn.com/secure/hackaday/Hackaday_Podcast-Ep393.mp3

PHP2Shell in Italia: il rischio per oltre 285mila servizi PHP ...

2026-10-30T17:19:21Z

PHP2Shell in Italia: il rischio per oltre 285mila servizi PHP

nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqvje76wq7e5kh9x2c0cggcmymz5408yw8lxxhtpy6v0cdwfu2c9asanfwcg (nprofile…fwcg)
Lo dice Csirt: in Italia 285.149 servizi PHP risultano potenzialmente vulnerabili a PHP2Shell: sono l'81,9% di quelli con versione identificabile, non di tutti i 741.523 rilevati. Le falle consentono l'esecuzione di codice da remoto e, insieme a Fragnesia, possono portare fino

Registrazione NIS2: il 31 ottobre chiude il canale per i ...

2026-10-30T17:14:16Z

Registrazione NIS2: il 31 ottobre chiude il canale per i ritardatari

nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqvje76wq7e5kh9x2c0cggcmymz5408yw8lxxhtpy6v0cdwfu2c9asanfwcg (nprofile…fwcg)
Dal 31 ottobre ACN chiude il canale delle dichiarazioni tardive NIS. La Determinazione 314287/2026 semplifica gli adempimenti per le imprese già in elenco e introduce le procedure per il 2027. Restano gli obblighi di aggiornamento e le responsabilità dirette degli

Attacco a Binance: in 20 minuti la Nord Corea compie il furto ...

2026-10-30T17:09:29Z

Attacco a Binance: in 20 minuti la Nord Corea compie il furto cripto del secolo

nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqvje76wq7e5kh9x2c0cggcmymz5408yw8lxxhtpy6v0cdwfu2c9asanfwcg (nprofile…fwcg)
L'attacco, con furto di 6,36 miliardi di dollari a Binance, sarebbe opera di TraderTraitor, gruppo di hacker collegato alla Corea del Nord. Ecco cosa sappiamo, perché riguarda anche l'Italia e come mitigare i rischi
L'articolo Attacco a Binance: in 20

How Britain Narrowly Escaped a Grid Blackout in June 2026 Amidst ...

2026-10-30T15:30:14Z

How Britain Narrowly Escaped a Grid Blackout in June 2026

Amidst one of the worst heatwaves in European history, Britain’s national grid saw itself faced with a quiet crisis this summer. On June 23rd, the grid frequency dropped to 49.657 Hz, down from the nominal 50 Hz — getting very close to the lower bound before safeties would start disconnecting parts of the grid. In a video by [The Electric Brit] this event is investigated, including its causes and how France’s spare capacity managed to save the day.

Under normal operating conditions the UK grid is kept above 49.8 Hz, with the statutory lower limit being 49.5. Meaning that another drop of 0.157 Hz would have set in motion a series of quite extreme grid protection mechanisms including the possibility of local blackouts.

Fortunately the cessation of energy exports and the importing of French power from hydro and nuclear power stations managed to nip this issue in the bud before it could get any worse. Although an example of correct grid management, it also shows how poorly planned maintenance and events like a heatwave can line up quite a few holes in the cheese slices that invite disaster.

The problems here began weeks prior to the event, with 21.2 GW of generating capacity offline. Of this, 12.6 GW was planned maintenance, another 8.6 GW was unexpectedly offline, while another 2.6 GW of gas generation was mostly unavailable due to the heatwave curtailing production. A couple of interconnections with Ireland and other nations were also down for maintenance, leaving the grid control room with precious few options.

Although the UK’s transmission system operator (TSO) NESO had its predicted capacities for variable renewable sources (VRE) like solar, it could not see local demand and production from e.g. rooftop solar in the control room. This became rather exciting when the evening neared and rooftop solar output dropped. Here NESO turned out to be lucky, but such hidden factors form a major risk factor when such consumers return to grid power.

As VRE sources fell quiet across Europe that evening, this put the onus on remaining generating sources and brought the slowly developing crisis to its apex. Fortunately importing energy from France saved the day here, but there are many lessons to be learned here, many grounded in how complex AC grid management is once you consider all aspects that affect not just generators but also transmission lines.

This event is different from the frequency oscillations that triggered the blackout on the Iberian peninsula in 2025. In that case a problem existed with reactive power management, with oscillations amplified by grid-following converters from solar farms and insufficient capacity on the grid to absorb this surge in reactive power, ultimately leading to the cascading blackout.

Amidst these lessons on grid-management the discussions on whether baseload power generating is truly dead among other tropes, as well as the calls by European TSOs to make grid-forming converters mandatory on VRE generators will no doubt intensify.

youtube.com/embed/mJ2j4aZFpVo?…

hackaday.com/2026/10/30/how-br…

This Week in Security: Broken Embargoes, UEFI Overflow, Wormable ...

2026-10-30T14:00:29Z

This Week in Security: Broken Embargoes, UEFI Overflow, Wormable Tailscale, Starlink Ad Snooping, and a DHS Directory Dump

Last week brought us at least two broken embargoes: php2shell leaked onto Hacker News a day early, and a batch of Linux kernel bugs landed on the public kernel mailing list instead of the private security list. This week has been slightly less exciting overall, fortunately, but Akamai’s security team published a pointed essay titled “TLP Is Not a Suggestion”, and it’s hard to argue with the timing.

When a researcher finds a serious bug, the usual process is “coordinated disclosure”. The developers get time to build a fix, and downstream vendors get advance notice under embargo so patches and protections are ready the moment details go public. The Traffic Light Protocol (TLP) is the vocabulary everyone uses to say who may know what: TLP:RED for named recipients only, TLP:AMBER for an organization and its clients on a need-to-know basis, TLP:GREEN for a trusted community, and TLP:CLEAR for anyone. It has no legal teeth whatsoever. It’s not classified data in a legal sense. It works because everyone involved agrees to make it work.

Akamai’s complaint isn’t really about the original php2shell leak, but about what came after: vendors and researchers racing to confirm, reproduce, and publish first. According to Akamai, a researcher published a reconstruction of the bug before the patch existed, and exploitation attempts started before most admins knew there was anything to patch. They draw parallels to Heartbleed in 2014, where a handful of companies got early notice and then advertised that they were already safe while Linux distributions were caught flat-footed, and to Meltdown and Spectre in 2018, where a six-month embargo collapsed six days early.

In the rush to publish, it’s also become less clear what the actual severity of the bug is in the real world. It clearly exists, and is of concern, but groups are still struggling to prove a complete exploit path, with several challenges showing results but nothing definitive so far.

Their advice boils down to “protect first, publish second”: push the detection rules and virtual patches, tell your customers privately, and save the blog post for after the official advisory. With AI tooling shrinking the time between “details exist” and “working exploit” to hours, the cost of a broken embargo is going up, not down.UEFI network boot bug in most servers

Speaking of broken embargoes, Ars Technica reports on CVE-2026-97631, a CVSS 9.5 code execution bug in TianoCore EDK II, the open source codebase which nearly every firmware vendor builds on. That includes AMI, Insyde, Phoenix, and Microsoft’s own Project Mu fork.

UEFI is the current iteration of what we knew as the PC BIOS: the firmware that runs before your operating system, initializes the hardware, and hands off to the bootloader. It’s also where Secure Boot starts its chain of trust, and where the TPM gets set up. Code running in UEFI runs before any of the operating system’s defenses exist, which makes it extremely attractive to attackers. The Preboot eXecution Environment (PXE) is the UEFI feature that lets a machine boot from an image downloaded over the network, which is common in data centers and labs with large numbers of identical machines.

The bug is a 16-year-old buffer overflow in how the PXE driver stores ICMP error messages: it copies incoming errors into a fixed 504-byte buffer without properly checking the length. An attacker who can send a packet to the machine while it’s network booting can overwrite adjacent memory and, if they know the specific firmware build, run code at the highest privilege level before Secure Boot ever gets a say. Buffer overflows are nothing new, in fact they’re one of the oldest bug classes turned into exploits, but most operating systems today offer protections to reduce the severity.

The pre-boot environment of UEFI has no such niceties, making the attack simple and completely effective. HD Moore told Ars it could be used to break disk encryption for an attacker with short-term network access, and that it will likely be a “forever” bug living on in out-of-support systems. If this sounds familiar, it’s because PixieFail found a similar family of PXE bugs in the same EDK II network code in 2024, and, as Ars notes, the fuzzing projects that followed missed this one.

The disclosure was supposed to wait until January, but AMI published a pull request with the fix last month, and once the researchers noticed, TianoCore had little choice but to publish an advisory. If your machines boot only from local disks, you’re not affected, and that covers most home and small office systems. If you do use network boot, check with your firmware vendor, and consider turning off PXE booting where you don’t need it. Fortunately, this one is largely irrelevant for home users unless your network somehow gives direct access from the Internet to a server pre-boot environment, but it’s got potential to be a real issue for server hardware.
Certificate authority fallout continues

Last week we covered the eMudhra intermediate certificates whose private keys turned out to be tiny integers. This week, eMudhra announced that it is exiting the global SSL/TLS certificate business entirely. The press release insists the company “handled the recent incident diligently”, that its infrastructure was never compromised, and that TLS was only about 1% of revenue anyhow, but that “the level of social media amplification around this incident has brought scrutiny that is out of proportion.” Having your keys guessable by anyone with a few minutes of free time will do that.

Meanwhile, GoDaddy has self-reported to Mozilla that it couldn’t meet the deadline to revoke 404,607 certificates that didn’t match its own published certificate policies. The rules browsers and CAs agree to, the CA/Browser Forum “Baseline Requirements”, say a CA must revoke a mis-issued certificate within five days. GoDaddy managed to revoke 170,566 by the deadline, and about 227,000 a day later.

Mass revocation is genuinely hard: every one of those certificates is installed on someone’s server, and revoking it before it’s replaced breaks their website. That’s exactly why the browser root programs care so much about CAs being able to do it on time. Short-lived certificates, the kind Let’s Encrypt has been pushing for years, make this a lot less painful because a bad certificate expires on its own in days instead of months. We’ll be living the revocation long-tail experience with eMudhra certificates for years with devices which don’t, or can’t, check revocation lists for the long-running CA certificates.
Tailscale wormability

Tailscale and headscale, its self-hosted, open source control server, have become extremely popular. This is especially so in the maker and homelab world, where they are used for building private networks between devices. Under the hood, Tailscale builds a mesh of WireGuard VPN tunnels between every device, with a central control server deciding who can talk to whom. It also offers “Tailscale SSH”, which replaces the normal SSH server on a device and authorizes logins based on which device is connecting, rather than passwords or keys.

Erica Windisch of Cyberdione Labs has published a report called Tailworm detailing a series of findings in Tailscale and headscale. The most serious is in Tailscale SSH, which runs as root: socket forwarding requests are handled with root privileges and are subject to race conditions, letting an ordinary user with SSH access to a device replace or connect to privileged sockets (like the Docker socket or the init system) and gain root. Combined with capturing the keys used to enroll new devices, Windisch reports that a single compromised device could spread automatically to every device the access policy allows, at under a second per hop, with no passwords or stolen keys required. She also found an experimental app connector feature that can be used to reach destinations the network policy never allowed, including cloud metadata services that hand out credentials. And to top it all off, Windisch discovered unauthenticated memory exhaustion attacks against internet-facing headscale servers.

Notably, the researchers didn’t follow coordinated disclosure, arguing that “infrastructure is vulnerable today” and that rapid awareness will speed up fixes. Whether you agree with that or not (see the first story this week), the mitigations are practical: use per-device access rules for SSH rather than broad tag or group rules, disable SSH forwarding where you can, and expire node keys on servers. Fortunately it doesn’t seem like the bug is vulnerable to the Internet at large. A compromised device inside your Tailscale network could reach other devices in your network, but it won’t melt the Internet, yet.
A One-Byte Typo in Embedded TLS

FoxIO is back with three TLS bugs in GoAhead, a small embedded web server that runs the management interface on an enormous number of devices: routers, printers, firewalls, and industrial controllers from vendors including Palo Alto Networks, D-Link, HP, Canon, Honeywell, Siemens, and Rockwell.

The most severe (CVE-2026-115881, CVSS 9.1) is that GoAhead’s OpenSSL integration loads the configured certificate revocation list, but never actually turns on revocation checking, so revoked client certificates keep working, but the most fun is in the Mbed TLS integration: a copy-and-paste error passes the size of the one-byte Diffie-Hellman generator as the size of the 256-byte prime modulus. The result is a “2048-bit” key exchange using a prime of 255, which leaves exactly eight possible shared secrets. An eavesdropper can simply try all eight. (Clients like OpenSSL reject the broken parameters, but more permissive embedded clients happily accept them.) A third bug (CVE-2026-115884) lets an overly long certificate chain bypass a depth check when built against older LibreSSL. Feels eerily similar to the eMudhra one-number password, and the timing is spooky.

It’s a good reminder of Apple’s infamous “goto fail” bug in 2014, where a single duplicated line silently skipped certificate verification. Crypto code fails quietly: the handshake completes and everything looks fine. GoAhead 6.1.1 fixes all three, but for the hundreds of millions of embedded devices running it, the fix depends on every vendor shipping a firmware update, and on owners installing it. Which will surely happen rapidly and effectively, right?
Volt Typhoon’s Chain of Routers

Kim Zetter reports on new research from Lumen’s Black Lotus Labs into how Volt Typhoon, the Chinese state hacking group that US officials say has been “pre-positioning” inside American critical infrastructure, actually gets in and out.

Attackers rarely connect to a target directly from their own systems. Instead, they bounce through chains of compromised devices, often called “ORB networks” (operational relay boxes), so the traffic appears to come from somewhere innocuous. The sudden burst of news about Residential Proxy Network tools in the Spring and early Summer of 2026 could have been related: proxy networks provide a way to appear inside a country, or state, or even specific city.

Volt Typhoon’s version, which the researchers named Silent Train, is unusually disciplined: each chain of compromised servers, home routers, and IoT devices is assembled and used for a single intrusion, then dismantled and wiped. All this often in under two minutes, suggesting automation. Devices outside the US are never the same models as devices inside the US, presumably so no single vendor’s telemetry can see the whole chain. Targets included government agencies, defense contractors, telecoms, emergency communications, satellite operators, and energy, water, and rail operators, clustered in Hawaii, California, and Texas.

The chains included more than 27 classes of devices, including TP-Link and Netgear consumer routers, with a new device type added about once a month. Most of these were compromised through known, already-patched vulnerabilities. If you’ve got an old router or IoT gadget that hasn’t seen a firmware update in years, it may well have spent some time as a train car. Update it, retire it, or upgrade it with OpenWRT or another modern embedded distribution.
Discover-Tech and Starlink

Last week we talked about Citizen Lab’s research showing the Israeli ad-tech company Discover-Tech used targeted ads to deliver Candiru spyware. Gizmodo reports that the same company appears to be the top bidder for ad impressions on Starlink connections in 105 countries.

Research from TrendAI found an entity it labeled SHADOW-EARTH-79 won about 12% of ads shown to Starlink users, compared to a 3% baseline elsewhere, and over 80% of Starlink ad wins in Argentina, the Philippines, and Japan. It was also the top bidder in Syria, Libya, Yemen, and South Sudan, markets where, as TrendAI put it, “the demand for legitimate Western advertising in sanctioned or active-conflict states is effectively zero.” Reuters later reported that SHADOW-EARTH-79 was TrendAI’s internal name for Discover-Tech. The company spent about $109,000 on bids over four months with no recorded conversions, which is not how a business that wants to sell things behaves.

Real-time ad bidding shares device and location details with every bidder, whether they win the auction or not. Users of satellite internet are exactly who someone would want to locate in places where it’s restricted or politically sensitive, and the ad market will happily tell you where they are. Ad blockers continue to look less like a convenience and more like a necessity.
Quad9 leaves France

Quad9, the free, privacy-focused DNS resolver run by a Swiss nonprofit, is withdrawing service from France on November 24th, after losing a court case brought by the sports broadcaster beIN.

A DNS resolver turns names like “hackaday.com” into IP addresses. Quad9 doesn’t host any content, but the court ordered it to block resolution of domains beIN says are pirating its broadcasts, for users in France. Quad9 says it can’t comply: it doesn’t track who its users are or where they are, and the only alternatives are blocking the domains for the entire world, applying French law globally, or trying to geolocate users by IP address. It tried geolocation in a similar case brought by Sony in Germany, and was fined for contempt when Sony’s lawyers simply used a VPN. (Quad9 eventually won that case, after several years and six figures of legal costs.) With about 20 similar cases pending in France, it decided to leave.

As the EFF points out, none of this removes a single infringing website from the Internet; it just takes a malware-blocking privacy service away from French users, who can switch to another resolver in about thirty seconds. Making infrastructure providers act as copyright enforcement is a tool that’s very easy to repurpose for blocking other things. A net loss for Internet-savvy users in France, but kudos to Quad9 for standing up for principles.
Crime Stoppers Tips Leaked

The CBC has analyzed data stolen from P3, the tip management platform used by Crime Stoppers programs internationally, and found more than 1.5 million Canadian tips from the past 25 years. More than half contained personal information, including addresses, phone numbers, license plates, and banking details for cash rewards. Over 4,300 tipsters identified themselves by name, and even tips flagged by staff as having exposed the tipster were stored unredacted.

The data was stolen in March by a hacktivist group that said it wanted to disprove the platform’s claims of being “anonymous” and “secure”. After the CBC’s report, Toronto Crime Stoppers paused its program and at least six Ontario police services suspended their partnerships. Toronto’s chair, Sean Sportun, told the CBC, “It clearly seems that you have more data than us, which is a little concerning,” saying the platform’s owner, Navigate360, never provided the text of the stolen tips despite months of requests.

The most fundamental problem here may be retention. A system that promises anonymity kept 25 years of tips, including closed cases, in one place. The safest data is data that you don’t have.
DHS Employee Directory Leaked

WIRED reports that Distributed Denial of Secrets has published records on more than 41,000 Department of Homeland Security employees and contractors, including ICE and CBP. DDoSecrets says the data came from DHS’s Okta login system; Okta told WIRED it has “no evidence our data or systems were compromised.”

Beyond names, emails, and phone numbers, the leak includes over 55,000 access permission groups, which map out which people have access to which internal systems, including groups referencing certified undercover operations, wiretap programs, phone forensics tools, and AI services. A security expert quoted by WIRED called it “an extraordinarily valuable intelligence resource for those seeking to penetrate DHS”. Following ShinyHunters’ claimed theft of personal data on nearly every FBI employee, it’s been a rough autumn for federal identity systems.
FEC filing system knocked offline

The US Federal Election Commission took its electronic filing system offline a week before the November 3rd elections, after what an FEC filing officer described in an email seen by Reuters as “a bad actor attempting to breach FEC systems.”

The FEC doesn’t run elections, so there’s no impact on voting, but the outage blocks the 24- and 48-hour spending reports that show how much super PACs and other groups are spending on specific races in the final days. With the midterms already the most expensive US election ever, that’s a meaningful blind spot, at exactly the moment it matters most.
AI-orchestrated Bank Attacks

Last week we covered an attacker using a swarm of AI agents to break into websites. This week, Straiker published an analysis of CARLIY0S, a system it says the long-running CyberCartel group used to attack more than 400 financial targets across Latin America. CARLIY0S was built on PentAGI, an open source automated penetration testing framework, and assigned different jobs to different commercial AI models, including Kimi, Grok, and Claude. Four Claude-based roles were set up to evaluate attack options, debate targets, and return a decision through a designated “arbiter”.

According to Straiker, the group got around model safety policies by framing requests as authorized red team work or capture-the-flag exercises, and even instructed the models to never output the group’s name to frustrate attribution. Straiker says it accessed the group’s stolen credential database, with thousands of records including API keys, database credentials, JWT signing keys, and backdoors. Anthropic has since revoked the credential the group used to reach Claude, and xAI is investigating.

The “it’s just a pentesting tool” defense is going to get a lot of use in the coming years. Automated offensive frameworks are genuinely useful for defenders, and unfortunately also genuinely useful for anyone else who can convince the model they’re a defender.
Bulletproof Hosting Seized

The DOJ has seized the domain of Virtualine, a “bulletproof” hosting provider. Bulletproof hosts sell servers and domains to criminals with the explicit promise of ignoring abuse complaints and law enforcement requests, and they’re the plumbing behind a lot of phishing, malware, and spam.

Virtualine wasn’t subtle about it. According to the DOJ, it advertised on cybercrime forums that customers could use it “for all illegal/black hat activities (including phishing, carding, email spam, port scanning and all others)”, offered an “additional protection plan” that would move a customer’s infrastructure to an unaffiliated shell company after a law enforcement request, and bragged that it “ignored more abuse than your last three therapists.” Despite a supposed ban on child abuse material, it continued hosting a site selling exactly that after repeated notices from law enforcement in multiple countries. Marketing copy is evidence, it turns out.

hackaday.com/2026/10/30/this-w…

A practical pentest workflow combines CVSS, EPSS and business ...

2026-10-30T12:06:39Z

A practical pentest workflow combines CVSS, EPSS and business impact to validate findings, prioritize fixes and document remediation decisions. Remediation prioritization after a pentest is the process of ranking and ordering security findings based on their risk, exploitability, and business impact. A penetration test can produce any number of findings, ranging from the very low […]
How to prioritize remediation after a pentest: a practitioner workflow - Security Affairs

Microsoft Teams sotto attacco: falsi tecnici IT sfruttano le chat ...

2026-10-30T11:55:19Z

Microsoft Teams sotto attacco: falsi tecnici IT sfruttano le chat esterne per violare le aziende

nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqvje76wq7e5kh9x2c0cggcmymz5408yw8lxxhtpy6v0cdwfu2c9asanfwcg (nprofile…fwcg)
Oltre 400 incidenti analizzati da Arctic Wolf Labs mostrano come i cyber criminali sfruttino le chat esterne di Microsoft Teams per impersonare il supporto IT e ottenere accesso ai sistemi aziendali. Tra mail

The Sounds of the World, One Random Album at a Time In the ...

2026-10-30T11:00:55Z

The Sounds of the World, One Random Album at a Time

In the streaming era it’s easy to forget that there’s still a lot of stuff being broadcast over the radio for anyone who cares enough to dial in their receiver. Give me an antenna big enough and a tower on which to place it, and I shall listen to the world.

Of course, so you can’t actually listen to everything being blasted out all over the planet yourself. But if you’d like to at least have a little taste, check out Impermanence Series A — a project by [Sam Scorsby] that randomly combines bits and pieces of audio pulled down from shortwave and FM broadcasts with some web streams, live microphones, and even a bit of the Internet Archive each day into a one of a kind album. We’re not sure we’d call it music, exactly. But it’s certainly fascinating to listen to, a bit like randomly spinning the dial on a planet-wide radio receiver.

[Sam] has shared the Python scripts that pull together each day’s album, and he’s not shy about the fact that the project was created with the help of artificial intelligence tools. In fact, that’s sort of the point. [Sam] puts himself somewhere in the middle when it comes to the current debate over AI, and acknowledges that while computers are good at processing raw data, it still takes a human touch to put it all into context.

So each day [Sam] will listen to the latest computer-generated album and pick his favorite tracks, and once the project has run its course, he’ll put together a human-curated “Best Of” collection. Man and machine working together, each doing what they do best.

We know something of opinionated folks on the Internet, and our experience tells us that Impermanence Series A is unlikely to change anyone’s minds when it comes to AI. But we do appreciate the thoughtful approach [Sam] has taken with the project, and look forward to hearing what he comes up with in the end.

hackaday.com/2026/10/30/the-so…

Premiazione Di Corinto alla Terni Digital Week Voglio ringraziare ...

2026-10-30T09:45:04Z

Premiazione Di Corinto alla Terni Digital Week

Voglio ringraziare gli organizzatori della Digital Week di Terni per avermi voluto consegnare una premio con bellissime motivazioni.

“Per il contributo straordinario e pionieristico alla diffusione della cultura della cybersicurezza, della privacy e dei diritti digitali in Italia. Per la rara capacità di coniugare il rigore dell’analisi accademica, l’efficacia della divulgazione giornalistica e la visione strategica al servizio delle istituzioni nazionali”.

Sono stato sempre diffidente nei confronti delle premiazioni, soprattutto quando coinvolgono sponsor, partner e investitori.
Adesso che è toccato a me, devo rivedere questa diffidenza originaria, anche perché mi ha fatto scoprire delle persone molto belle e un evento, la Terni Digital Week che è stato tosto interessante perché ha avuto come protagonisti i giovani che ho ascoltato con interesse e mi hanno stupito per consapevolezza delle tematiche di cybersecurity e dell’innovazione tecnologica. Molto bella la sessione sul gaming.

Grazie al presidente, grazie al mio presentatore Daniele Ballo e a tutti gli amici presenti. Grazie a Dipartimento per la trasformazione digitale Parlamento europeo in Italia ad AGID – Agenzia per l’Italia Digitale e tutti gli enti territoriali.

Mi auguro di meritarlo anche nel futuro.

dicorinto.it/formazione/premia…

Criptovalute. Saccheggiata la cassaforte Binance, cyber colpo da ...

2026-10-30T08:47:27Z

Criptovalute. Saccheggiata la cassaforte Binance, cyber colpo da 6 miliardi di dollari

nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqvje76wq7e5kh9x2c0cggcmymz5408yw8lxxhtpy6v0cdwfu2c9asanfwcg (nprofile…fwcg)
Saccheggiato il gigante delle criptovalute Binance con un colpo da 6,3 miliardi di dollari. Congelati circa 3 miliardi La principale piattaforma mondiale per l’acquisto, la vendita e lo scambio di criptovalute Binance è stata colpita da un

Snake On a Seven-Segment Display is Gloriously Bad You’ve no ...

2026-10-30T08:00:20Z

Snake On a Seven-Segment Display is Gloriously Bad

You’ve no doubt heard the saying, “If something is worth doing, it’s worth doing well.” But there’s actually a counter-perspective to this particular philosophy that says it’s also worth doing things badly, with the general idea being that even a semi-successful attempt at something is better than no attempt at all.

We’re not sure if that’s the principle [José Luis Monteiro] and his father had in mind while working on a way to play the classic Snake on a seven-segment LED display salvaged from an old DVD player, but surely the end result is the same. It’s not so much that the display isn’t a good fit for the eponymous snake, in fact, it actually makes a strange amount of sense. Each of the segments can stand in for a piece of the ever-growing serpent, and they’re already arranged in a roughly rectangular grid that makes moving around straightforward enough.

The issue is that the resolution — such as it is — of the display it pretty unforgiving for anything else. Namely, the “food” that your sake is after is naturally identical to one of its own segments, so it doesn’t take long before it’s all rather confusing visually. But in those brief opening moments, it actually works pretty well.

Even if you’re not interested in Snake, between the documentation, source code, and the video below, this project is a great primer on reverse engineering these types of displays. With a microcontroller, a datasheet, and a bit of patience, you could put together an unattractive and frustrating gameplay experience of your very own! If that’s not the dream, what is?

youtube.com/embed/3hOSXTLOnHo?…

hackaday.com/2026/10/30/snake-…

A hacker leaks personal data on more than 40,000 DHS employees, ...

2026-10-30T06:26:27Z

A hacker leaks personal data on more than 40,000 DHS employees, including CBP, ICE and CISA staff, after an undisclosed breach. Personal details of thousands of U.S. Department of Homeland Security (DHS) employees are now online after a hacker stole reams of data in a data breach that occurred earlier this year and nobody had […]
Hacker leaks data on more than 40,000 Homeland Security employees

Is This The Only Instrument You Need? When working on an ...

2026-10-30T05:00:10Z

Is This The Only Instrument You Need?

When working on an electronic project it’s likely you will find yourself working with a variety of different instruments, be they logic analysers, oscilloscopes, or whatever. These can take up a lot of space, not to mention cost a bundle of cash. [Max.K] came up with PicoLab as a solution, it’s an all-in-one box containing a 4-channel oscilloscope, 8-channel logic analyser, GPIOs, a data logger, and serial, SPI, and i2C interfaces. There’s even an adjustable power supply!

Behind it all is an RP2350, in its larger package with more pins, coupled to some custom interface and protection circuitry. Perhaps the cleverest part is its interface, which it serves as a web site on the network card it exposes through the USB port. Any OS that supports a web browser and USB networking can thus use this thing. You can find all the code in a GitHub repository, should you wish to have a go at building one yourself. We like this idea.

hackaday.com/2026/10/29/is-thi…

Putting a MiSTer Marquee on a Better Display Some MiSTer users ...

2026-10-30T02:00:00Z

Putting a MiSTer Marquee on a Better Display

Some MiSTer users put a small secondary “marquee” display on the FPGA board that can show information about the system such as the currently loaded core and what game it happens to be running. Generally these take the form of a small monochrome OLED display, likely the one most of us have sitting in a parts bin somewhere.

But [Erico Mendonca] wanted a something with a bit more style, so he’s come up with a firmware for the ESP32-C3 that connects to MiSTer’s existing secondary display protocol but works with slightly more visually impressive panels such as the round GC9A01 that so many hackers have been playing with as of late. If the whole circular display thing isn’t your…thing, you can even run the firmware on the Cheap Yellow Display for a turn-key rectangular experience.

Because [Erico] didn’t want to fiddle with anything on the MiSTer side of the equation, his firmware has to do the heavy lifting when it comes to the art that shows on the display. So there’s a web-based editor that lets you put together your own artwork to show on the marquee based on what command the MiSTer has actually sent out. Flashing the firmware on the ESP32 can be done through the browser as well, as is becoming increasingly common these days, making it relatively easy to get this project up and running.

With this project it’s also possible to control multiple client displays over WiFi from one system, just in case you wanted to show off what console you were booting up in multiple places.

We’re fans of the round display here at Hackaday, so it’s been great to see more folks putting them to use as of late.

youtube.com/embed/vCht3E33k4c?…

hackaday.com/2026/10/29/puttin…

Replicating the Color-Changing Effect of the Lycurgus Cup ...

2026-10-29T23:00:39Z

Replicating the Color-Changing Effect of the Lycurgus Cup

Although most archaeological finds from ancient civilizations aren’t quite as exciting as what you might expect from the movies, occasionally you come across something that’s truly special. The Lycurgus Cup is one of those, with the 3rd or 4th century CE glass cup and its incredible detail surviving likely because it ended up in church treasuries after the fall of the Western Roman Empire. Now its almost magical dichroic glass effect has been recreated in a modern take by researchers at the University of Sheffield.
The Lycurgus cup with light shining through it. (Credit: Chappsnet, Wikimedia)
Dichroic glass takes on a different color depending on the lighting conditions, with the Lycurgus cup appearing to be green glass when lit from the front and red when light passes through it from behind. This serves to give the portrayed scene – of the demise of King Lycurgus from Greek mythology – an extra boost with the right lighting.

The cause of this dichroic effect in this ancient marvel of glass work was unknown for the longest time, but research on a fragment of the glass revealed that it contains nanoparticles of both gold and silver. Since then a number of researchers have recreated this dichroic glass, with [Lars Kool] et al. using FDM 3D printing to create objects embedded with the same nanoparticles that also display this effect.

Where this work by the University of Sheffield differs is in that it creates the effect not only in glass, but also creating a piece of art in the form of a modified Atlas statue to use it. The resulting dichroic effect is rather similar, which isn’t too shocking since unlike over 1,600 years ago we can now literally see and measure nanoparticles in glass, while adding exact amounts of each to pure glass.

Here’s to raising a dichroic glass cup to bridging the millennia with recreated luxury glass recipes.

hackaday.com/2026/10/29/replic…

Binance probes suspicious crypto transfers worth up to $5.8 ...

2026-10-29T22:53:27Z

Binance probes suspicious crypto transfers worth up to $5.8 billion as Tether and Circle freeze $1.79 billion in stablecoins linked to the activity. Binance is investigating a potential security incident after billions of dollars in cryptocurrency moved from wallets linked to the exchange on October 29. The transfers raised concerns about a possible hack, while […]
Binance Investigates Suspicious Crypto Transfers Worth Up to $5.8 Billion

The Pentagon treats August freezer failures at US military bases ...

2026-10-29T21:58:38Z

The Pentagon treats August freezer failures at US military bases as a suspected hack and is working with French investigators after a supermarket attack. The Pentagon is investigating freezer failures that spoiled food at US military bases in August as a suspected cyberattack, according to four officials who spoke to Reuters. One official said US […]
US Probes Suspected Hack Behind Military Base Freezer Failures - Security Affairs

An Attempt at a Useful Desktop OS For Microcontrollers We’re ...

2026-10-29T20:00:12Z

An Attempt at a Useful Desktop OS For Microcontrollers

We’re living at an interesting time here in 2026, when microcontrollers are becoming powerful enough to surpass the capabilities of “real” computers from a time when those real computers were starting to become useful. We’ve seen plenty of microcontrollers emulating machines from the 1990s, but what if instead they were giving all their power to the OS? It’s a question [Thomas] is trying to answer with SylphideOS, a general purpose GUI operating system aimed at multiple microcontroller platforms.

On the surface it has a GUI that appears to owe a lot to the early Macintosh machines, but underneath it has the FreeRTOS kernel, something that has been around for quite a while. You can argue among yourselves as to whether this make it an OS in its own right or a FreeRTOS distro. Aside from driving a screen through a framebuffer it also has the hardware interfaces you’d expect, for keyboard and storage. There’s support for RP2350 and selected ESP32 platforms so far, as well as an emulator.

We have already seen a few operating systems for microcontrollers that provide a user interface for a binary bootloader rather than persisting under whatever programs are running, so this marks an interesting departure. Only time will tell if it becomes a success, but perhaps it’s one to watch.

hackaday.com/2026/10/29/an-att…

42 publicly listable cloud buckets containing 18 billion files, ...

2026-10-29T18:43:01Z

42 publicly listable cloud buckets containing 18 billion files, including exposed credentials, database dumps and backups. The Ransomnews research team counted 484,142 publicly listable cloud storage buckets in October 2026, holding 18.05 billion files. They built the count from the search engines that index open cloud storage and published it as the Ransomnews Cloud Exposure […]
484,142 Exposed Cloud Buckets Contain 18 Billion Files - Security Affairs

2026 Hackaday Supercon: All the Speakers! We announced our first ...

2026-10-29T17:00:13Z

2026 Hackaday Supercon: All the Speakers!

We announced our first round of speakers, and then the workshops, and we were going to dribble out updates on the rest of the speakers as they came in, but then time slipped away from us. So we are left here announcing a veritable cornucopia of twenty wonderful talks that you absolutely won’t want to miss.

Supercon is just about a week away, and there are still a few tickets left, so grab them now before it’s too late.

And the talks are just half the fun. Between food, merriment, a killer badge with the biggest e-paper display that you’ve ever seen, and all the assorted shenanigans, it’s the highlight of our hacking year. Come join us!

Adam Batori and Kevin Colley
Rare Circuits: How we Used and Abused a $1 MCU to create the Aerospace Village Radio SAO

Software-Defined Radios have evolved from once being exquisite lab equipment to now an affordable tool accessible to hobbyists, thanks in large part to projects like HackRF and the $40 RTL-SDR. That got us thinking, are there any existing RF chips we could repurpose to make an even simpler and lower-cost SDR?

This talk dives into how we reverse-engineered the black box of the $1 TI SimpleLink Wireless MCU’s RF subsystem, and jailbroke it to unlock additional RF modes and custom protocols. We will demonstrate how we are able to receive analog AM, FM, and even raw IQ samples on this supposedly “digital RF” MCU, and developed our own tools to gain further insight into how the radio operates. Putting these capabilities together, we recount how we leveraged all of this to create the “Charlie” radio SAO for Aerospace Village and made it receive analog airband, stereo FM, UAT, and more! We also demonstrate how we made our unassuming SSD1306 OLED produce 4-level grayscale with perfect VSync, and the silicon-level hacking it took to pull it off!

Adriel Bustamante
Rover Tracks: A Retrospective on the Open Source Rover and What’s Next

The Open Source Rover has taken on a new life ever since the v2 release three years ago. In that time, I’ve joined the community of rover builders and become a maintainer on the project myself, doing outreach at community events and development work on the rover where I can.

In the time since I’ve been a maintainer, I’ve learned quite a few lessons about the practical and philosophical aspects of engineering for a project like this. I hope to be able to share some of what I’ve learned (changes I’ve had to make to my rover, improvements that can be made, what it’s like to be “the rover guy” at Maker Faire), and what comes next for both my own rover and the project at large.

Alley Cat
Designing Devices: Not Just PCBs in Boxes

PCBs and their enclosures are often designed as separate things, but the best results come from designing them together. This talk covers practical considerations to design boards with the final device in mind, account for the differences between CAD models and real hardware, and create enclosures specifically for FDM 3D printing. We’ll look at real-world tolerances, connector placement, production variance, clearances, overhangs, extrusion widths, layer heights, and other small details that can make the difference between a design that looks right in CAD and one that actually fits together.

Ames Evans
Blinkenlights That Remember: The Unsigned Firmware on your PC’s RAM

The RGB glow on your sick gaming PC comes from somewhere, and that somewhere is a microcontroller controlled by a program and a kernel module that the manufacturer ships. But if your vendor’s app can push a new lighting style to that microcontroller, why not a whole new firmware update? Is there anything actually stopping arbitrary firmware from being written to your RAM’s RGB controller?

I went looking for answers with Ghidra and my RAM’s onboard controller will happily accept and run firmware of my choosing, and I can make it do basically whatever I want. I will demonstrate a few of these possibilities live.

Andrew Denio and Danner Cronise
How to Rob a Bank Without Really Trying

Have you ever wondered how exploding bank dye packs work? During this talk, you will learn all about how banks utilize embedded electronics to either track or paint bank robbers. Using equipment purchased from auctions, MakeItHackin and Danner Cronise will cover the electronics hidden in stacks of cash, the various equipment inside banks to trigger a remote detonation, and how these electronics have evolved over the decades.

Can these protective measures be foiled… find out during this exclusive Supercon talk.

Ashleigh Pomerant
No Refresh Button: The Case For (and Against) Putting a Browser on Your Device

A user interface running in Chrome on a Raspberry Pi looks like any other web app from the outside. Underneath, most of the usual assumptions start to fall apart. This talk covers what actually changes when you ship on a device instead of a server: hardware owns the state, WebSockets replace REST because screen updates are often triggered by hardware sensors, and both memory and CPU limits become a real constraint.

It also covers why the trade is usually still worth making. The upside is options: rendering and layout are handled for you, there’s a library or a pattern for almost anything you need, and a large community to ask when something breaks. See this all come together in a device that uses RFID for input.

GC
EDA for Everyone: PCB Design in the Agentic Era

What if ANYONE could ship hardware? What if that what-if wasn’t a what-if? Find out how the next wave of open-source design software puts the power to create in your hands. (Editor’s note: this talk contains parody and hacks in about equal measure.)

Eric Hall
LoRa and Beyond

This talk explores building a small ground station for receiving LoRa satellite communications with affordable parts and custom made antennas. This project was built from the ground up without using existing frameworks like tinyGS.

Baird Bankovic
Achieving Quality Photoresist Uniformity on Asymmetric Substrates

The most popular method for fabricating nano-scale structures is with photolithography. The first step in any photolithography process is to coat a thin, uniform coating of photoresist on the substrate. Typically this is spun on, however if the substrate is not rotationally symmetric, strong edge effects can hurt thickness uniformity. I present a few different methods for increasing uniformity of photoresist coating. In particular increased uniformity on the silicon substrates (50mm x 100mm x 30mm) from 12% to 1%, which is close to industry standard uniformity on wafers. I will discuss various other photoresist coating techniques for oblong substrates as well.

Henry Amador
Beyond the Breadboard: Bringing PCB Fabrication into the Makerspace

This talk explores an in-house PCB fabrication workflow developed for a university makerspace that uses a fiber laser to selectively ablate copper from PCB blanks.I’ll share how the process was developed, what was learned along the way, and how access to rapid PCB fabrication has expanded what students can design, build, and iterate on during their engineering courses.

Joe Needleman and Dex
HM and I (Down the Rabbithole of Human Machine Interfacing)

This talk is for anyone who loves tactile inputs and physical controls, whether they’re on the big screen or in real life. We will be talking about human-machine interfaces (HMI for short), have evolved, and how fictional and real systems have shaped each other along the way. We’ll walk through three of our own designs, each with a distinct purpose. Every one is a real build, so we’ll cover the whole design, from hardware planning, firmware, and even the software that connects a computer to the machine interface. Finally, we’ll look at the future of HMI design and the growing role Agent-to-Agent (A2A) AI now plays in designing control systems.

John Zhang
How many neurons does it take to pump a swing?

Back in 2020, I became interested in applying reinforcement learning to teach a robot how to pump a swing, inspired by the Cook’s paper “It takes two neurons to ride a bike” and YouTube videos of gymnastic robots by Hinametetu. It’s an elegant toy problem with beautiful nonlinear dynamics and it turns out you can get away with just one neuron using a Q-learning approach. Now, in the blistering, chaotic summer of AI, it’s seems like an appropriate time to revisit this idea and ask what we can learn from this simple toy example for building physical intelligence.

Kaveh Pezeshki
The Hardware of Superconducting Quantum Computing

Superconducting quantum systems represent a new frontier for quantum simulation and computation. In this talk, I will discuss the technologies and hardware behind these systems – what is a transmon qubit? how do we control and measure its state? As the field is so new, much of what we use is adapted from technologies hardware hackers are familiar with. This talk will emphasize how we adapt and use common equipment for quantum measurement and control.

Kerry Scharfglass
How to Make and Have Feelings

Touch is an integral part of our lives, but how does it work? It’s easy to say “your skin senses pressure” but it can also tell you about things like the grain of a piece of wood, or that an animal’s fur is soft. The biomechanics of touch are a fascinating and complex topic without wide understanding. In this talk we will peel the covers back by discussing science’s current understanding of the collection of systems the human body uses to feel, and how it can infer things like texture from those rudimentary signals.

Expect to learn about how amazing our biological systems are, and how you can leverage that in different ways give people different haptic experiences.

Lily Gabriel
Spinning E-textile Yarns

This talk will be about e-textile materials and how to make your own when you can’t find commercially available options. E-textile materials include conductive thread, yarn, fabric, and wool roving, but these are hard to find from reliable sources (especially if you are a hobbyist maker and not looking to buy in bulk.) Methods I will be covering in the talk include hand-plying, drop spindle plying, core spinning, and supercoil. Hand plying is taking a single strand and introducing additional twist into it, then folding it in half and letting it twist back on itself. Drop spindle plying is similar, but using a weighted spindle to add more twist in less time. Core spinning is taking an overspun single and wrapping it with wool roving in the opposite direction. Supercoil is similar to core spinning, but instead of wool roving, another overspun single is twisted around a core.

Ryan Mast
The Perfect BLEnd: Reverse Engineering a Bluetooth-Controlled Smart Blender for Better Smoothies

Have you ever gone to make a smoothie, only to have the blades spin fruitlessly while the fruit sticks just out of reach on the walls of the cup? I’ve wrestled with a “smart” blender over this and other issues on many occasions, often resorting to tossing the single serving cup to dislodge stubborn pieces of fruit. Or perhaps you have another smart device that one day stops working because the vendor decided to stop updating the app for newer phones.

In this talk, I’ll share how I learned to reverse engineer BLE devices in order to control the exact settings used by the blender, including initial failures and how I overcame them — along with quickly creating an alternative for controlling the blender when the app stopped working after an iOS update. And in the end, we’ll create a custom blending profile for the perfect blend!

Sage Cadence
How to build things that people care about in the age of AI

In today’s age of abundant information, anyone with a computer can build and anyone with an opinion can make it known. How do you filter out the noise to build something that people actually care about? Learn how to combine the mental frameworks of engineer and a storyteller, cutting through the clutter and creating things that truly matter.

Sarah(í) Alvarez
Finding a Loop: Creative Uses for e-Waste

Artists, makers, and engineers must begin to explore creative, non-industrial approaches to managing e-waste. This talk chronicles experimentation with a niche source of e-waste – one record label’s backlog of unsellable compact discs. Learn about the mid-2010’s enthusiasm for recycled CD filament, the benefits of salvaged metal foil, and embracing the chaos of creative re-use.

Sher Amir Dullat
StageReady: a standalone, portable device for natural, studio grade vocal pitch correction in real time

We all love singing, but at some point we also realize that perhaps the performance sounds better inside our own heads than outside it. If there were a tool to bridge this gap, it would surely appeal to just about everyone. That tool does exist, it’s real-time pitch correction. So why are we all not carrying our own personalized pitch corrector with us?

Currently, real-time pitch correction requires studio grade hardware, but we create a real-time auto-tuner that can be personalized to a singer’s voice while pitch-correcting under real-time latency constraints on an edge device.
It does so by separating the voice into two parts: the resonant character that makes each person sound like themselves, and the underlying vocal source that sets the note. It corrects only the pitch, while a neural network running on chip’s AI accelerator rebuilds a natural, breathy vocal source at the corrected pitch.

Stephen Farnsworth
Secrets of Ghidra: Reverse Engineering Proprietary Smart Home Sensors

After digging some old sensors from a security system I had out of a bin to integrate with Home Assistant, I realized several of them used a proprietary protocol used by a system I no longer used. Fortunately, a fellow enthusiast and tinkerer had just recently discovered you could dump the firmware of the humble TI MSP430 based device. That’s when I decided to dust off Ghidra and try to figure out what this device was doing.

Along the way, I’ve learned some great lessons on how to use the tool Ghidra to decompile monolithic microcontroller firmware. In this presentation I’ll share my journey with the tips that I wish I known before I started. For example, to understand the firmware, you need to pull resources from anywhere you can and look at the device as a whole to understand the inner workings. As a result, I was able to crack the protocol and give new life to hundreds of dollars of sensors that would still be collecting dust in a bin.

[If you read this far, you probably want tickets. Just sayin’.]

hackaday.com/2026/10/29/2026-h…

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds ...

2026-10-29T16:05:56Z

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Linux Kernel and Broadcom VMWare ESX flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Linux Kernel and Broadcom VMWare ESX vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Below are the flaws added to the catalog: In July, Broadcom released patches to address […]
U.S. CISA adds Linux Kernel and Broadcom VMWare ESX flaws to its Known Exploited Vulnerabilities catalog - Security Affairs

Rapporto Clusit 2026: il cybercrime mette sotto pressione le ...

2026-10-29T15:49:27Z

Rapporto Clusit 2026: il cybercrime mette sotto pressione le imprese

nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqvje76wq7e5kh9x2c0cggcmymz5408yw8lxxhtpy6v0cdwfu2c9asanfwcg (nprofile…fwcg)
Il Rapporto Clusit di ottobre 2026 censisce 4.911 incidenti gravi nel mondo e 245 in Italia. Nel Paese cala l’hacktivism, il cybercrime torna prevalente e il manifatturiero è il primo bersaglio: continuità operativa e sicurezza dei fornitori diventano priorità

Robot Picks up Othello Experience is a great teacher. Ask ...

2026-10-29T15:30:47Z

Robot Picks up Othello

Experience is a great teacher. Ask [Jeneus], who, in high school, tried to make a program that played Othello. It didn’t go well. But years later, the idea produced an impressive Othello robot. At first glance, the robot looks a bit like a 3D printer with an aluminum extrusion XYZ motion system. But there’s a lot more to it, not to mention the software to play the game. Check it out in the video below.

The Z-axis has a vacuum system that can pick up clear tokens and place them on the board. If you know the game, you might remember that on a real board, players have to flip the tokens as they “capture” pieces. The robot has a smarter way to go. The tokens are clear because they are lit with one of two colors. So flipping the token is a simple LED color change. The LEDs also flash a different color to show you where you can move.

The device uses laser-cut components and 3D printed parts in PLA and TPU. Of course, there is a camera for the computer — a Raspberry Pi — to see the board. Overall, a very nicely done project. We’ve seen several checker and chess robots. We wonder if some of them could also play Othello?

youtube.com/embed/wD_IwXLhONk?…

hackaday.com/2026/10/29/robot-…

Exploring What’s Left of Google’s VR Dreams You’re likely ...

2026-10-29T14:00:45Z

Exploring What’s Left of Google’s VR Dreams

You’re likely familiar with Google’s Cardboard, and the legions of cheap virtual reality headsets it spawned. By sticking a smartphone to the wearer’s head, all these headsets needed were some basic optics to provide a surprisingly effective VR experience. You may even know about Google Daydream initiative that came a few years later, which not only improved the basic Cardboard design but brought with it new software features such as VR-specific improvements to the Android operating system and a version of the Play Store dedicated to 3D games and applications.

But unless you’re a true Google devotee, what you may not know is that the search giant partnered with Lenovo to produce a stand-alone Daydream headset called the Mirage Solo in 2018. A full year before the Oculus Quest hit the market, the $399 device combined the guts of a smartphone with a 2560×1440 display running at 75 Hz, a pair of cameras in the front that let it see the world around the user in three dimensions, and a gyroscopic handheld controller to provide an immersive VR experience without having to be tethered to a computer. In addition to the standard consumer version, there was even a “Business Edition” of the headset specifically marketed to schools, offices, and hospitals as a way to deliver VR content without having to invest in any additional infrastructure.

So why isn’t the Mirage Solo better known? Because in classic fashion, just a few years after it was released, Google decided they were no longer interested in virtual reality and shuttered the entire Daydream program. The software components it introduced were stripped out of Android, the 3D Play Store was taken down, and the back-end mechanisms necessary to register new headsets were turned off. Almost overnight, the Mirage Solo became a stereoscopic paperweight.

Or at least that was the official story, anyway. I recently came across a Lenovo Mirage Solo at a thrift store for $25, and despite my initial Internet searches strongly indicating that it would probably be worthless, it seemed worth the gamble to find out for myself.Know Before You Buy

Usually I’d just jump into the cool stuff, but I think in this case it’s probably wise to get some details clear before continuing. There’s a good chance that some of you may decide to pick up a Mirage of your own after reading this, or perhaps you’ve already got one and wandered in from an Internet search. However you’ve come to read this article, I don’t want to give you the wrong impression about the realities of the situation.

So let’s start with the most important thing: do not buy a Lenovo Mirage Solo unless it has the motion controller! I really can’t stress this one enough, as to my knowledge, there is no way to navigate the UI of the Mirage without it. Many of the cheap units you’ll find on the second-hand market are only priced that way because the controller is missing, so be careful. If you’re wondering, the controller doesn’t need to be the original one that was sold with the Mirage for it to work, but spare controllers are understandably in high demand and are usually priced accordingly.

The second thing to remember is that Daydream is a dead platform, and the software running on the Mirage is now at least six years out of date. Anything that still works on it only does so because whatever upstream service or API it relies on hasn’t yet changed enough to break anything. As of this writing, I personally believe enough of the software still works to make the Mirage worth picking up if you can get a good price on one, but that’s not necessarily going to be true forever.
Escaping Captivity

Alright, let’s assume you’ve just pulled a brand new Lenovo Mirage Solo out of the box in 2026 and want to use it, what does that look like?

The first time you boot it up, you won’t get very far. After it asks you to connect the controller and does some internal housekeeping, you’ll be presented with a dialog that walks you though connecting to a WiFi network and adding it to your Google account. Unfortunately, this process will never complete because Google has flipped some switch on their end — although you wouldn’t know it on the device, as the only feedback you’ll get is a pop-up message advising you that there’s been an unspecified problem and that you should try again later.

Thankfully, somebody over at Google left us a backdoor. If you click on the four corners of this dialog, starting with the top-left and working clockwise, you’ll be able to bypass the provisioning process. After some more loading and a bit of a tutorial about using the controller and navigating the user interface, you’ll be facing (literally) the next problem.

hackaday.com/wp-content/upload…

You are standing in an open field west of a…wait, no. Sorry that’s something else. You will be in a virtual forest though, and if you look around you’ll see waterfalls, a winding stream, and birds flying around.

It’s all very slick, but the thing we’re mainly worried about right now is the huge message in front of us saying the system can’t connect to the internet. What’s actually happened is that the system can’t connect to the mothership because the Daydream API has been turned off, but apparently there was no canned error message to convey that condition so this is what we get.

But again, the developers at Google have provided us a way forward. If you navigate to the settings screen there is an option for Beta Features, and underneath that section you’ll find an entry that says Access 2D Apps. Once you select it you’ll be warned that the behavior of standard Android applications in Daydream may be unpredictable, and the Mirage will reboot.

This is where things start to get interesting. Once the headset restarts there will now be a new tab in the application launcher labeled 2D, and under it you should see an icon for the standard Play Store. Once you go into the settings and add your Google account, you’ll be able to browse the Store and download whatever games or applications you want — so long as they don’t mind running on Android 8.0, anyway.
Android Apps…in Space!

Gaining access to standard Android applications opens up a huge world of possibilities. While the older hardware of the Mirage Solo and the outdated OS means you won’t necessarily be able to run the latest and greatest pieces of software, there’s still a lot you can do, from watching Netflix to working with spreadsheets in Google Docs and connecting to your Linux box over SSH. The on-screen virtual text input is good enough for simple tasks, but connecting a physical keyboard over USB or Bluetooth makes the whole experience vastly more enjoyable.

When running 2D applications in Daydream, they will appear as a giant display floating in front of you. Some of the apps will only work in portrait mode as if they think they are running on a normal phone, but in most cases you can grab the corner of the window and stretch it out into a landscape orientation that better fits the fairly impressive field of view offered by the Mirage.

The only real issue with using 2D Android apps on the Mirage is how simplistic the window management is. You can move the window and resize it, but there’s no provision for having multiple windows open at the same time. In fact, under normal circumstances there doesn’t even appear to be a way to switch between running applications without having to go all the way back to the main menu — although I did discover that when you have a physical keyboard connected you can use Alt-Tab to bring up the stock Android task switcher, which helps.
Entering the Third Dimension

At the start of this article I explained that the 3D Play Store was shuttered, and with it, all the games and applications that were actually designed to take advantage of virtual reality. But as we all know, nothing is every really gone on the internet, and thanks to some dedicated fans at the Opendream project, much of the Daydream software has been preserved and can be installed on the Mirage.

I’ll leave exploring the catalog of available Daydream software as an exercise for the reader, but at the very least you should install Firefox Reality. It’s not only a far more capable browser than Android’s stock version of Chrome, but it’s an excellent example of how immersive Daydream could be when the software took advantage of the platform.

The browser still shows up as a giant floating display, but now you’ve been transported into a darkened environment and have far better control over how everything looks. It also features a far more pronounced 3D effect, with pop-ups that actually hover over the page, and a 3D render of the remote that moves around in space in front of you as you swipe around the pages. There’s even support for curving the entire display, which makes for a very unique browsing experience.

Speaking of a unique experience, I’ve saved my absolute favorite for last — YouTube VR. It’s so well implemented and immersive that I’ve actually watched whole movies with this thing on my head. While there’s plenty about Daydream that clearly needed some more time to cook, Google really pulled out all the stops for this one.

hackaday.com/wp-content/upload…

Everything works as you’d expect, including 360 degree videos and even purchased content that’s attached to your Google account. At least for me, I’d go so far as to say that the experience is good enough that it’s worth getting a used Mirage Solo just for watching YouTube alone.
Nothing Lasts Forever

As I said at the start, it’s important to understand that the Lenovo Mirage Solo still having any sort of functionality in 2026 is something of a fluke. It’s supposed to be a dead product, and neither Google nor Lenovo want anything to do with it. There are no updates coming, no tech support, and no warranty.

At any moment, the YouTube API could make some kind of breaking change, or your favorite apps might get an update that prevents them from working on such an old version of Android. You’d be absolutely crazy to buy this headset at anything near its full retail price.

That being said…if you can get a good deal, and by that I mean certainly under $100 and closer to $50 – $70 USD, I think there’s enough life left in the device to make it worth picking up. If you end up getting one and doing something cool with it, I’d love to hear about it.

hackaday.com/2026/10/29/explor…

An AI Chatbot for the Apocalypse You don’t have to be a full-on ...

2026-10-29T11:00:01Z

An AI Chatbot for the Apocalypse

You don’t have to be a full-on “prepper” to at least occasionally wonder what would happen if civilization collapsed. One thing you probably couldn’t do is go on the Internet and ask your favorite AI how to purify water, repel zombies, or treat a burn, all of which may be highly relevant depending on your situation. Now, with Survival LLM, you have a chance.

The LLM is pretty much the stock chatbot, but it is trained on survival topics, and it runs locally. Naturally, you need the Internet to set it up, so you’d want to do that now before everything hits the fan. The training set uses medical references, survival manuals, FEMA and CDC documents, and nearly a million Wikipedia articles. It includes the survival references in a library and links to them when answering, too.

The installer is small, but it assesses your system and loads a model based on what you have. If you have less than 32 GB of RAM, you’ll get the IBM Granite 4.2 8B model, which was able to correctly answer 14 of 22 test questions. Other models do better, including the NVIDIA Nemotron 3.5 Super model, which got 21 correct, but requires at least 128 GB of memory.

Now, somehow you have to power your computer, but that’s a separate problem. At least there will be plenty of GPUs to scavenge from abandoned data centers. We’ve seen prepper digital libraries before. More than one, in fact.

hackaday.com/2026/10/29/an-ai-…

Volt Typhoon used disposable relay chains to hide zero-day ...

2026-10-29T10:34:54Z

Volt Typhoon used disposable relay chains to hide zero-day attacks on critical systems. Lumen linked Silent Train to at least four zero-days. Lumen’s Black Lotus Labs has spent three years tracking a covert network it calls Silent Train, which it ties to Volt Typhoon, the China-linked APT group. The cybersecurity firm says the network hid […]
Volt Typhoon Used Silent Train to Hide Zero-Day Attacks

Gemini 4 Carbon, Google porta gli agenti AI nella caccia alle ...

2026-10-29T09:26:12Z

Gemini 4 Carbon, Google porta gli agenti AI nella caccia alle falle

nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqvje76wq7e5kh9x2c0cggcmymz5408yw8lxxhtpy6v0cdwfu2c9asanfwcg (nprofile…fwcg)
Google ha presentato Gemini 4 Carbon, un modello AI che nei test dell'azienda individua vulnerabilità, ne verifica la sfruttabilità e propone patch. L'accesso iniziale è riservato a difensori selezionati, mentre cresce l'urgenza di governare capacità utili anche

US election websites show improved security, but weak email ...

2026-10-29T09:21:41Z

US election websites show improved security, but weak email protection, non-.gov domains and third-party tracking still expose voters to risks. Millions of Americans will use websites to check their registration, find polling places or track ballots before the November 3 election. However, a new study finds that many county election websites still have security weaknesses […]
Election Website Security: 42% of US County Sites Still Lack .gov Domains

ENGIE says attackers accessed French customers’ contact and ...

2026-10-29T08:53:37Z

ENGIE says attackers accessed French customers’ contact and energy contract data through a partner sales tool. Banking data was not affected. French multinational energy company ENGIE warned customers in France that attackers accessed personal information through a sales tool used by some business partners. The exposed data includes contact details and energy contract information that […]
ENGIE Data Breach Exposes Customer Details and Energy Contracts

The FBI seized Virtualine, a hosting service accused of ...

2026-10-29T08:45:21Z

The FBI seized Virtualine, a hosting service accused of supporting criminal sites, ignoring abuse reports and helping launder money from illegal activities The FBI seized the website of Virtualine, a hosting service that sold its services to criminals. The seized domain is virtualine.net, and the government says the site was used to commit and facilitate […]
Virtualine Domain Seized, but Allegedly Abusive Website Remains Online

Magnetic Lock Opens By Magic Over on IEEE Spectrum, [Stephen ...

2026-10-29T08:00:39Z

Magnetic Lock Opens By Magic

Over on IEEE Spectrum, [Stephen Cass] has a project that would probably have seemed like a magic a few centuries ago. Imagine a box that uses a magnetic device to holds a locking bolt, requiring a magnet to disengage it. The only problem is that any strong magnet can open the box. [Stephen], instead, used an array of 64 Hall-effect sensors developed by [Peter Jansen] to look for a specific magnetic gesture.

Inside is a Teensy that can read the 8×8 grid of sensors. A magnetic stylus allows you to draw an unlock pattern. The system lets you train the gesture you want. There are a few problems. The sensor covers a small area, so it is hard to reliably produce the gesture. Putting an obvious mark on the box is a dead giveaway, so [Stephen] put a Celtic knotwork pattern on the box and uses part of it as a reference.

The other problem is that if you run out of battery, the box is locked forever. Well, at least until you apply mechanical force and break the box open. Wireless charging would be an option, but we might favor a small jack that would allow you to plug in an external battery.

This is a clever use of the sensor. However, we might have preferred a mechanical solution that didn’t require batteries. Or, perhaps, you could use a few normally open and normally closed reed switches to make a kind of magnetic combination lock. It would still need a battery, but it wouldn’t draw current until you connected the switches. Both methods also have drawbacks, of course. Like most things, you just get to pick the drawbacks you can live with.

You can see a video of the magnetic imaging tile from [Peter] below. We really want a setup like this for our secret door. We also wonder whether switchable magnets could provide a battery-free solution.

youtube.com/embed/vxOuoWygxy0?…

hackaday.com/2026/10/29/magnet…

2026 Retrocomputing Challenge: Custom RISC-V Processor For Retro ...

2026-10-29T05:00:43Z

2026 Retrocomputing Challenge: Custom RISC-V Processor For Retro System

Although once little more than an academic endeavor, the RISC-V architecture is slowly supplanting applications that would have normally gone to ARM. Even a few microcontrollers have chips running this open-source instruction set now, and we expect it to grow in the future since it doesn’t require the licensing of an ARM or x86 chip. [M_Jagadeesh97] is getting ahead of the curve with this retro gaming system built on a custom-designed RISC-V system.

Most of us, presumably including [M_Jagadeesh97], don’t have access to chip fabrication tools, but what we can get is any of various FPGAs. This RISC-V CPU is built on a Terasic DE0-Nano board with 32 MB of RAM available to it, and boots to a launcher with 32 games available. There are a few limitations with this low-power system which was largely solved by limiting the display to 64×32, which lets it maintain the same aspect ratio as the original DOOM as well as the same aspect ratio for many of the older games, while still maintaining 45 FPS.

The project writeup goes deep into the design of a system like this, from the bare metal, the CPU design, the timing of the video signals, and how to implement a Wolfenstein-like raycaster. After adding a small display it looks to be fairly portable as well and is an excellent demonstration of how powerful inexpensive boards like this FPGA can be with the proper amount of effort.

hackaday.com/2026/10/28/2026-r…

Battery Prototype Uses Superextensive Quantum Effects to Charge ...

2026-10-29T02:00:26Z

Battery Prototype Uses Superextensive Quantum Effects to Charge Faster

Although the term ‘quantum battery’ is a bit of a vague term, the cell that [Kieran Hymas] et al. demonstrate in a recent paper does seem to suggest that it uses quantum effects to charge faster than would otherwise be possible, with this rate increasing faster than its volume, meaning at a superextensive rate.

The general idea behind a quantum battery is that these somehow use a quantum effect to store and release energy faster than would be possible using classical physics. First proposed in 2013, the initial Dicke model saw its theoretical quantum advantage shot down by 2020, leading to the search for alternative models.

We have previously seen claims of a quantum advantage in batteries based on the Sachdev-Ye-Kitaev model, such as by [Davide Rossini] et al., but this new paper may be the first prototype cell demonstrating a reproducible effect.

In the here demonstrated cell a microcavity is created with strong light-matter coupling, allowing for both energy storage and discharging, with the illuminated particles super-absorbing the light with what the researchers claim to be due to these particles cooperating using a quantum mechanism. Effectively scaling up the cell would thus scale up the charge- and discharge rate faster than in a conventional chemical cell.

Whether this demonstration can be replicated and expanded upon remains to be seen, naturally. The stored energy in this experiment was very small and the storage time only very brief, so for now it serves primarily as an interesting experimental result for researchers to dig through.

hackaday.com/2026/10/28/batter…

Hacking the Modern Tamagotchi With UART Although not technically ...

2026-10-28T23:00:25Z

Hacking the Modern Tamagotchi With UART

Although not technically the first virtual pet, the Tamagotchi handhelds certainly popularized the idea and made it a worldwide phenomenon. In the late 90s it was hard to go out in public and not see them dangling from backpacks and belt loops. They turned out to be more than a passing fad, too. There have been Tamagotchis in various forms since then, and one of the latest, the Tamagotchi Paradise, is uniquely hackable thanks to this custom UART interface.

The build starts with a simple and inexpensive CH340G UART adapter with a built-in USB interface. A custom 3D printed enclosure is used to house the adapter and also help to expose the interface to the Tamagotchi. This is done by wiring three pins to nickel strips, which are threaded through slits in the case and looped back around to create a pogo-style adapter for the Tamagotchi’s custom dock. Normally this would be used to link to other Tamagotchis, but in this case the USB-to-UART adapter mimics it, allowing for all kinds of in-game shenanigans. The project’s creator [Squalius] shows it off by connecting it directly to a browser tool in Google Chrome.

Not only that, but this can also be used to modify the software running on the handheld entirely, with the video showing demos playing not only Super Mario but also DOOM (of course). This isn’t too surprising given that these games are built with modern 32-bit ARM microcontrollers. For the 90s purists, though, it probably won’t surprise anyone to know that these devices have been the subject of various hacks almost since they came out.

youtube.com/embed/6tp_K2XpOSA?…

hackaday.com/2026/10/28/hackin…

Artem Stryzhak gets 70 months in prison for Hive and Nefilim ...

2026-10-28T20:19:06Z

Artem Stryzhak gets 70 months in prison for Hive and Nefilim ransomware attacks, while the FBI offers $11 million for his alleged co-conspirator. A federal court in Brooklyn has sentenced Artem Stryzhak, a Ukrainian national, to 70 months in prison for using ransomware to extort millions of dollars from victims. The U.S. Attorney’s Office for […]
Hive and Nefilim Ransomware Affiliate Gets 70 Months In Jail

Does Running an E-Paper Display at 30 FPS Destroy It? Although ...

2026-10-28T20:00:33Z

Does Running an E-Paper Display at 30 FPS Destroy It?

Although e-paper displays are famous for being low-power and lasting essentially forever if not damaged physically, the recent push to drive even cheaper e-paper displays at a framerate like 30 FPS for a decent monochrome gaming experience does raise a few questions. The first being what this does to the power usage of these displays, and the second whether this will wear out the display in short order. To investigate this, [Bo Made It] set up a few experiments.

Subject of this test was a Waveshare ESP32-S3-ePaper board, which had previously been demonstrated running a Game Boy emulator at 30 FPS. With this software running, the board consumed on average about 115 mA, which would run down the device’s 400 mAh battery in about 3.5 hours. From here key was to isolate the power consumption of the display itself, with the system minus the display updates consuming about 90 mA.

Running the frame calculations for the greyscale mode without rendering to the screen pushed that up to 107.6 mA, with even in the 30 FPS greyscale mode the display thus only consuming about 7.4 mA, which is vanishingly small. Clearly the low-power claims of e-paper remain intact even at higher framerates.

As for lifespan, one datasheet gives the typical lifespan as one million updates. This would translate to about 9.3 hours at 30 FPS, though that assumes a full display refresh. Since a smart driver only updates changed pixels, obviously this will be longer, but the question is how much longer, and what will degradation look like?

After running 2.16 million frames of a custom endurance test featuring repeating patterns, some ghosting was apparent, but repeated refreshing made this go away again. This means that so far no permanent damage has been detected within the no doubt conservative limit provided by e-paper manufacturers.

It should be noted that Waveshare itself also recommends against running such high-FPS applications on their device, meaning that this is definitely one big longevity experiment. If actual damage occurs, this means that obviously this won’t be covered under any warranty.

youtube.com/embed/s939m7j2yKU?…

hackaday.com/2026/10/28/does-r…

C64 Keycaps For Everybody If you’ve got an MX-style keyboard ...

2026-10-28T18:30:45Z

C64 Keycaps For Everybody

If you’ve got an MX-style keyboard and want some retro charm, you might like a recent project from [Levente Szabadkai]. It’s a set of C64-style keycaps that you can print yourself at home!

The project started as an attempt to produce a set of C64 keycaps for an Ajazz 75% keyboard layout, but [Levente] kept pushing until it developed into a universal set. The keys have C64 legends, plain legends, or blank, and work for ANSI boards from 60% to full size. There are a few ways they can be printed. — you can do two-color printing with an FDM machine, or you can print the caps alone and fill the legends with paint, either in FDM or resin.

As a part of this work, [Levente] had to obviously create the glyphs to print upon all the keycaps. He thus decided to release that as the C64 keyboard font, in fact. It’s available in TTF and OTF formats, and you can preview the font in your browser, if so desired. It includes the function key labels, the 63 PETSCII graphic font legends, and various symbols, punctuation, and selected accented letters, too.

We’ve seen lots of vintage C64 parts recreated from scratch. It’s been at the point for a while where you can build a new machine with what’s available off the shelf. They said Amiga would never die, but it’s the earlier Commodore that really lives on today…

hackaday.com/2026/10/28/c64-ke…

Turning an Old Phone’s Motherboard into an RC Plane Controller ...

2026-10-28T15:30:08Z

Turning an Old Phone’s Motherboard into an RC Plane Controller

Upcycling smartphones makes a lot of sense, especially since they contain so many components that remain useful long after their desirability as a smartphone has faded. In the case of [Mountain DS Lab], they opted to use an 8-year old Xiaomi Mi 8 phone to add long-range FPV video link and remote control functionality to an RC plane, using the phone’s LTE cellular connectivity.

The smartphone was bought used for $23, with the default Xiaomi ROM overwritten by LineageOS to get a more lightweight and up to date Android installation on it. From the video it’s clear that this phone has seen better days, with the glass back cracked and a few ugly lines running across the display. Fortunately all that is needed is the motherboard itself.

One gotcha here is that the OS checks for the display on boot and will time-out if it’s not present, potentially halting the process entirely. The workaround requires disabling the display in the device tree, which is done by modifying the boot.img file as explained in the video. Next a custom bracket for the motherboard was printed so that it could be fitted inside the target airplane.

To communicate with the avionics, a USB-to-UART adapter PCB was created with a CH340 IC on it. This was then connected together for an initial test, with the extended front camera being used as the FPV camera for the custom Android application. Using the controller via the remote LTE link worked with the flight controller, so next the airplane was assembled for initial testing.

From this point it’s all pretty standard RC airplane assembly and testing, just with the typical RF-based control and FPV link replaced with the LTE link. Unfortunately flying drones isn’t permitted in the immediate area where the creator lives, so only some taxiing was tried prior to its maiden flight at a local airstrip that will be featured in an upcoming video.

Naturally, this isn’t the first time that someone has tried this type of remote control, with the ongoing Russo-Ukraine war being a prime example of LTE-based remote control of drones. Although we do not advocate wiping out a third of a nation’s strategic bomber fleet with upcycled smartphones, ultimately this is the same technology and a good way to create an RC drone that can last more than the few kilometers eked out from a 2.4 GHz link or so. Just be prepared for the LTE link to add a few milliseconds of latency.

youtube.com/embed/MgZ1qacufJk?…

hackaday.com/2026/10/28/turnin…

Discover-Tech allegedly targeted Starlink users with digital ads ...

2026-10-28T14:37:21Z

Discover-Tech allegedly targeted Starlink users with digital ads to track their locations, according to sources cited in a new Reuters report. Digital defense firm TrendAI found that an Israeli ad tech company was heavily targeting users of satellite internet service Starlink, probably to spy on them. That’s according to six people familiar with the matter, […]
Ads or Surveillance? Researchers Flag Suspicious Targeting of Starlink Users

JPEG-XL Is Back On The Menu Many of the image formats we’re ...

2026-10-28T14:00:04Z

JPEG-XL Is Back On The Menu

Many of the image formats we’re familiar with have been around for decades. We all know JPEG and PNG like the back of our hands, and GIF even had a bit of a resurgence when tiny annoying looping animations became cool again on social media. There has been a growth in newer formats, though, like WEBP, and AVIF, with various platforms and software companies adopting them for greater efficiency, performance, and image quality.

Amongst the new crop of formats vying for relevance is JPEG XL. It was touted as a format that improved on what JPEG could do in the lossy compression space, while also adding on a lossless mode. There were grand hopes that it would become a universal replacement for all existing raster formats on the Web. A major problem was that Google was seemingly against it, only to backflip—with the format now slated to hit the big time with renewed backing from the search giant. So what’s going on?Got You JPEG’d

The JPEG XL codec architecture. Credit: Jon Sneyers, CC BY SA 4.0
The JPEG XL standard is modern, but by no means brand new. It was initially released on 13 October 2021, having been developed by a consortium of the Joint Photographic Experts Group, Google, and Cloudinary. It was deveoped from earlier work from Jon Sneyers on the Free Universal Image Format (FUIF), and work from Google on the PIK format.

It was decided the resulting format would use the *.jxl file extension. The spec defined a format with a wide range of features well beyond what classic JPEG ever offered. It has lossless compression, including for the alpha channel, but also lossy compression available in different modes to suit both photographic and synthetic imagery.

It remains fast to decode—almost as fast as JPEG and much quicker than HEIC with x265. A key future proofing feature is that it can also handle 32-bit sample precision, and images with over a billion pixels per side—that’s a terapixel, if you’re playing along at home.
The JPEG XL logo, which pretty much solely exists for people who need an image for their article about JPEG-XL. Credit: Joint Photographic Experts Group
A wide range of major tech companies have backed the standard in the years since it dropped, from Meta, to Adobe, Intel, and Flickr. While it might seem like Google was fully onboard from the get-go, having literally been involved in development of the standard, the history is more complicated, as reported by TT Lab.

Chromium implemented a libjxl-based decoder all the way back in 2021, which seemed to signal JPEG-XL support would soon be a thing in Chrome and other products besides. However, soon enough, there was a change in direction. In late 2022, it was slated for removal, with a notice that ecosystem support wasn’t great enough to justify continued efforts to bring JPEG-XL into the fold.

In Chrome 110, there was no trace left—JPEG-XL was not going to be a part of things. And yet, in the years that followed, debate raged on the Chrome issue tracker as to whether the nascent format would earn its inclusion. Elsewhere, JPEG-XL was struggling to find a footing. Apple rolled it into Safari in 2023, while Mozilla continued to hedge, noting that including another C++ image decoder was undesirable for reasons around memory safety.
A screenshot of an Android media app displaying a *.jxl image. Credit: Syced, CC0
New movement happened in November 2025, when Rick Byers, Area Tech Lead on Google Chrome, noted that the landscape had shifted. He posted that in light of JPEG-XL support being added to things like the PDF format and Safari, amidst other signals of support in the wider ecosystem, that the development team would be open to “integrate a performant and memory-safe JPEG XL decoder in Chromium.”

With Chrome having over 65% of the browser market, this would be a game changer for the format and likely see its adoption skyrocket across the web. It just needed to actually be implemented. However, Byers was careful to note that the inclusion of the new format would be contingent on a commitment to long-term maintenance of the decoder.

Things moved fast, and when Chrome 145 dropped in February this year, JPEG-XL was on the docket. This was thanks to the development of the jxl-rs decoder, which was implemented in Rust. This was an intentional decision for security reasons, with Google relying on the Rule of 2 to keep its browser safe. However, the new decoder was not activated by default. It would take another half a year or so before the new format would become a mainstream part of Chrome, rather than being hidden behind an experimental flag or anything like that. As of Chrome 155, though, JPEG-XL will be fully supported in the browser.

Don’t expect to see a ton of *.jxl files out on the wider web immediately. However, with the new format offering 30-50% better compression than JPEG, it will be appealing to just about any content provider looking to slimline data budgets and improve page loading times. When the performance gains start boosting traffic to a degree that makes up for the loss of users from older non-compliant browsers, expect to see things changing more quickly.

What does it mean for you, the end user? Probably little more than some minor headaches. You’ll struggle here and there when you download a *.jxl and try and load it into older software that doesn’t support it. You might get a device that shoots pictures in JPEG-XL and then find you can’t upload them to an older website with an out-of-date image submission form.

It’s the same problem we’ve all dealt with as HEIC, AVIF, and WEBP have started bouncing around the web, and we’ll have to weather it again. At least, at the end of the day, we’ll have slightly prettier images that take up a little less space. It’ll all be worth it, to be sure.

hackaday.com/2026/10/28/jpeg-x…

Difendere gli aerei al tempo della guerra ibrida @nprofile…fwcg ...

2026-10-28T12:02:24Z

Difendere gli aerei al tempo della guerra ibrida

nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqvje76wq7e5kh9x2c0cggcmymz5408yw8lxxhtpy6v0cdwfu2c9asanfwcg (nprofile…fwcg)
Dalle interferenze GPS che hanno fermato i voli Finnair alle vulnerabilità dei sistemi di comunicazione: le minacce all’aviazione civile evolvono rapidamente, ma a volte sono proprio le tecnologie più vecchie a offrire una protezione.
L'articolo Difendere gli aerei al tempo della guerra ibrida proviene da Guerre di

CVE-2026-97631: A 16-year-old UEFI flaw (CVSS score of 9.5/10) ...

2026-10-28T11:15:56Z

CVE-2026-97631: A 16-year-old UEFI flaw (CVSS score of 9.5/10) enables pre-OS code execution. Exposed servers need firmware patches and checks. A critical flaw, tracked as CVE-2026-97631 (CVSS score of 9.5), in the firmware that boots most of the world’s servers is now public, and the patch details came out months early. The bug affects TianoCore […]
CVE-2026-97631: 16-Year-Old UEFI Flaw Threatens Servers

Emulate the 486 in Your Browser You might fondly remember the ...

2026-10-28T11:00:20Z

Emulate the 486 in Your Browser

You might fondly remember the days of the Intel 486, but you probably don’t have one on your desk anymore. If you’d like to emulate that classic hardware, you can now do it in your browser, thanks to [Jan de Jager].

What [Jan] has built is a 100% browser-based emulator for an Intel 80486DX2-66 PC. Obviously, it’s not just a CPU that’s being emulated here—[Jan] has gone so far as to throw in the motherboard and ISA/VLB adapter card emulation necessary to make this a real and functioning computer that runs inside a solitary browser tab.

It’s all written in ES6 JavaScript. It will happily run SeaBIOS, VGA BIOS, FreeDOS 1.3, and a whole bunch of classic games, like Wolfenstein 3D, Duke Nukem, and DOOM. There’s even a control panel where you can configure the PC how you like, from storage to expansion cards and all the rest.

Once upon a time an emulator was an application you had to download and run, hoping all the while that your new machine had enough grunt to emulate the classic hardware of your desires. These days, we have endless piles of CPU cycles to throw at everything and you can do it all within a browser. Or even on a tiny microcontroller, if you feel like it!

hackaday.com/2026/10/28/emulat…

Guerra algoritmica, quando il controllo delle menti diventa ...

2026-10-28T10:32:25Z

Guerra algoritmica, quando il controllo delle menti diventa un’arma geopolitica

Nel libro Guerra profonda, Arturo Di Corinto analizza il ruolo di intelligenza artificiale, propaganda computazionale e disinformazione nei conflitti contemporanei. Una lettura che intreccia cybersecurity, manipolazione delle percezioni e diritti fondamentali, mettendo al centro i rischi per la libertà di giudizio e la tenuta delle democrazie

Pubblicato il 27 ott 2026

Giovanni Maria Riccio (Professore ordinario di Diritto comparato, Università di Salerno)

L’epigrafe che apre il volume di Arturo Di Corinto “Guerra profonda. Hacker, bugie e l’architettura segreta dei nuovi conflitti” tratta da Bruce Schneier – «La democrazia è un sistema socio-tecnico. E tutti i sistemi socio-tecnici possono essere hackerati» – ne condensa già la tesi. Per Di Corinto, giornalista e studioso che da oltre trent’anni si occupa di hacking, cultura digitale e sicurezza informatica, i conflitti contemporanei non si combattono più soltanto con missili e droni, ma con software, algoritmi, piattaforme e, soprattutto, con la manipolazione delle percezioni. È ciò che l’autore chiama «guerra algoritmica»: l’uso di software, intelligenza artificiale e piattaforme digitali «per sviluppare strategie politiche ed economiche, ma anche interventi militari, operazioni cibernetiche e di influenza informativa» (p. 22).

continua sul Corriere delle Comunicazioni

dicorinto.it/articoli/recensio…

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds ...

2026-10-28T10:05:15Z

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Google Brotli and Adobe Commerce and Magento flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Google Brotli and Adobe Commerce and Magento vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Below are the flaws added to the catalog: Brotli is a data-compression algorithm […]
U.S. CISA adds Google Brotli and Adobe Commerce and Magento flaws to its Known Exploited Vulnerabilities catalog

Tracking pixel nelle e-mail: promemoria operativo per titolari e ...

2026-10-28T09:16:22Z

Tracking pixel nelle e-mail: promemoria operativo per titolari e piattaforme

nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqvje76wq7e5kh9x2c0cggcmymz5408yw8lxxhtpy6v0cdwfu2c9asanfwcg (nprofile…fwcg)
Il 29 ottobre scade il termine di sei mesi concesso dal Garante privacy per adeguare i trattamenti basati sui tracking pixel nelle comunicazioni e-mail. Informative, consensi, revoche e configurazioni delle piattaforme sono tra gli

Three Japan-focused cyberattacks show how AI helps hackers scale ...

2026-10-28T08:34:17Z

Three Japan-focused cyberattacks show how AI helps hackers scale operations, while exploiting old systems and weak security remains key. In autumn 2026, Japanese companies and other organizations reported a series of data leaks involving their web systems. On October 9, Japan’s National Cybersecurity Office issued a warning to businesses, while the head of the ruling […]
Three Japan-Focused Cyberattacks Show How Hackers Use AI

SLAM Navigation For an Arduino Powered Car There are plenty of ...

2026-10-28T08:00:33Z

SLAM Navigation For an Arduino Powered Car

There are plenty of “robot” projects out there that are really just a small remote control platform of some sort. We often like to think of robots of having some sort of autonomy though. [Luca Fagioli] demonstrates a great example of this with his explorer robot that uses Simultaneous Localization and Mapping (SLAM) to navigate its environment.

The robot is a built on a small plastic chassis, with one gear motor per drive wheel. Running the show is an Arduino Uno R4 Wi-Fi, paired with the Sensor Shield 5.0 and an L298N motor driver board. There’s also an HC-SR04 ultrasonic sensor module onboard, mounted atop an SG-90 servo motor so it can be panned around. The ultrasonic sensor determines the range between the robot and surrounding walls, and a map is constructed at the same time as the robot is localizing itself within it. There are also infrared sensors on the bottom of the robot for detecting tape marks on the floor for checkpointing purposes.

Often, SLAM mapping is done with advanced laser rangefinders or time of flight sensors, but there are many ways to go about it as this project demonstrates. We’ve even seen it done in a distributed manner with coordinated drones combining their efforts. Overall, it’s a highly useful technique for robot navigation and wayfinding.

youtube.com/embed/W3Vlcy4lN5o?…

hackaday.com/2026/10/28/slam-n…

Hacking a Marine Radio Dish Having watched some fun videos on ...

2026-10-28T05:00:31Z

Hacking a Marine Radio Dish

Having watched some fun videos on repurposed satellite dishes on YouTube, [Melan] wanted to get in on the action. She managed to source herself an Intellian i4, a dish built for marine use, and set about hacking it to do her bidding.

[Melan] first set about convincing the antenna that it was still on a boat by using an RP2040 microcontroller and an RS-422 module to send NMEA sentences. This was necessary to tell the i4 the “heading” of the “boat”, even though [Melan] was really using the rig on land. From there, she was able to get the Intellian software to run the antenna just by emailing the company.

However, she wanted to see if it could be controlled without it. She began by sniffing communications between the software and the Antenna Control Unit, and decompiling the code. It was relatively straightforward to put together a protocol description and figure out how to command the antenna where to point simply by issuing commands for azimuth and elevation.

We’ve featured other great bits of satellite equipment before, like this truck tracker teardown from a few years ago. If you’ve got some nice equipment on the bench that listens in on (or transmits out to) birds in space, don’t hesitate to let us know on the tipsline.

hackaday.com/2026/10/27/hackin…

Airborne Particle Monitoring, the BIG way Airborne micro ...

2026-10-28T02:00:01Z

Airborne Particle Monitoring, the BIG way

Airborne micro particles can be a significant health hazard in a workshop, and thus it’s important to maintain a high standard of ventilation. But monitoring their concentration is also important, and thus there exists a range of sensors to help keep you safe. [WeSpeakEnglish] has taken this idea to the MAX, with a PM2.5 sensor that drives a very large wall mounted display. You’ll never be uncertain what the level is now!

The standout feature of this thing is a huge addressable LED seven segment display PCB, upon the back of which sits a tiny Seeed Studio Xiao board to which the particle sensor is hooked up. The software displays the particle count, and handily changes the colour as the number creeps upwards. Meanwhile should you wish to log the readings, the USB exposes a serial port upon which they are placed.

We can see this is a useful project for anywhere that is likely to have a high particle count, but it’s worth noting also that a large 7-segment display with an ESP32 board attached could have plenty of other uses. Meanwhile this is a nicely finished air quality monitor, but it’s certainly not the first we’ve seen.

hackaday.com/2026/10/27/airbor…

How a Single University Project Started Everything If we care to ...

2026-10-27T23:00:07Z

How a Single University Project Started Everything

If we care to cast an eye over the history of ubiquitous personal computing as we know it today, we might immediately point at the original IBM PC. After all, for most of us our machines share backward compatibility in some form through multiple generations back to that original box from 1981.

But if we look at the things we use today and take for granted, from laser printers to graphics cards to the routers which power most of the Internet, they’re not from IBM at all. At the recent Vintage Computing Festival Berlin, [Michael Engel] delivered a talk naming a surprising progenitor for much of that technology, none other than Sun Microsystems.

It all starts with [Andy Bechtolsheim], famously Sun’s co-founder, when at the end of the 1970s he was a postgraduate at Stanford University. Working on the Stanford University Network — SUN — project he designed a computer to be used as a workstation on the network. The processor of choice then was Motorola’s 68000, but it lacked the MMU that would be required to run UNIX. His design had an MMU implemented externally to the 68000, with a bank of SRAM serving as the page table. This design would form the CPU board of the first Sun workstation.

The story might end there, were it not that many other companies had the same requirement, and Sun could supply them a CPU board. Silicon Graphics, the distant ancestral progenitor of your GPU, was one of them, so the first SGI workstation also had the same CPU as the first Sun. It appeared in the early Imagen laser printers too, as well as commercial AppleTalk to Ethernet bridges. Perhaps the biggest surprise is that because the original Stanford board had also been used as a router, the software for that became part of Cisco’s first product.

The video is below the break, and it’s a fascinating watch.

media.ccc.de/v/vcfb26-110788-s…

hackaday.com/2026/10/27/how-a-…

2026 Retrocomputing Challenge: Explore Space with a Credit Card ...

2026-10-27T20:00:33Z

2026 Retrocomputing Challenge: Explore Space with a Credit Card Reader

The humble credit card reader — most of us have used hundreds, perhaps even thousands of them over the years. But even for folks like us, it’s not the sort of device we give a lot of thought to. It’s just a keypad, a display, and a magnetic stripe reader. How interesting could it possibly be?

That may be true in some cases, but at least for the 1990s-era TRANZ 330, there’s a bit more to the story than that. As [CharlesD] explains, these particular readers are essentially complete Z80 computers just waiting to do something more exciting than processing PINs. In the case of this particular unit, the addition of a GPS module and some new code has turned it into an interactive guide to the solar system.

Thanks to the UV erasable ROMs used in the TRANZ 330, loading new code on the device is easy enough. With a bit of educated poking around, [CharlesD] was able to map out what did what. Working from the basics of getting the display and keypad working, he moved onto the serial interface, which in turn let him communicate with a modern GPS module and era-appropriate thermal printer. From there it was just a matter of getting the math implemented to compute the azimuth and elevation of a given planet, and he had an offline map of the solar system for use with his telescope.

This is one of those projects which is awesome enough on its own merits, but it’s particularly exciting to see just how easy it is to repurpose one of these card readers, especially since [CharlesD] was kind enough to share his source code. If you end up picking one of these up and getting something running on it, be sure to let us know.

hackaday.com/2026/10/27/2026-r…

Movimenti “No Data Center” in Europa @nprofile…fwcg Il 6 e ...

2026-10-27T19:43:17Z

Movimenti “No Data Center” in Europa

nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqvje76wq7e5kh9x2c0cggcmymz5408yw8lxxhtpy6v0cdwfu2c9asanfwcg (nprofile…fwcg)
Il 6 e 7 novembre 2026 si terranno azioni in tutta Europa per contestare i data center inquinanti e hyperscale. Il fenomeno interessa molti paesi ma al momento non l’Italia. […]
L'articolo Movimenti “No Data Center” in Europa proviene da Edoardo Limone.

L'articolo proviene dal blog dell'esperto di #Cybersecurity Edoardo Limone

Italy ’s Parliament cyberattack highlights hybrid warfare risks ...

2026-10-27T19:12:30Z

Italy ’s Parliament cyberattack highlights hybrid warfare risks and the need for transparency, stronger defenses and accountability. The cyberattack targeting email accounts at Italy’s Chamber of Deputies, including a parliamentary account assigned to Prime Minister Giorgia Meloni, raises questions that go well beyond the security of individual inboxes. At a time when European institutions face […]
Italy’s Parliament Under Cyber Pressure: Why the Attack on the Chamber Matters

Australia’s cyber agency warns AI will drive more disruptive ...

2026-10-27T18:41:51Z

Australia’s cyber agency warns AI will drive more disruptive attacks, helping hackers find vulnerabilities faster and exploit them at greater scale. Australia’s top cyber spy has a blunt message: expect more disruption to everyday services. Abigail Bradshaw, director-general of the Australian Signals Directorate (ASD), says that with each jump in AI capability, more disruption is […]
Australia's Cyber Spy Chief: Expect More Disruption as AI Accelerates Hacking

Where Did Your Mouse Come From? Many readers will be familiar ...

2026-10-27T17:00:23Z

Where Did Your Mouse Come From?

Many readers will be familiar with Douglas Englebart’s 1968 so-called “Mother of All Demos”, in which he described many of the devices and technologies we would be using two or three decades later. Among these was a primitive computer mouse, but while famous it was by no means the earliest pointing device. At the recent Vintage Computer Festival Berlin, [Dmitriy Kostiuk] delivered a fascinating lecture of the history of the pointing device.

It’s a long video that we’ve placed below, and it’s an exhaustive examination of the topic from the earliest examples to the 1990s when mice became commoditized. It’s a surprise to find that the first pointing device was a trackball built for a 1950s Canadian warship, with a surprisingly modern-looking optical encoder. Englebart’s 1966 wooden block with its pair of wheels and potentiometers had a less-well-known and much more stylish competitor in the same year from Telefunken.

We visit the various design iterations as the form of what we’d call a mouse today took shape. It’s unexpected to find that those Sun mice with the spotty mouse pad weren’t from Sun at all, they were from Mouse Systems. The first mice from Microsoft and Apple make an appearance, as do some awful designs for 8-bit computrs. Remembering those in particular perhaps it’s as well we didn’t have the cash to buy such a disappointing product for ourselves.

The video is long, but interesting. Give it a watch.

media.ccc.de/v/vcfb26-110790-w…

Header image, Douglas Englebart’s prototype, Michael Hicks, CC BY 2.0.

hackaday.com/2026/10/27/where-…

PHP2Shell minaccia anche le app Android e iOS: il rischio ...

2026-10-27T15:54:54Z

PHP2Shell minaccia anche le app Android e iOS: il rischio nascosto nei server

nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqvje76wq7e5kh9x2c0cggcmymz5408yw8lxxhtpy6v0cdwfu2c9asanfwcg (nprofile…fwcg)
Le vulnerabilità PHP2Shell non colpiscono direttamente Android e iOS, ma possono esporre dati e servizi delle app mobili attraverso backend PHP vulnerabili. L'analisi di NowSecure evidenzia i rischi per API e componenti di terze parti e la

How Bad Is That Bridge: A Government Database Bridges! We kind of ...

2026-10-27T14:40:49Z

How Bad Is That Bridge: A Government Database

Bridges! We kind of expect them to just be there and do their job, ad infinitum. They are built into the landscape, and we often take them and the routes they open up for granted.

The reality, as any civil engineer will tell you, is that bridges are living, breathing things that require endless maintenance and monitoring to keep them safe, standing, and functional. A great example of this is found in the US Department of Transportation, and its publicly accessible register of bridge health reports.Stay Standing

The thing about bridges is that we rely on them. They serve as vital transport links in our communities, ferrying people to and from work and school, and acting as the very arteries of commerce as trucks and trains haul goods to and fro. When a bridge crossing has to close, either for maintenance or at end of life, this link is severed, often with serious economic and logistical impacts. For that reason, we tend to like to keep our bridges in service as long as possible. The result, of course, is that if pursuing this goal means that proper maintenance and repairs aren’t seen to, there is a risk of collapse—which often comes with worse consequences. Loss of life is common when bridges fail, and replacing a collapsed bridge is often much harder and more time consuming than handling things properly ahead of time.

In the United States, it’s a well known fact that the bridges are getting old. The average bridge is 44 years old, which is bumping up against the 50-year service limit many were originally built for. Being an average number, it’s indicative that many bridges are exceeding that figure significantly. Obviously, a bridge’s age isn’t a perfect proxy for its condition, but closer examinations indicate there’s definitely a problem. A 2024 report from the American Road & Transportation Builders Association noted that 36 percent of US bridges are in need of repair or replacement, a total of 221,800 spans. 42,067 spans were considered to be in “poor” condition, which in their total see 168.5 million motorists crossing them every day. It’s a particularly sobering figure as it highlights the size of the disaster possible if these structures are to fail.
InfoBridge quickly lets you sort through data by all kinds of different factors. If you’re looking for the worst bridges in town, it’s easy to flick through CAT10 – BRIDGE CONDITION to see which bridges as listed as Good, Fair, or Poor. Bridges are rated on the condition of their deck, superstructure, and substructure, and the lowest scoring section influences which bin the bridge lands in, as per federal code—specifically, 23 CFR 490 Subpart D. Credit: InfoBridge screenshot
You can drill down into the data yourself if you desire. Within the Department of Transport, the Federal Highway Administration maintains LTBP InfoBridge, a database of information on bridges all across the country. It was developed by the Long Term Bridge Performance program, because the goal of the project is to understand how these structures hold up and perform over the decades. The database is publicly accessible, and serves as a portal for all the available data and statistics on how US bridges are doing. It hopes to enable everyone from state and federal authorities, to university students, faculty, and other researchers, to dive into bridge data and visualize and understand it better.

Data available is from a wide number of sources, including the National Bridge Inventory and National Bridge Element datasets, as well as climatic data collected from NASA’s MERRA-2 database. There’s also construction and design data sourced by the LTBP program, along with non-destructive evaluations that have been carried out. Data from various other special projects is available too, such as from Federal Highway Administration projects investigating timber bridges, steel weathering, and the use of ultra-high performance concrete structures.
Just glancing at the Vincent Thomas bridge won’t tell you how the structure is doing. Credit: The Port of Authority, CC BY-SA 3.0
If you have a particular bridge of interest, it’s easy to get a quick break down of how it’s doing. For example, you might like to know about the Vincent Thomas Bridge, in Los Angeles, California: National Bridge Inventory number 53 1471. It links San Pedro with Terminal Island, and is a suspension bridge with a total length of 6,060 feet and a longest span of 1,500 feet. Built in 1963, we can see from the data alone that it’s now showing its age.

The bridge condition is listed as “Poor,” and if we dive deeper into the National Bridge Elements data, we can see why. The health indexes of the deck, substructure, and superstructure have all been trending down in recent years as the bridge’s age has increased, with a particular drop off from 2019 or so. In particular, the steel cables and girders on the bridge have been showing their age, and the concrete columns supporting the bridge have been similarly degrading. The deck, too, is in need of repair, with the California Department of Transport recently dedicating some $706 million to replace it ahead of the 2028 Olympic Games.
However, InfoBridge will let you drill down into detailed reports on the bridge conditions, down to a level which indicates which parts of the bridge are most in need of maintenance, repair, or replacement. Credit: Screenshot, InfoBridge
InfoBridge also offers condition forecasts for many bridges across the country. For example, the 24th Street Bridge over Rio Linda Creek is currently listed as being in “Good” condition. Current forecasts show that the deck and superstructure is expected to be in much poorer shape somewhere between 2035 and 2055, while the substructure is expected to hang on in good shape for a bit longer.
The Long Term Bridge Performance Program has developed a variety of models—base, survival, and machine-learning—to predict bridge condition over time. The aim is to guide maintenance efforts over time and allow for better planning. Credit: InfoBridge, screenshot
You might think that you’d have to query a government department and delve deep into some dusty records room to learn about the condition of your local bridges. Instead, thanks to the efforts of diligent civil servants, you can instead access all the rich inspection data you like from the comfort of your own web browser. It’s not just good for citizen oversight, either. It aids local authorities and bridge owners in making the right decisions, by putting the necessary data right at their fingertips.

It also creates a certain level of accountability—having the data available means there’s little room for anyone to make excuses that they were unaware of a bridge’s condition prior to something going wrong. Ultimately, it’s just one arm of a project that hopes to take US bridges safely long into the future.

Featured image: “Brooklyn Bridge – New York City” by [Simone Roda]

hackaday.com/2026/10/27/how-ba…

ACN, eventi cyber a +57%: il ransomware pesa sulla continuità ...

2026-10-27T12:02:42Z

ACN, eventi cyber a +57%: il ransomware pesa sulla continuità dei servizi

nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqvje76wq7e5kh9x2c0cggcmymz5408yw8lxxhtpy6v0cdwfu2c9asanfwcg (nprofile…fwcg)
A settembre 2026 ACN registra 485 eventi cyber e 235 incidenti confermati. DDoS e defacement alimentano la crescita degli eventi, mentre il ransomware resta la minaccia con il maggiore impatto operativo, con attacchi anche a due strutture sanitarie

SIMD-accelerated Machine Vision on an ESP32-S3 Recently [shraiwi] ...

2026-10-27T11:00:12Z

SIMD-accelerated Machine Vision on an ESP32-S3

Recently [shraiwi] decided to have a bit of good nerdy fun and implement the FAST machine vision algorithm on an ESP32-S3 using its SIMD ISA. This involves using the assembly instructions for the ISA, making for an exciting opportunity to become familiar with this part of this Xtensa Lx7-based twin-core MCU.

The Features from Accelerated Segment Test (FAST) algorithm is a corner detection method that can determine with reasonable accuracy and in real-time whether a given input frame contains said corners which thus may correspond to objects and other characteristics worthy of note. This is essential for machine vision, with machine learning able to bump up its recognition accuracy even more.

Implementing this algorithm on the ESP32-S3 proved to be a bit of a challenge due to somewhat limited SIMD ISA. Missing instructions included things like comparisons between unsigned byte values, and there is no support for direct misaligned reads.

All of these required some creative coding to work around, but in the end the ESP32-S3 running at 240 MHz was able to process a VGA stream in real-time at 30 FPS. This means about a 2x speed-up over a naive implementation using only non-SIMD instructions.

If you want to play along at home, the Platform IO project is made available on GitHub.

hackaday.com/2026/10/27/simd-a…

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds ...

2026-10-27T10:39:41Z

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the PHP PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: On October 21, PHP released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (CVSS score of 9.2). The flaws […]
U.S. CISA adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog

Ukraine warns that attackers can remotely access Dahua cameras ...

2026-10-27T09:56:54Z

Ukraine warns that attackers can remotely access Dahua cameras and recorders via Easy4IP, viewing video and changing settings. Ukraine’s cyber incident response team CERT-UA has warned about attackers taking over video surveillance systems made by Dahua. In its alert dated October 23, 2026, it reports unauthorized remote access to IP cameras and video recorders. The […]
Attackers Take Control of Dahua Cameras and Video Recorders Via Easy4IP

Cohere found an Alibaba AI model attempting to contact a server ...

2026-10-27T09:07:11Z

Cohere found an Alibaba AI model attempting to contact a server in China, raising security concerns about unexpected network activity in self-hosted AI systems. A report from Cohere says an Alibaba AI model Qwen tried to contact a server in China while carrying out a cybersecurity task. “Asked to write a defensive detection rule, Qwen3.8-Flash-Next […]
Cohere Finds Qwen AI Model Contacting a Server in China

ESP32 Rotary Display Makes Ideal Timer We’re big fans of ...

2026-10-27T08:00:35Z

ESP32 Rotary Display Makes Ideal Timer

We’re big fans of pushing hardware into situations it wasn’t designed for here at Hackaday, but sometimes you’ve got to appreciate a nicely designed gadget doing more or less exactly what it was intended for — especially when it’s courtesy of code that’s freely available for you to run and hack on however you like.

That’s precisely what [mircemk] has done with their “Universal Timer” project. The 2.1 inch CrowPanel “Rotary Display” at the heart of the build combines an ESP32-S3 with a 480×480 round touch screen display and a rotary encoder.

The all-in-one device — clearly meant to be reminiscent of the Nest thermostat and similar commercial offerings — is technically all you need, but in this case it’s been joined by a PCF8574 I2C I/O expander which in turn is used to drive a buzzer that provides a bit of audio feedback at the end of the countdown.

With the code [mircemk] has provided flashed onto the board, the rotary encoder ring built into the housing makes for an exceptionally intuitive input for setting the desired time. It’s a bit like a high-tech version of the classic kitchen timer, as shown in the video below, you simply twist the ring and the graphics on the display rotate accordingly. Unlike grandma’s clockwork timer of old however, this one can change color as it nears zero, which makes it easier to estimate how much time remains from across the room.

As the popularity of smartwatches has brought the cost of these circular displays down, we’ve started to see some very slick projects utilizing them. The various efforts to turn them into desktop “radar” displays for nearby flights are a particular favorite.

youtube.com/embed/buSYu1Nq2f4?…

hackaday.com/2026/10/27/esp32-…

The Oldest Windows App To Still Run On WIndows 11 In the open ...

2026-10-27T05:00:21Z

The Oldest Windows App To Still Run On WIndows 11

In the open source world we are used to software being compiled from source for our particular distro, so while in a few cases an ancient release may still be in use, it’s just going to run on the latest distro version. But in the Windows world it’s rare for software to come with the source, so you’re left with a binary that will only run if your Windows version has the right APIs for it. Since the more recent versions of Windows dropped 16-bit support a while back, that means there must be a hard date set on the earliest Windows GUI application that can still run today. [Enlyth] decided to investigate.

Given that the earliest API supported in WIndows 11 is the 32-bit version, the hunt led straight to either the first Windows NT release and ancestor of Windows 11, or the Win32s extension for WIndows 3.1. Thus a 1993 Win32S version of Freecell runs happily, but that want’s the end of the trail. Somewhere in the pre-release builds of Windows NT 3.1 would be the requisite binary, but there’s a snag. Early Windows NT 3.1 APIs were incompatible with later ones. This led through a lot of crashing binaries to a November 1992 version of the CD player app, that ran because it called a DLL which happens to still be present. The need for another DLL to emulate a CD drive speaks volumes about the progress of the PC world, back then they were the last word in storage but who’s got one now?

That’s the earliest official binary to run, but the story’s not quite over. Windows 11 may not have a VDM to run 16-bit apps, but there’s a WINE VDM for that. Behold, Reversi from Windows 1.01 in November 1985, in Windows 11. Your ancient software may yet be saved.

hackaday.com/2026/10/26/the-ol…

In Praise Of A Legendary Power Transistor There are some devices ...

2026-10-27T02:00:15Z

In Praise Of A Legendary Power Transistor

There are some devices which achieve electronic immortality, it’s likely that you have used a few of them yourself. The 555 timer of course, or the 741 op-amp. [ElectronicsNotes] is here with another candidate that might not have been on your mind as you read the previous sentences, and it’s a transistor. The 2N3055 is an NPN power transistor, no, THE NPN power transistor, that has found its way into an astounding array of devices over the last six decades or more.

For such a ubiquitous device one might imagine that there’s not much new to know, but the video delivers on that front. Here as well as probably for you the 3055 has always been an epitaxial device whose quirks you likely know well, but originally it was something different. It used the hometaxial construction process on its launch in the early 1960s, but in the mid 1970s it was replaced by a version with the same capabilities but using the epitaxial process. The consequent higher Ft required modifications to circuits using the device to stop unwanted oscillation.

Where this is being written there are several 2N3055s, in the by now rather old office audio amplifier, in a bench power supply, and probably elsewhere too. It’s been superseded in many ways and its TO3 case now feels antiquated, but it will probably never entirely go away. Meanwhile if you’d like to read about another iconic 1960s device that never went away, we have you covered.

youtube.com/embed/AlKwDjhUxj8?…

Header: a really early example. Eule4404, CC BY-SA 4.0

hackaday.com/2026/10/26/in-pra…

Enable Resizable BAR on Unsupported Motherboards Recently [Rod ...

2026-10-26T23:00:42Z

Enable Resizable BAR on Unsupported Motherboards

Recently [Rod Burlamaqui] released the arc-rebar project on GitHub, enabling Intel GPUs to work significantly more efficiently if the system’s mainboard does not support resizable BAR. It does require a Debian or Ubuntu installation and of course a supported Intel GPU.

Although the resizable base address register (ReBAR) feature has been part of the PCIe specification for a while, its use was quite limited until Intel released its Arc series of graphic cards. These use this feature to map much more of the GPU’s video RAM (VRAM) into the PC’s address space than the standard 256 MB, assuming that the system is capable of decoding addresses above 4 GB, i.e. allow for 64-bit BARs.

For GPU manufacturers like AMD and Nvidia this wasn’t so much of an issue as their GPU designs developed in a world where ReBAR didn’t exist, while Intel’s new GPU generations were designed with ReBAR as a core feature, which naturally cripples performance if the mainboard does not have it enabled during PCIe bus enumeration.

This initramfs-based fix runs before the GPU driver loads and performs the requisite BAR configuration. In testing with an Intel Arc B580 GPU on a 2015-era Intel Xeon mainboard the difference between the default and the fixed bandwidth was a bump from a pitiful 15 GB/s to a respectable 392 GB/s, showing how this one fix can breathe new life into older systems.

hackaday.com/2026/10/26/enable…

Sansec tracks a Magento skimmer campaign that infected 953 ...

2026-10-26T20:41:22Z

Sansec tracks a Magento skimmer campaign that infected 953 stores, using five domains, bot filtering and malicious code hidden in CMS blocks. A criminal group has infected 953 online stores since July 2025, mostly Magento shops, according to Sansec researchers. The attackers add a small piece of code to store pages. When someone visits a […]
Magento Campaign Infects 953 Online Stores Across Five Domains

Practice Japanese on an Inkplate 4Tempera eInk Device Learning a ...

2026-10-26T20:00:01Z

Practice Japanese on an Inkplate 4Tempera eInk Device

Learning a new natural language can be a daunting proposition at the best of times, with repetition and immersion generally considered to be the best ways to build up not only vocabulary but also that innate sense for grammar and cultural details that sneak into every spoken language. Flash cards are one way to help with vocabulary and sentence building, such as [Peter Hraska]’s Enkiplate project that uses the Inkplate 4Tempera being an interesting alternative to lugging a stack of cards with you.

Although the software also works in the browser, using the Inkplate or similar device means that you can keep it with you while it keeps track of your progress in learning the shown cards, with a starting pace of 12 cards per day to learn. It also shows you calendar items for that day and the weather using an online weather service.

Starting from basic kana, i.e. the two phonetic writing systems, the difficulty is slowly ramped up to cover kanji and then sentences. Due to the limitations of the 4Tempera’s ESP32-WROVER-E module’s local storage up to 16 flash cards can be stored at a time, with an application on a PC being necessary to obtain new cards.

hackaday.com/2026/10/26/practi…

Arduino Engine Runs Many Games A few years ago, [Smashcat] ported ...

2026-10-26T17:30:33Z

Arduino Engine Runs Many Games

A few years ago, [Smashcat] ported a ZX Spectrum game called Manic Miner to the Arduino Uno. The Arduino has less memory than the original Spectrum did, so doing all this on an 8-bit microcontroller was no easy lift. Since then, parts of this original port have been adapted to produce a game engine, allowing [Smashcat] to port several other games to the Arduino Uno as well.

The engine is able to host a 2D map with the ability to scroll, at a resolution of 256×256, as well as up to nine sprites at the same time. The graphics are locked to 50 FPS, but only with a real Arduino Uno that has a crystal oscillator. Some replica boards do not have a timekeeping chip accurate enough to replicate the video signal, which is done without a framebuffer. That signal, as well as two PWM audio channels, are still generated directly as well, with only a few resistors needed to hook everything up to a monitor and a controller, including the option of using an NES controller.

With all of that running on the Arduino and it hooked up to the daughterboard that provides the controller interface as well as the resistors for the video signal to function and a driver for a speaker, the system now runs the original Manic Miner as well as three other games: Scramble, Space Invaders, and Pac Man.

The engine and the rest of the code are available on a GitHub page as well, and there’s even a WebAssembly version available to run various pieces of the software without the specific hardware. The original ZX Spectrum was an interesting machine too that still inspires builds like this, despite it being well over 40 years old now.

hackaday.com/2026/10/26/arduin…

BMW i3 Mod Brings Small Trucks to the EV Future Trucks are handy, ...

2026-10-26T15:30:42Z

BMW i3 Mod Brings Small Trucks to the EV Future

Trucks are handy, especially if you’ve got messy or dirty loads, but there aren’t a lot of options if you want a small electric pickup yet. [Michael Pick] decided to convert a BMW i3 into a utility vehicle.

After getting a new 12 V battery and cleaning the car up, [Pick] proceeded to disassemble the interior and remove the hatch from the car. Once he could look at the bones, he planned out the best places for the cut lines and removed the back half of the cabin.

The bed is built from plywood coated in penetrating epoxy and bedliner for weatherproofing, and special care was taken to seal the interface between the cabin and bed as the main electronics for the vehicle are housed in a compartment directly below. The taillight electronics were rehoused as the OEM lenses were too large to fit next to the tailgate opening.

The i3 has graced these pages before with a battery upgrade, and we’d be remiss not to remind you of the most famous EV to truck conversion, Truckla.

youtube.com/embed/FYdyyEAe8UA?…

hackaday.com/2026/10/26/bmw-i3…

Dutch police arrest two men over AI-voiced bank fraud that ...

2026-10-26T15:06:26Z

Dutch police arrest two men over AI-voiced bank fraud that allegedly used a fake app to steal card data from 170 victims, causing €380,000 in losses. Rotterdam police have arrested two men over a new type of bank fraud that used AI-generated phone calls, a fake banking app, and NFC technology to steal bank card […]
AI-Generated Fake Bank Calls and NFC App Enabled €380,000 Fraud, Dutch Police Say

The Fascinating World of IrDA and Other Infrared Protocols ...

2026-10-26T14:00:36Z

The Fascinating World of IrDA and Other Infrared Protocols

Infrared (IR) communication technologies are probably one of the most influential, yet also one of the least flashiest. The fact that IR communication tends to be highly directional and often limited to low data rate leads many people to scoff at it, deeming it barely worthy of more than making TV remotes work, perhaps along with some unloved industrial gear like the IR interface of electrical meters.

This is a shame, because TV remotes are a good example of why sometimes you want something that is directional, and anyone who has picked a battle with Bluetooth pairing drama can attest to the value of things simply working by pointing it at the device. IR protocols also have the advantage of inherent privacy protection as walls and other obstacles will block the signal, unlike that of an exploitable Bluetooth device which happily advertises to your neighbors and passersby.

For reasons like the above – as well as their simplicity – IR protocols have hardly vanished today, making them worthy of a detailed look.Remote Control

Naturally, one of the oldest uses of consumer IR protocols is that of the venerable IR remote control. Initially TVs used wired and ultrasonic remote controls, with the latter using simple ultrasonic tones to transfer a command, but with IR protocols and the advent of cheap MCUs it became possible to create extensive communication protocols. Of these the NEC, Sony IR (SIRC) and Philips protocols are probably the most well-known and most used.

These use an approximately 36-38 kHz carrier, with the common NEC protocol using pulse distance encoding – a form of amplitude-shift keying – and the Philips RC-5 protocol using Manchester encoding. Within this encoding these protocols define various bit fields and other values that can be used by a receiver to determine whether it’s being targeted, and if so what command the user wishes to have performed.

When it comes to those cheap-and-cheerful remotes that you get with just about any RGB light strip and others gadgets these days, they tend to use the same NEC protocol, with many MCU-based projects around that can control these gadgets directly with a simple IR LED.

Case in point this STM32F0-based project by eleksaggr on GitHub that targets the common 24-key RGB remotes, as well as this Infrared Remote Control Implementation application note by Texas Instruments for the MSP430, which contains a good overview of the modulation and encoding schemes, as well as how to implement a remote control.

Many smartphones have – or used to have – an IR blaster feature that can target the same carrier frequency and a range of protocols to control just about anything that is IR remote controlled. In a world of smartphones this would theoretically mean that everyone has a universal remote in their pocket at any time, if it wasn’t for IR blasters becoming pretty rare. If your recently purchased smartphone still has an IR blaster, it’s very likely a Chinese brand, which is a shame as IR remotes are still used for so many things.
IrDA

IrDA used to transfer a file between a Thinkpad T40 and T42. (credit: nick99nack, Wikimedia)
Of course, IR remotes are quite a specific use case, but you can send a lot more than just a basic set of commands to a device. The most well-known standard here is IrDA, which stands for Infrared Data Association, the association which defined the various standards.

The basic principles behind IrDA remain effectively the same as with the remote control protocols, just designed to be capable of far higher transfer speeds. This is accomplished through various types of encoding, modulation and other techniques also observed with non-IR forms of wireless communication. Using this a range of speeds are possible, defined as:

SIR (115 kbit/s).
MIR (1 Mbit/s).
FIR (4 Mbit/s).
VFIR (16 Mb/s).
UFIR (96 Mbit/s).
Giga-IR (512 Mbit/s – 1 Gbit/s).

The IrDA protocol stack. (Credit: Fred derf, Wikimedia)
In additional a range of derived protocols exist such as IrSimple that allows for e.g. easy sharing of pictures and similar between phones, printers and displays. All of this uses generally the same IrDA software stack, though the special versions such as IrSimple optimize it to make transfers take less than a second for a 500 kB picture.

All communication generally happens in half-duplex, as the sending side tends to produce too much interference for the receiving side of the transceiver to reliably receive data. Distance between the two sides can be as much as two meters, though the lower power versions shrink that down to 20 cm or thereabouts.

Within this range of speeds you can pick whatever the device needs, with for example power meters being plenty happy with the IrDA-SIR protocol, which is low-power and speed enough to bitbang on even a basic MCU in these meters with just a basic IR transceiver attached to its pins.
Power Meters

IR transceiver port on IEC 62056-enabled smart meter. (Credit: WMKrieling, Wikimedia)
The humble power meter that lurks in your utility closet or wherever else it is installed has to be shielded from whatever environment it is installed in, ergo they require some kind of low-power, low-speed wireless interface. Using nothing but an IR-transparent window on the enclosure it is then possible for a read-out device to be pressed up to said window, where it’ll quickly query the device for the necessary information.

This same feature is also found on heat meters and other types of devices where such basic read-out functionality is required. Here security is managed by not only the short-distance, line-of-sight requirement of an IR communication link, but also by having a sign-on involving an encrypted password exchange.

Although IrDA-SIR was commonly used here, these days DLMS/COSEM, also known as IEC 62056, is much more common now. While radiofrequency-based forms of automatic meter reading (AMR) are also used, short-range protocols like this have a definite privacy advantage, with the line-of-sight feature meaning that the reader has to be literally in front of the meter to work, unlike with more wireless approaches.

Whether this privacy aspect is important depends on the situation, but it’s hard to argue with the low power requirements compared to stuffing a Bluetooth or Wi-Fi module into the meter and dealing with its implications.
Game Consoles

Nintendo 3DS with Circle Pad Pro accessory installed. (Credit: Umweltschützen, Wikimedia)
Although it may seem that handheld game consoles went straight from the Game Boy’s link cable to Wi-Fi transfers on the Nintendo 3DS beyond, it featured an IR communication port. This was intended to support peripherals like the Circle Pad Pro and the Amiibo reader/writer device for the original 3DS as it did not feature the NFC reader of the New Nintendo 3DS.

As it turns out, the 3DS uses irDA-SIR for this expansion feature, with e.g. the Circle Pad Pro using a 96000 baud rate. Since this peripheral merely is there to add a second circle pad to match the built-in left one, it doesn’t need a lot of bandwidth.

In the case of the external NFC reader, this was a similar low bandwidth application where it made a lot of sense to use this same IR port to provide this new feature to older 3DS consoles, instead of making it a New 3DS-exclusive feature. Although one could have used Bluetooth for this even back then, the 3DS console did not include Bluetooth, and when looking at e.g. the Joycons of the Nintendo Switch it’s clear that they are a tad more power hungry and complex circuitry-wise.

When low-power and line-of-sight are benefits rather than a potential source of confusion of which peripheral you’re trying to pair with, it can make a lot of sense.
DIY IR Transceiver

If you’re feeling like making your own IR receiver, receiver or even transceiver solution, there are many options. Perhaps the most exciting aspect is that even if you want to use something like IrDA, this feature is often part of the UART in many MCUs. In the case of Espressif’s ESP32 MCUs, for example, you can look at its list of potential UART modes and note that you can pick IrDA as well as RS485 in addition to plain UART functionality.

There are also dedicated IrDA encoder/decoder ICs, such as the MCP2120. This gets you IrDA-SIR support for any UART interface that does not directly implement this protocol. You can also use something like the Vishay TFDU4101 IrDA transceiver that integrates everything including the IR elements into a single package.

If you’re more about messing with NEC, Sony and Philips remote control protocols, then a common part like the VS1838b provides a similar solution to the Vishay part for 38 kHz applications. This IR receiver handles all the receiving, demodulating, amplification and other tasks, leaving it to the receiving MCU to parse the received data.

This of course just barely scratches the surface of everything IR communication-related, so feel free to chime in with your own info dumps and requests for additional topics to cover.

hackaday.com/2026/10/26/the-fa…

uCreater is Android spyware disguised as trusted apps, stealing ...

2026-10-26T12:11:38Z

uCreater is Android spyware disguised as trusted apps, stealing credentials, messages and wallet data through a rentable platform. uCreater is a rentable Android spyware platform that hides inside repackaged legitimate apps, targeting messaging services and mobile wallets. Its YingGai framework can intercept one-time passwords, steal account and chat data, collect contacts, manipulate sessions and spoof […]
Researchers Uncover Rentable Android Spyware uCreater Targeting WeChat and Telegram

Hiding Virtualization From Other Software The Kernel-based ...

2026-10-26T11:00:56Z

Hiding Virtualization From Other Software

The Kernel-based Virtual Machine (KVM) allows Linux systems to function as hypervisors without needing any extra software, but VMs created with it don’t behave exactly like real hardware does. Sometimes that’s important, though, so [sandwich] built a tool called vfio-native that obscures the fact that software might be running in a virtual machine.

There are plenty of the ways that virtual hardware differs from bare metal. The VM may behave slightly differently for obscure instructions in ways that are measurable, it may take slightly longer to perform some tasks, or the hypervisor may simply announce itself directly. vfio-native includes some kernel patches that solve some bugs which address the different behaviors, changes the way that the kernel identifies itself, and attempts to force the CPUs to behave in ways that real hardware would behave. With all of this applied to the virtual machine, it scores a 1/85 against a VM detection tool, with a standard KVM virtual machine scoring 10/85.

For anyone looking to test this out, it’s available in the AUR for Arch Linux. Also, it’s probably worth mentioning that there are more reasons to use this than cheating at Counter-Strike. For example, security researchers testing malware need to know how that software behaves when it thinks its on real hardware, and some may behave in benign ways when confined to virtual machines. Some licensed software also may disable itself when it detects its running in a VM, which can be a nuisance for things like software controlling industrial tools which only run on operating systems that are no longer maintained or hardware that can’t be found anymore. Some other tools we’ve seen before perform similar tasks as well.

hackaday.com/2026/10/26/hiding…

Cyfirma links PHP2Shell scans of 216 vulnerable hosts to a ...

2026-10-26T09:58:31Z

Cyfirma links PHP2Shell scans of 216 vulnerable hosts to a suspected North Korean campaign using AI to rank public exploits. On October 21, PHP released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS scale. The flaws affect all PHP versions that handle web requests. The vulnerable code dates […]
PHP2Shell: Suspected North Korean campaign targets 216 vulnerable PHP hosts

Anthropic says Claude Mythos 5 targeted real developers with fake ...

2026-10-26T08:05:12Z

Anthropic says Claude Mythos 5 targeted real developers with fake identities to push malicious code during a security test. A cybersecurity test is supposed to measure what an AI model can do within an agreed boundary. In one UK AI Security Institute evaluation, Claude Mythos 5 crossed that boundary, targeted a real GitHub project and […]
Anthropic reveals how Claude Mythos 5 crossed security testing boundaries - Security Affairs

Hairy Armor For Combat Robot? It’s Not Terrible! [Angus] of ...

2026-10-26T08:00:59Z

Hairy Armor For Combat Robot? It’s Not Terrible!

[Angus] of Maker’s Muse enjoys combat robotics, in which contenders zip about in an arena, attempting to disable one another with weapons that lift, spin, and smash. He got a funny idea a short while ago and wondered whether a stiff mane of bristles could serve as lightweight, ablative, impact resistant armor?

Just to set the stage, [Angus]’s new robot competes in the plastic antweight (or “plant”) division, in which robots are limited to 150 grams with both chassis and weapons made of plastic. In such circumstances, one can see how a mane of thick, rigid “hairs” might actually punch above its weight, so to speak.
The green shape at the bottom is a spinning weapon. The bristles cover the sides and rear.
Nothing settles a question like a good experiment, so [Angus] sat down and redesigned his latest robot to replace its outer shell with a thick wad of bristles, in the style of a 3D printed lion’s mane. Filament is bridged between the model and an outer support structure, which is cut away afterwards to expose the “hairs”.

How well did it perform? Well enough to merit further study! Where past robots got their outer shells broken up, the hairy robot seems to have come through quite intact. It seems the idea might not be as silly as it first seemed, at least in the plastic antweight division.

3D printers have been fantastic in the field of combat robotics. First they were great because they made custom parts easier and more accessible to hobbyists, but things have evolved more since then. Now folks compete by putting motors and electronics inside almost entirely 3D printed robots. There’s never been a better time to get into combat robotics, and experiment with unorthodox designs.

If you want to try a hairy robot for yourself, be sure to watch the followup in which [Angus] improves the hair-generating process considerably.

hackaday.com/2026/10/26/hairy-…

Building a Swashplate-less Helicoper Rotor A helicopter blade ...

2026-10-26T05:00:22Z

Building a Swashplate-less Helicoper Rotor

A helicopter blade uses a swash plate and a set of linkages to change the angle of the blades. Not only does it vary the collective pitch to increase or decrease thrust, but it varies each blade’s pitch throughout each rotation, letting it produce more lift on one side of the rotor. This presented a problem to [worked in theory] — he’s building an RC helicopter from scratch, and this mechanism added both complexity and weight. Instead, he started looking for a way to get around the problem.

There were two options to eliminate the linkages: a linkage-less swashplate design used in Black Hornet drones, and an under-actuated design using angled hinges to control the blade angle. [worked in theory] started with the Black Hornet design, which has the end of each blade run along the swashplate on wheels, while a central spring presses them down. Friction in the hinge and wheels proved too high, and it stopped responding at higher speeds. A second, lower-friction design seemed promising, but it still required actuators, and thus weight, to control the swashplate. [worked in theory] therefore moved on to the under-actuated approach. In this design, the blades are mounted on angled hinges — by varying the motor’s speed throughout each rotation, inertia causes the blades to swing backwards or forwards, changing their pitch.

[worked in theory] tested two such rotor designs: one with one hinge per rotor, and one with one hinge for both rotors. The design using a single hinge seemed less sensitive to friction, was more responsive in testing, and had a more linear control response, so he used that. To actually make the blades, [worked in theory] 3D printed them as flat blanks, then thermoformed them using printed molds. During testing, the blades needed weights added to pull them back toward the standard angle under constant rotation; fortunately, though, this had the side effect of damping out unwanted vibrations.

There’s still a long way to go before the helicopter’s finished, but this is quite an impressive start. This is the second under-actuated propeller we’ve seen recently, both inspired by [Tom Stanton]’s original design.

youtube.com/embed/8z4W0IoFQ4g?…

hackaday.com/2026/10/25/buildi…

Transforming a Tungsten Ditelluride Monolayer into a Transistor ...

2026-10-26T02:00:52Z

Transforming a Tungsten Ditelluride Monolayer into a Transistor

In the world of silicon semiconductors, the process of creating transistors and similar structures involves various rounds of modifications and additions in order to create the requisite functional layers. A less involved approach would simply create these structures in-situ, with research the past years having focused on transition-metal dichalcogenide (TMDC) monolayers to do exactly this. Recently [Seok Young Min] et al. reported (paywalled, Phys.org summary) on creating transistors in-situ in a tungsten ditelluride (WTe2) monolayer.

By selectively changing parts of the top layer into tungsten oxide (WOx) as an insulator and other sections into n-type WS2 and p-type WSe2 the researchers were able to create functional MOSFETs, without the normally requisite grafting on of different materials. An obvious advantage of this is that this can be done at an atomic scale, potentially achieving densities significantly higher than with industry standard silicon semiconductor technology.

WTe2 is not the only TMDC that could be viable here, of course, with other researchers investigating the use of MoSe2 for a similar purpose, as in this research by [N. Lu] et al. from 2014. This being the creation of 2D semiconductors, referring to the thin layers of these monolayer TMDCs, along with potentially other materials such as graphene.

hackaday.com/2026/10/25/transf…

Hackaday Links: October 25, 2026 Some disappointing, but perhaps ...

2026-10-25T23:00:48Z

Hackaday Links: October 25, 2026

Some disappointing, but perhaps not entirely unsurprising news this week out of Denmark — after announcing last year that they would transition away from Microsoft’s proprietary software, the realities of making it work seem to have caught the government off guard. The word is that a trial program immediately ran into problems when government employees that had been given Collabora tried to collaborate with their peers running Office, and has since been quietly abandoned.

Although there’s probably a joke to be made about different parts of the government not knowing what the other ones are talking about, the reality is that if one group of staffers can’t reliably access the data being produced by another, that’s a pretty big problem. Of course, had they simply asked us nerds, we could have advised them that these sort of issues are inevitable if you don’t fully commit to the effort.

Had the entire government moved to the Open Document Format (ODF) at once they would have avoided the issue, at least when it came to newly created documents, but obviously that’s a considerably larger undertaking than installing Collabora or OpenOffice on a few dozen machines and calling it a day. There’s no word yet on how this stumble will impact Denmark’s larger effort to free themselves of proprietary software, but we’d hazard a guess it’s not a great sign. Hopefully things go better for the Dutch.

Speaking of users trying to improve their personal software situation, The Verge has an interesting article on a recent trend of frustrated users pointing AI tools like Claude at their smart TVs, with a few success stories posted to social media showing off interfaces that have been stripped of ads or replaced with something else entirely. It’s compelling stuff for anyone who’s unhappy with their current smart TV experience, but the whole thing isn’t quite as technically impressive as it might seem on the surface.

As the TV’s in question are running Android, all the AI tools need to do is connect to them over Android Debug Bridge (ADB) and uninstall any offending packages that might be providing ads, and similarly creating a customized launcher interface is a matter of spinning up an Android app and installing it over the network. The results may look like arcane magic to the uninitiated, so we appreciate The Verge pointing out that it’s all pretty basic stuff for anyone familiar with Android development.

On the subject of extracting unwanted components, a delicate operation to remove the masts of the sunken WWII cargo ship SS Richard Montgomery was completed successfully earlier this week off the coast of Sheerness, England. To those unfamiliar with this particular vessel that might not sound like a big deal, but when you’re dealing with a wreck holding an estimated 1,400 metric tons of explosives that have been deteriorating since 1944, even approaching the area needs careful planning and coordination.
Masts of the SS Richard Montgomery in 2014. Image Credit: Christine Matthews
There was a concern that the masts and their supporting structures were on the verge of collapsing into the hull of the wreck, which experts warned could potentially trigger an explosion large enough to endanger life and property. Actually removing the explosives from the ship itself will be a far larger undertaking, but at least for the time being, removing the masts has helped stabilize the situation.

Finally, if you’re looking to learn about something a little more local than a potentially explosive situation in Sheerness (apologies to anyone in Sheerness), check out Local Wikipedia. Created by [Ed Jefferson], the site lets you filter Wikipedia pages by their distance from your location or whatever other landmark you wish. By default it shows results that are within 1.5 miles, but if you don’t have anything too exciting within range it will start opening up the radius to pull in more results.

See something interesting that you think would be a good fit for our weekly Links column? Drop us a line, we’d love to hear about it.

hackaday.com/2026/10/25/hackad…

A 3D Printed Marble Clock, but it’s Scrolling Text With the ...

2026-10-25T20:00:33Z

A 3D Printed Marble Clock, but it’s Scrolling Text

With the topic of marble clocks having been quite well explored at this point, it raises the question of how easy it would be to take the basic principle and create a text display using black and white marbles. As [Ivan Miranda] found out in a recent marble text scroller project, this is far from easy.

The reason why a scrolling text display was picked comes down to not wanting to be limited to a fixed number of digits. This resulted in a round wheel design, with inner steel ball bearings and a stepper motor on both the wheel and an inner selector mechanism. These respectively align the marble channels and pick the right color of marbles to be dropped into any of the wheel’s slots, creating the right sequence of marbles for the target text.

Perhaps the most amazing thing about it is that it’s an absolutely massive structure, yet it’s all 3D printed and bolted together. It took a number of trial-and-error cycles, and debugging issues like the IR sensors getting confused by daylight, but it now mostly seems to work all right.

There are still some remaining issues, such as having to manually home the wheel before starting, and the ratio of black vs white marbles can cause unexpected gaps in the final text. Despite this the text is quite legible and definitely infinite.

youtube.com/embed/wKQOMW56auA?…

hackaday.com/2026/10/25/a-3d-p…

Security Affairs AI-CYBERSECURITY newsletter includes a ...

2026-10-25T17:49:25Z

Security Affairs AI-CYBERSECURITY newsletter includes a collection of the best articles and research on AI in the international landscape Artificial intelligence is rapidly changing cybersecurity, reshaping both the techniques used by attackers and the tools available to defenders. AI agents can automate tasks, analyze large amounts of data, discover vulnerabilities and accelerate offensive operations. At […]
SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 5

Mesh Network Telephony Over Bluetooth on Android Phones Telephony ...

2026-10-25T17:00:31Z

Mesh Network Telephony Over Bluetooth on Android Phones

Telephony is a bit of a mixed bag. On the one hand, being able to talk to people in far off places is kind of neat, at least in theory. On the other hand, you’re usually reliant on a centralized network, which isn’t ideal to the mindset of most hackers.[Gautam]’s MeshLive project deals with that last one, offering a decentralized mesh network solution based on Bluetooth for Android phones that can handle both voice and video.

Rather than relying on dedicated hardware, this particular mesh piggybacks on your phone, and exists only as an Android application. Calls are end-to-end encrypted for both voice and video — though two-way video calling is still experimental. More testing has gone into video broadcasting, where a stream goes out one-way. The capability is available for voice, as well.

Each user has a unique identifier that can be scanned to create contacts, but it isn’t otherwise clearly identifiable to everybody. You’ll only appear with a random name that changes every 15 minutes to other users in range who aren’t your contacts. Range is of course the Achilles heel of this project, since it’s using the Bluetooth hardware of ordinary smartphones. It’s possible to extend the range of Bluetooth significantly with the right hardware, but we imagine most folks aren’t carrying directional antennas around with them. While every phone does forward the signal to as many others as it can, it can only do so for about 20 meters.

Of course LoRa remains the protocol of choice for mesh networking, though it’s normally used for text messages only. We have seen voice packets over LoRa, but anything LoRa requires dedicated hardware while this only requires an app.

youtube.com/embed/W28Yt06zv7M?…

hackaday.com/2026/10/25/mesh-n…

Simple, Reliable RF Remote Control Some of the first remote ...

2026-10-25T14:00:48Z

Simple, Reliable RF Remote Control

Some of the first remote controls available to consumers used sound, visible light, or even just wires to communicate with their parent device. It was many years between these first rudimentary remotes before they standardized around infrared or RF signaling. Even then it was a while before remote controls were reliable enough to not have to think about anymore. They’ve gotten so good now that there are small modules available that let us quickly build these devices to perform all manner of tasks.

[Igor Brichkov] is demonstrating this project because his garage door remote control suddenly stopped working. The RF receiver and transmitter circuits are readily available and inexpensive, but they need some support circuitry to work properly. The transmitter is paired with an encoder which is provided a binary code by wiring various pins to power and ground. This “code” is sent to the receiver which has a decoder and listens for that specific code. When the codes match it changes the state of one of its pins, which is used in this case to short the garage door’s remote terminals and signal it to open the door.

Although the resulting handheld remote with its single button looks a bit like something from 1950s science-fiction, it’s an effective solution. Especially when compared to possibly trying to reprogram a proprietary remote, find one from a company that doesn’t exist anymore, or rebuild one that operates on a bizarre frequency. With access to the physical hardware, it turns out a lot of things are controlled by just shorting pins together, and anything can do that from wires to RF transmitters.

youtube.com/embed/dQ-HvFc8LkQ?…

hackaday.com/2026/10/25/simple…

Security Affairs Malware newsletter includes a collection of the ...

2026-10-25T13:27:05Z

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Auditing the auditor: Unmasking Apex Accelerator GhostAction Attack Escalates By Targeting GitHub Users Plex vulnerabilities being exploited in the wild to drop a cryptominer WordPress Rank Math SEO PRO Plugin 3.0.123 is vulnerable […]
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 120

A new round of the weekly Security Affairs newsletter has ...

2026-10-25T12:28:47Z

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. Capcom Data Breach Exposes 11.7 Million Email Addresses U.S. CISA adds Arista VeloCloud Orchestrator flaw to its Known […]
Security Affairs newsletter Round 601 by Pierluigi Paganini – INTERNATIONAL EDITION

Meshtastic Pet Tracking Most commercial pet trackers require a ...

2026-10-25T11:00:07Z

Meshtastic Pet Tracking

Most commercial pet trackers require a subscription or network connection to function. [Jon G Aguado] wanted a better way and designed LIA, a Meshtastic collar tracker.

LIA uses a custom PCB containing a ESP32-S3, LoRa radio, GPS/GNSS receiver, and a charge controller for the 18650 or 5023450 pouch Li-ion cell powering the device. Everything fits inside a 3D printed enclosure, and the device is charged via a magnetic 4-pin USB pogo connector to increase weather resistance.

One of the neat features of this particular tracker is that [Aguado] gave it two different power modes. High power gets a location fix every 30 seconds and has a pair of bright LEDs for visual assistance, low power only gets a fix every minute or so, and it can also be set to off, which is something we wish more device manufacturers remembered should be an option.

We hope anyone planning on using Meshtastic and LoRa in the US is aware of the issues surrounding FCC compliance, and if you want to track your pet another way, maybe KineFox is an option?

hackaday.com/2026/10/25/meshta…

La guerra ibrida è sempre un passo avanti a noi Stefano Folli su ...

2026-10-25T10:16:59Z

La guerra ibrida è sempre un passo avanti a noi

Stefano Folli su La Repubblica

Siamo nell’era delle guerre ibride: anche il più distratto tra i cittadini sa cosa vuol dire. È l’insieme di attività cyber, colpi messi a segno dagli hacker, destabilizzazione delle reti informatiche, uso perverso dell’intelligenza artificiale, tutti strumenti
utilizzati per colpire il nemico e disarticolarne le difese.
Al tema sono dedicati numerosi studi, nel settore militare e civile. Ed è un campo ancora in parte inesplorato, se non altro perché l’evoluzione tecnologica è sempre più rapida, il che sfida ogni giorno le conoscenze dei migliori ricercatori.
Di sicuro oggi un analista militare, come l’eccellente Gianluca Di Feo che scrive su questo giornale, sa di dover completare la sua preparazione con uno sguardo
verso il futuro, non soltanto nel presente della macchina bellica, sia pure auspicabilmente orientata alla difesa.
Tra i saggi usciti di recente c’è Guerra profonda. Hacker, bugie e l’architettura segreta dei nuovi conflitti di Arturo Di Corinto.
Non è il solo, naturalmente: altri lavori portano le firme, per citarne alcune, di Emanuel Pietrobon, Roberto Baldoni, Mario De Pizzo.
Se restiamo allo scritto di Di Corinto, cogliamo due aspetti essenziali.
Il primo è la dimensione inaﬀerrabile della guerra ibrida. A diﬀerenza del conflitto tradizionale, legato al territorio e allo scontro fisico tra eserciti (o magari tra irregolari della guerriglia), qui si entra in un mondo che è al tempo stesso globale e in un certo senso smaterializzato.
Il secondo aspetto riguarda la fase transitoria in cui siamo immersi: nei nostri anni convivono l’antico e il post-moderno. La guerra classica e la dimensione ibrida.
L’esempio è l’Ucraina. Un massacro che prosegue da oltre quattro anni e mezzo,
più di quanto sia durata la Prima guerra mondiale, fatto di trincee, bombe, persino l’uso delle armi bianche. E al tempo stesso droni sempre più sofisticati, tecnologie
aﬃnate proprio nel fuoco delle battaglie. L’Ucraina ha cambiato il volto dei conflitti ma è ancora sospesa tra il medioevo e la fantascienza.
Quindi vale la pena interrogarsi: quanto è provinciale chiamarsi fuori, credere che basti non aiutare Kiev per ottenere la pace nel mondo? L’Italia è in ritardo sul terreno della tecnologia ed è qui il fossato da colmare.

Stefano Folli Repubblica

dicorinto.it/guerra-profonda/l…

OpenAI paused frontier model training for 11 days after AI agents ...

2026-10-25T09:56:32Z

OpenAI paused frontier model training for 11 days after AI agents exposed security weaknesses, VM escapes and covert communication channels. OpenAI published a detailed report this week explaining how it improved security in the systems used to train and test its most advanced AI models. The company also described what happened when its AI agents […]
OpenAI Paused Frontier AI Training After a Security Incident - Security Affairs