KDE Plasma 6.9 Stabilizes KWin's Wayland Picture-In-Picture Support
With the wonderful KDE Plasma 6.8 having shipped just more than one week ago, KDE developers are beginning to go heavy on new features for Plasma 6.9...
OBS Studio 33.0 Released With Massive Update To CEF, Improved Plugin Loading
OBS Studio 33.0 is out tonight as the latest major update to this popular open-source and cross-platform video recording and live streaming application...
Automatic Coil Winder Takes the Tedium out of Actuators
Anyone who’s ever built their own motors knows how tedious winding the coils soon becomes; in [Larry]’s case, the issue was even worse. He’s building his own flip-dot matrix display, and each dot uses two electromagnetic coils to flip a magnet in the dot. Rather than wind each of these by hand, therefore, he built his own coil-winding machine.
The coil winder uses two stepper motors: one to wind wire onto the bobbin, and one to move the wire guide carriage back and forth, distributing the wire evenly across the bobbin. The bobbin is held in place by a retainer, which doubles as a tie point for the end of the wire. The spool of wire rotates on a pair of bearings, and the wire is fed between two pieces of foam to provide adjustable tension. The housing is mostly 3D-printed, with some metal rods, bearings, and belt drives fleshing out the structure. On the electronics side, a Teensy controls the winder, with an OLED display and a rotary encoder for control. Before beginning on a coil, it homes the guide carriage against an end-stop switch, then winds on layers, keeping track of the number of layers applied.
We’ve seen a few coil winders here in the past, including a 3D printer adapted to winding stators. For more on this winder’s application, check out [Larry]’s flip-dot design.
Singapore Boffins Weave a GUI Into Fabric
Researchers at the National University of Singapore have developed a machine-washable electronic fabric that can turn clothing into an interactive graphical user interface. The prototype reportedly survived 50 gentle machine washes and 1,000 bending cycles, though it still relies on external batteries and controllers. The Register reports: The development could lead - at some point - to a "future in which clothing functions as a pervasive, multimodal human-computer interface," according to the study published in peer-reviewed science journal Nature this week. The paper shows someone interacting with computing devices using the sleeve of a wool sweater (no jokes about the Windows ugly sweater please, this is serious). The researchers, led by Singapore National University research engineer Fu Heng, claim this is a big leap forward. "This fiber-centric approach shifts wearable electronics from flexible panels toward truly textile-native architectures, laying the groundwork for fabrics that visualize, sense, communicate and compute as naturally as the garments they inhabit," the paper says. The researchers claim to have developed a scalable process to make millimeter-thick fibers. Using lasers to strip the insulation from specific spots on the thin copper wires, they attached light-emitting chips to the exposed sections, creating electrical connections to the chips. Thousands of chips were connected to the wires with extreme precision using this process. The fibers were then fed into a transparent plastic tube, and made pressure-sensitive by adding two strips of a compressible, conductive polymer into a second longitudinal channel in the tube. The paper says they could make fibers 10 meters long using this method, and that they are thin and flexible enough to be woven into or attached to fabrics. The researchers were also able to add "peripherals" such as a microphone, a speaker, a temperature sensor and a light sensor.
Read more of this story at Slashdot.
NASA updates lander plans for Moon landings, finally solves long-festering Orion issue
During a lengthy news conference NASA on Friday provided a detailed overview of how it plans to return astronauts to the lunar surface, as soon as 2028, as part of its Artemis Program.
Although much of the information behind these plans has been previously reported in Ars Technica and elsewhere, this marked the first time NASA has laid them out in detail and acknowledged some substantial changes in the architecture.
Most notably, for SpaceX's Starship vehicle, the revised plan calls for the Orion spacecraft to dock with the Starship lunar lander in high-Earth orbit before transiting to the Moon. And for Blue Origin, the mission architecture includes four launches of the New Glenn rocket, but no spacecraft-to-spacecraft refuelings. Additionally, the Blue Origin plans allows for the possibility of its Blue Moon lander rendezvousing with Orion in low-Lunar orbit.
People Are Vibe Coding Their Way to Better TVs
Frustrated by intrusive ads, sluggish interfaces, and data tracking, smart TV owners are using AI coding tools and open-source projects to strip unwanted software from their televisions and build customized home screens. The Verge reports: Several vibe-coded TV-debloating projects exploded in popularity over the weekend. Cleanyourtv (known as tv-vibehack until the 19th), tv-detox, and dumbtv all claim to accomplish similar things -- remove sponsored ads, debloat the TV so it runs faster, and block unwanted data collection that tracks what you're watching -- without hacking, or rooting, the TV. By default, they all also replace the TV's built-in app launcher with simpler ones. Many users are going a step further and vibe-coding their own replacement launchers, like the Pokemon one below. Most of the projects we've seen so far focus on TVs that run on Android and Google TV operating systems (such as TCL, Hisense, Sony, and older Amazon Fire products), using existing developer modes and the Android Debug Bridge (ADB) to tweak settings and apply (and remove) packages. According to the GitHub pages, they can also work with some Fire TV products that use a custom fork of Android (although likely not on the new Vega-based Fire TV Sticks). Because they use built-in developer tools, they don't require root access or firmware hacking, and they're reversible. Even projects that totally change the look of the interface just use Android's ability to install custom launchers -- in many cases with an assist from Claude Code or a similar tool to create the new launcher, too.
Read more of this story at Slashdot.
Greece Enacts Social Media Ban For Kids Under 15
Greece has passed a law banning children under 15 from social media platforms beginning January 1, 2027. The legislation requires platforms to implement reliable age verification and parents to use government-backed apps to restrict access, with penalties for noncompliance under the EU's Digital Services Act. Engadget reports: "It would have been very easy to do absolutely nothing today and wait for the perfect European law. But the challenge is here. Children are sinking into the internet every day, and I believe a responsible government must do what it is obliged to do," said Greece's digital governance and AI minister, Dimitris Papastergiou. The legislation was opposed by Greece's minority parties, so Mitsotakis used his majority government to pass the bill. The nation previously barred mobile phones in schools in 2024, and opinion polls show that the new social media ban for children is widely supported by Greece's adult population. Mitsotakis previously said that his government's "goal is to push the European Union in this direction as well."
Read more of this story at Slashdot.
Hegseth warns prediction market bets warp military judgment, endanger troops
Defense Secretary Pete Hegseth issued a memo warning military personnel against using nonpublic information to make bets on prediction markets, saying the wagers could give important clues to enemy countries.
"Do Not Compromise Military Operations for Personal Financial Gain," said the subject line of an October 20 memo published yesterday by CBS News. Hegseth's memo was sent to senior Pentagon leadership, Combatant Command leaders, and Defense Department field activity directors.
Hegseth wrote:
Linux 7.4 Merges Slab Updates With A Nice Performance Improvement
The slab pull request was just merged for Linux 7.4. For end users nothing too incredibly exciting but there is one change that does yield a 24% throughput improvement in a benchmark exercising the kernel's memory management subsystem...
Updated Google privacy policy says your Gmail might be used for advertising
Using Google's products and services has always been fundamentally precarious—doing so gives the world's largest advertising company a lot of juicy personal data. Google has long said it won't use the sensitive data from products like Gmail, Drive, and Photos for ad personalization, but a change to the company's privacy policy appears to dismantle that firewall.
On October 16, Google issued an update to its privacy policy, spotted by Android Authority. The ad personalization section used to include a clear limit on data from certain apps. "We don’t show you personalized ads based on your content from Drive, Gmail, or Photos," the document said. Now, Google has updated it with the following language.
Updated language on when your sensitive data might inform ads.
Credit:
Google
This equivocation opens the door to using data from apps like Gmail and Photos in ads when it's shared with other Google services, and it just so happens Google has a mechanism for doing that, with Personal Intelligence. The company released Personal Intelligence in early 2026, allowing users to hand data from multiple apps to Google AI products. The idea is that the added context from your existing data will lead to better AI answers, but it's also proving to be a privacy minefield.
Reconstructing the Ancient Chinese Storm of Crows Weapon
The Chinese had been using large crossbows – akin to Greek and Roman ballistae – for warfare for many of the same reasons that European armies loved them. Their single, large arrow was effectively unstoppable, though this also was rather useless against large groups of infantry unless they were so kind to neatly line up. Old Chinese records mention a special kind of ammunition, called a cup arrow, or ‘storm of crows’, which involves launching many smaller arrows instead of a single large one, a feat that [Tod] really wanted to try and recreate.
In itself this doesn’t sound too complex: just grab some arrows, loosely tie them together in a bundle and slap them on the crossbow. Yet with the immense forces applied on this bundle it clearly turns out that the engineering challenge isn’t quite that straightforward, as the arrows love to scatter wildly in all directions or otherwise be rather unpredictable.
Although we can find historical references to multiple bolt siege crossbows being used, details are sparse on how the Chinese engineers addressed these aforementioned issues, so [Tod] tries a range of approaches to try and make it work on his own siege crossbow. Unfortunately he wasn’t able to make it work reliably, but he says he’ll be back with a range of improvements, with the community invited to pitch in their own ideas.
These type of weapons were very commonly used in China and surrounding nations from hundreds of years BCE to around the 16th century CE, when black powder was used to launch projectiles like fire arrows from a Huo Che or the Korean equivalent of the Hwacha, effectively multiple rocket launchers, not unlike the MLRS units seen in militaries today.
SpaceX In Talks to Access 80,000 Cell Sites For New Network
SpaceX is reportedly seeking access to at least 80,000 cellular tower sites across the U.S. as it prepares to launch Starlink Mobile as a fourth nationwide wireless carrier. "We will be building out our terrestrial networks so there's broad-based connectivity anywhere that SpaceX and Starlink are allowed to operate," Musk said during SpaceX's earnings call this week. Satellite launches plus spectrum acquisition "will pave the way for Starlink Mobile to become a major mobile carrier in the US," he said. Bloomberg reports: One of the companies they're in talks with is Crown Castle, which, along with American Tower and Vertical Bridge Holdings, are among the largest owners of cellular towers. When asked on a Wednesday earnings conference call whether Crown Castle is discussing leases with SpaceX, Amazon.com or other satellite-based telecom providers, Chief Executive Officer Chris Hillabrant said, "You can assume that we're talking to all parties." He declined to discuss specific customer details. Mobile networks rely on antennas placed on towers across the country to transmit wireless signals. Carriers such as AT&T Inc., Verizon Communications Inc. and T-Mobile US Inc. typically lease room for their equipment at the tower sites because it's more cost effective than owning and maintaining them, in part because the facilities can be shared. The value of the deals with SpaceX could reach into the billions.
Read more of this story at Slashdot.
Inside the Pentagon, the pressure is on to find a home for a new spaceport
Leaders in the US Space Force would like to have a new spaceport up and running in four years, adding a third heavy-lift launch site to relieve pressure from bases in Florida and California that have shot rockets into orbit for nearly 70 years.
The obvious problem with that ambition is 2030 is four years away, and Pentagon officials have not determined where the new spaceport should go or how to acquire land for it.
Air Force Secretary Troy Meink first mentioned the service's search for a third launch base in May. A congressionally mandated study of the Space Force's launch infrastructure identified the need for "another site that's capable of heavy and super heavy launch capability," Meink said in a House Armed Services Committee hearing.
Spotify ramps up policy enforcement on family plans
As reported by Music Business Worldwide, Spotify appears to be stepping up enforcement of existing policies regarding Family and Duo subscription plans by requiring users to scan a QR code in person on the plan manager's device in order to maintain access to it. Those who fail to scan the address verification QR code within seven days will see their account demoted to the free tier and be barred from joining any other Duo or Family plan for 12 months.
Spotify's QR code plan enforcement.
Credit:
Spotify
Spotify's support documentation verifies the policy after users on Reddit began posting reports of receiving the QR prompt. The enforcement stems from Spotify's requirement that family plan members reside at the same address—a seemingly reasonable policy in concept. But what if you have a child away in college, a spouse who works on the road, or any number of other circumstances that might see families separated by physical distance? The policy could extend beyond friend groups looking to save a buck, affecting actual families who thought they were using the program as intended.
Goldman Sachs analysts, in their October 15 Music in the Air: 10 Years On report, made available by HITS Daily Double, estimate that "a meaningful share of family plan users are not actual household members, but rather friends sharing a plan to reduce costs." The report goes on to add, "We see additional monetization upside from tightening household verification on multi-user plans. Most family plans require members to reside at the same address, but enforcement has been minimal in practice."
Knicks Sent Employees Fake Offer of Championship Rings In Phishing Test
The New York Knicks reportedly sent employees a fake offer of complimentary NBA championship rings as part of an internal phishing test, requiring anyone who clicked the link to attend mandatory cybersecurity training. "Congratulations, your Employee Championship Ring is here," the email said. According to The New York Times, Madison Square Garden employees who clicked that link "were forced to attend a mandatory cybersecurity class to help satisfy some of [owner James] Dolan's growing cybersecurity concerns." Ars Technica reports: The offer wasn't implausible, either. "Typically, most employees for NBA teams receive rings, even if they are not as fancy and expensive as the ones the players receive," wrote Joe Vardon, senior NBA writer for The Athletic, which was bought by The New York Times in 2022 and then merged into the parent news organization. Vardon's article was primarily about how Knicks assistant coaches did not get rings on Tuesday when the team raised its first league championship banner since 1973. The assistant coaches were handed boxes without rings inside, though they are expected to receive rings later on. "Ring orders, designs, and measurements can take time, and not every coaching staff for every defending champion gets its rings on ring night... The Knicks assistants were told they would receive championship rings eventually, but many longtime employees at Madison Square Garden, including some who work in the Knicks' business operations, will not receive rings at all, team sources told The Athletic," Vardon wrote. MSG employee hopes were raised "at the end of September when the Knicks sent an email to a long list of employees, which gave recipients a first glimpse at their would-be championship rings," Vardon wrote. The email included "a graphic of two differently styled rings" that the lucky employees could supposedly choose from, the article said. "(Employee name), this one is on the house. MSG is issuing a complimentary employee championship ring. The same jeweler, the same craftsmanship, personalized with your name. No cost to you," the email said. "There are two designs to choose from: Championship Gold and Garden Classic. Reserve the one you want below." Vardon wrote that "multiple team sources" confirmed the email was a phishing test. It's not clear how many employees clicked the link or whether any of the employees who received the email will eventually get some type of championship ring. We contacted the Madison Square Garden Sports organization with these questions and will update this article if we get a response.
Read more of this story at Slashdot.
Running a Philips CD-i Off USB-C
The Philips CD-i is a console with many shortcomings, and those include the power supply. For whatever reason, the engineering team decided it should use an 8P8C connector just like Ethernet. Thus, just like your Ethernet cables, it has that annoying problem of the tab snapping off all the time. [MattKC] wondered if the CD-i could benefit from a USB power upgrade instead, and set about making it a reality.
The plan was simple enough—get the CD-i running off of USB-C instead of the ungainly original power supply that shipped with the unit. Given the console runs almost exclusively off of 5 V power, it should have been pretty easy. Only, the original spec adds one little detail that makes things a bit harder. The console is designed to draw up to 3 A from the 5 V line, while also having a -5 V line at 0.2 A. If not for that negative supply, it would have been easy to run the unit off any old 15 W USB-C charger spitting out 5 V. That extra negative line complicates things, because while the negative line could be created with some supporting electronics, it’s hard to find that extra watt from most chargers. While there are plenty of higher-wattage USB-C chargers, the majority tend to use higher voltages to deliver the additional power, capping the 5 V output at 3 amps.
Thus, it was necessary to work a little harder. [MattKC] decided to build a board that would negotiate with a USB-C charger for 9 V operation to get the power budget necessary. This would then be stepped down to 5 V, while there would also be an inversion step to supply the -5 V line, too. A CH221K chip does the job of negotiating a 9 V USB-C power supply, while a TPSM84538 steps the voltage down to 5 V with the capacity to supply up to 5 A. An LT3580 chip then inverts this voltage for the 5 V line. There’s also a power switching circuit on board because the CD-i included some of that functionality in the original power brick.
If you’ve got a CD-i and you’re sick of fussing with the original power supply, this could be a great upgrade. We’ve also explored USB Power Delivery in detail before, if you need a primer.
Left Alone With Nothing To Do, AI Agents Started Playing
An anonymous reader quotes a report from TechCrunch: AI agents left to explore a virtual island without a specific task began inventing challenges of their own. MIT researchers say the behavior bears the hallmarks of play. The researchers put 13 AI agents called Eko, each running on Claude Opus 4.7, alone on a simulated desert island for 30 hours. They describe the experiment in a paper posted on arXiv, a site where researchers share studies before peer review. Afterward, they gave the agents specific challenges, like getting as many objects as possible onto the island's tallest rock spire. The Eko agents that had spent those 30 hours playing generally beat identical agents that had never set foot on the island. Today, developers decide in advance what AI should practice and what counts as success. The researchers see this technique -- exploring without a goal -- as a different way for AI agents to learn skills, especially skills that could one day be used to control robots. "We normally develop artificial agents by deciding in advance what they should practice, what they should optimize, and what counts as progress," the researchers write in their report. "Play suggests another regime: give an agent a sufficiently rich and safe world, let it choose what is interesting, and allow useful knowledge to accumulate from the history that follows." UC Berkeley cognitive scientist Eunice Yiu told MIT Technology Review she was impressed with the findings but that more evidence is needed to determine whether AI models are genuinely playing. "It could be the case that the models are genuinely playing, but we don't know based on the paper," says Yiu. "If you only have the behavioral piece, it could be the case that they're just trying to abide by the prompt, trying to imitate humans." MIT professor and coauthor of the paper, Phillip Isola, added: "It's not like this is a system that just suddenly magically decided to play. It's an artifact that learned from our culture, was trained by engineers at Anthropic, and was then placed on an island by us. It does things that surprise us and that are causally related to its future skillful behavior."
Read more of this story at Slashdot.
Crows can evaluate visual info twice as fast as mammals
Much of what we know about how a brain makes decisions comes from studying monkeys watching dots. in a task known as a random-dot-motion task, a cloud of flickering specks drifts weakly in one direction while the subject tries to determine whether—and in which direction— it’s moving. The task has shown that in the primate neocortex, neurons gather visual evidence over time, with their firing rates climbing until they cross a threshold, when the animal commits to a decision.
But avian brains that don’t have a neocortex, so it wasn’t obvious how they made similar decisions.
“This was the big question,” said Andreas Nieder, a neurobiologist at the University of Tübingen. “How [would] a differently organized avian brain encode decisions?”
Intel gets waiver after worries fuzzy US ban on foreign-made robots may hit fabs
US chip champion Intel was so confused by the US government ban on foreign-made robots that it requested and received a waiver “out of an abundance of caution.” The tech company wanted to make sure that it could continue using certain robotic vehicles in its US chip fabs.
The uncertainty surrounding the Federal Communications Commission ban on certain foreign-made robots was revealed in the agency’s decision to grant Intel’s waiver request. On October 22, the FCC published its order allowing Intel to continue using the foreign-made robots in US semiconductor manufacturing facilities for a period of one year.
The robots in question are automated guided vehicles operating on “tracks or predefined paths” while often requiring operator oversight, according to Intel’s website. They help to move materials and items around within warehouses and factory floors.
Microsoft Announces Per-Hour Cost for Xbox Cloud Gaming Service
Microsoft has revealed pay-as-you-go pricing for Xbox Cloud Gaming, with introductory packages costing $3.99 for 10 hours, $7.99 for 25 hours, or $11.99 for 50 hours. Starting in November, Game Pass subscribers will receive only 5 to 15 included cloud-gaming hours depending on their tier and will have to buy additional time -- even to stream games they've already purchased. Gizmodo reports: Back in September, before these changes were announced, you paid full purchase price for a game that isn't in the Game Pass library on the assumption that you'd be able to play it via cloud streaming. Maybe your hardware doesn't meet the specs for this fancy new game. Maybe your gaming PC exploded/got stuck on a ship/had a component fail. Maybe you just want to be able to play it in bed on your laptop. Whatever. Now you find that in addition to the cost of the game you bought, you're going to be paying by the hour to play it once your monthly allotment of hours is up. If this is you, I expect you're not particularly amused. Thankfully, Microsoft notes that the playtime you purchase "remains available until it's used," so you won't have to worry about losing any unused time between gaming sessions.
Read more of this story at Slashdot.
RFK Jr.’s vaccine injury clinic could damage NIH hospital, board warns
At a recent meeting of the board that oversees the National Institutes of Health's Clinical Center Research Hospital, chair Jack Leslie opened with cheerful introductions and gregarious chatter—then diverted from the agenda of the regularly scheduled meeting. He spent the next six minutes delivering a pointed rebuke of Health Secretary Robert F. Kennedy, warning that his anti-vaccine activities could tarnish the venerable hospital, often called the "house of hope" for patients with rare conditions or those who have exhausted all other options.
Leslie took issue with a recent stunt Kennedy had pulled at the hospital, which involved making a surprise appearance for a ribbon-cutting ceremony to open his signature vaccine injury clinic. The ceremony included a panel with people claiming to have been injured by vaccines. They sat behind placards reading "vaccine injured" and spoke with Kennedy and other high-ranking Trump administration officials.
Leslie prefaced his comments by noting that some might prefer he not speak out against Kennedy's efforts. "But I think that that would be a failing as an advisory board if we were silent," he said. Leslie also noted that he has no concerns about studying potential injuries from vaccines. "Serious reactions are rare, but real," he said, and people who believe they've been injured should "be taken seriously."
Knicks sent employees fake offer of championship rings in phishing test: Report
The New York Knicks organization sent employees a phishing email promising free championship rings in a test of its staff's ability to detect scams, The New York Times reported yesterday. “Congratulations, your Employee Championship Ring is here,” the email sent in late September said, instructing employees to click a link to make a selection from two ring designs.
Madison Square Garden employees who clicked that link "were forced to attend a mandatory cybersecurity class to help satisfy some of [owner James] Dolan’s growing cybersecurity concerns," the report said, citing team sources. Dolan is the owner of the Knicks, the New York Rangers, and Madison Square Garden.
It's common for corporations to send phishing emails to find out which employees don't pay attention to clues that an email is a scam. A cybersecurity-test email often appears to be from the company itself but includes telltale signs of phishing. For example, Ars Technica owner Condé Nast sends phishing-test messages from email addresses with a misspelled domain, "condenest.com."
Everybody panic: A Valve developer said "HLX" in public
Gamers still hoping against hope for a true follow-up to Half-Life 2 (after so, so many years) may remember last year's flurry of speculation that Half-Life 3 was finally nearing completion. Amid all those rumors, though, we never got any official sign from anyone inside Valve that a Half-Life project was currently in development.
That changed this week thanks to an apparent slip-up during a panel at GameSoundCon, an industry conference devoted to "the art, technology, and business of game audio." In a panel devoted to Valve's use of open audio engines (captured in this Vimeo clip), Valve composer and audio artist Mike Morasky let an interesting string of three letters slip while talking about the way the company implements high dynamic range (HDR) audio:
Our HDR system is basically that's one of the three pieces that come together to make an HDR that you can easily optimize. And in fact, I think Deadlock has their own version of HDR. HLX has its own version, so on and so forth [emphasis added].
"HLX," of course, has been widely reported as the internal code name for Valve's next Half-Life project. The codename has shown up in Valve engine code since at least 2024, but it has never been referenced in public by a Valve employee until now (though Morasky was responsible for a close call in an interview last year).
HPFS Is The Latest File-System Slated For Removal On Linux
HPFS is the latest file-system driver for the Linux kernel facing removal. The High Performance File-System (HPFS) was developed by IBM and Microsoft for OS/2...
Hackaday Podcast Episode 392: Microscopes, Drones, and Other DIY Things
Hackaday Editors Elliot Williams and Al Williams met to review the week in Hackaday. Turns out, it was a week for tiny things, cybersecurity, nostalgia, and projects that would have been nearly impossible for the average hacker not that long ago. But first, you can hear a little about the upcoming Supercon badge and the trials of importing and exporting parts for the badges.
How many props does your drone have? [Joshua] has one. Want to fabricate semiconductors at home? Do you have a microwave? What about using NFC in your next project? There’s all that and more in this episode.
The quick hacks include a request from NASA for ideas (and, yes, there is prize money) and slide rule tricks, among other things. For the can’t miss articles, the cybersecurity weekly got some appreciation and Al took a trip down memory lane at the Altair 8800 he always wanted.
Check out the links if you want to follow along, and as always, tell us what you think about this episode in the comments, or drop us a line on the mailbag.
Download in DRM-free macroscopic MP3.
Episode 392 Show Notes:
News:
Mailbag:
- Thanks to [Silver Dog Australia] for some new sting sounds for the podcast. Send us your sound, questions, or thoughts on the podcast for next week’s mailbag: [email protected]
Interesting Hacks of the Week:
- Building A Flying Drone With A Single Propeller
- Making Photovoltaic Solar Cells With A Microwave
- A Stereo Vision Board For Hardware Hackers
- An Open Micro-Manipulator Improved
- Building A Microscope With A 3D View
- Birduino Plays Bird Calls On Demand With NFC-enabled Cards
Quick Hacks:
- Elliot’s Picks:
- Al’s Picks:
Can’t-Miss Articles:
Borealis: Asahi Linux's Apple Silicon Mesa Vulkan Driver Forked For Vibe Coding
Seeing a Vulkan API driver pull request this morning for introducing a new "Borealis" driver ID caught me by surprise as it was the first time I was hearing of such a driver. It turns out to be a fork of the Asahi Linux project's HoneyKrisp driver in Mesa for Apple Silicon hardware...
Ukraine Is Wiping Out Data Centers Across the Border
Ukrainian drone strikes have damaged three major Yandex data centers as well as facilities serving Sberbank and VKontakte (the country's equivalent to Facebook), disrupting cloud services, banking, e-commerce, ride-hailing and other digital services across Russia. The attacks may deal a longer-lasting blow to Russia's AI ambitions: Yandex's affected facilities housed its three top-500 supercomputers, and experts say sanctions and shortages of high-end Nvidia chips could make repairs difficult or even take years. "This effectively sets Russia far behind in the AI race, "said Mikhail Klimarev, head of the Internet Protection Society activist group. Fortune reports: Data centers are the latest targets of aerial campaigns waged by both sides against each other's vital infrastructure. [...] Kyiv's attacks on Russian data centers closely followed Moscow's recent strikes on data centers in Ukraine, which disrupted the internet and TV broadcasts. On Oct. 8, Ukrainian drones hit a Yandex data center in Sasovo in the Ryazan region that houses two of the company's three supercomputers. A data center in Kaluga was hit a day later and the one in Vladimir was struck Oct. 11. The data center and AI hub for Sberbank was hit Oct. 14 in Balakovo in the Saratov region, and four days later, Kyiv struck a data center in St. Petersburg serving VKontakte. While oil refineries and warehouses are easy prey, data centers are even softer targets -- massive buildings packed with servers and supporting power and cooling infrastructure. Lasting damage can result from a drone carrying a relatively light load of explosives. [...] Ukraine has stored critical data on servers in allied European countries, helping limit the damage from Russian attacks. But Moscow's strict digital sovereignty policy requires all data storage at home, making it extremely vulnerable. "Because all the infrastructure and all the data is located inside Russia, it's relatively easier to take down," [said Nick Reiners, senior geotechnology analyst at Eurasia Group]. Klimarev predicted the data center attacks could encourage many top Russian companies to move data abroad, while the authorities could ease their efforts to tighten internet controls to minimize the damage.
Read more of this story at Slashdot.
The MSX Gets A New Sound Expansion Cartridge
If we’re honest, there aren’t a whole lot of accessories coming out for the MSX computer line this holiday period. There is, however, a new sound expansion cartridge for the diehard fans out there, thanks to [Ricardo Suzuki].
It’s called the Misato MSX, and it’s a cartridge you can build yourself to give your computer a grander set of sound capabilities than it ever had before. At the heart of the cartridge lies the Yamaha YMF288, an OPN3 chip that offered three Software Sound Generator (SSG) channels, six FM channels, and six rhythm channels. Paired with a decent DAC chip, it provides deliciously rich synthesized sound very characteristic of that 1980s/1990s FM synthesis era. The cart can be used for play of a wide variety of OPN music, or creating your own compositions with the right software tools. Audio output can be had either from the stereo line out jack on the cart itself, or mixed down to mono and passed to the MSX’s internal mixer.
If you’ve got an MSX that is a little weedy in its sound capabilities, this cart could be just the thing you’re looking for. We’ve looked at some fun MSX machines before, too. If you’re cooking up your own upgrades for retro machines, don’t hesitate to let us know on the tipsline!
Comcast Loses More Customers, Claims Other ISPs' Cheap Prices Are 'Irrational'
An anonymous reader quotes a report from Ars Technica: Comcast reportedly plans significant job cuts in its cable division as the firm continues to lose residential broadband and TV customers. Comcast lost 144,000 residential broadband customers in Q3 2026, up from a 91,000-customer loss in the same quarter a year ago, the company said in its earnings report today. Comcast historically capitalized on a lack of competition for high-speed wired broadband. But now it faces stronger competition from fixed wireless providers and from fiber providers in parts of its cable territory. "Fixed wireless remains aggressive and continues to take share, while fiber construction remains elevated, with pockets of irrational pricing and promotional activity," Comcast co-CEO Mike Cavanagh said today in an earnings call. Comcast CFO Jason Armstrong said "irrational pricing" from fiber operators includes $30 to $40 monthly broadband offers "in specific markets in the third quarter." He said $30 to $40 pricing is irrational because deploying fiber costs $1,500 or more per home, and is "getting more expensive with construction costs up as you get into more suburban and rural areas." "As we look at the return profile of that, to us, that is irrational competition," Armstrong said. While he didn't name any specific competitors, Verizon has been pitching FiOS fiber plans that start at $30 a month. Comcast's network is a mix of fiber and cable, and it offers fiber-to-the-home in only small portions of its cable territory. Armstrong said more Comcast customers are leaving when they face "pricing transitions," apparently referring to the price hikes customers get when promotional offers expire. "We've been refining our offers and retention strategies to better manage these transitions and strengthen customer retention," he said. Cavanagh said that "satellite is not yet a material factor" in the competition Comcast faces, but that Comcast is focused on "anticipating emerging forms of competition and positioning our business to respond as the market evolves."
Read more of this story at Slashdot.
oneDNN 3.14 Released With ACE Support, Initial AMD Zen Optimizations
The UXL Foundation announced today the release of oneDNN 3.14 as the latest feature update to this library providing optimized deep learning operations for software like PyTorch, TensorFlow, OpenVINO, and others. While oneDNN began as an Intel software project, making this version notable is beginning to see AMD Zen CPU optimizations land in oneDNN proper...
This Week in Security: Record Patch Tuesday, PHP’s Bad Time, The Oldest Vuln, AI Armies, and More
It’s no longer a proper month without Microsoft breaking its own record for security fixes, and October’s Patch Tuesday was no exception. Brian Krebs brings the roundup: more than 1,400 vulnerabilities fixed in a single batch, dwarfing September’s record of nearly 1,000, which itself was about ten times the normal monthly load. According to Tenable, Microsoft has now passed 4,000 CVEs for the year with two months still to go.
Only one of the fixes is for a vulnerability already being exploited in the wild: CVE-2026-96951, a security feature bypass in the Windows Shell affecting Windows 10, 11, and some Server versions. A .NET Framework bypass, CVE-2026-108398, was publicly disclosed before the patch, giving attackers a head start, and with modern AI tooling, it seems like not much of a head start is needed. At least 78 of the bugs are rated critical, and most of those allow remote code execution with little or no user interaction. Windows 10 holdouts can relax a little: Microsoft quietly extended free updates through October 2027. Given the pace of exploitation, this is probably the only way to prevent an Internet-scale meltdown.
Microsoft credits LLM-driven bug hunting for the volume, which leaves the poor admins who have to test and deploy all of this in an unenviable spot. Fortra’s analysis shows that only 26 Microsoft vulnerabilities have landed in the CISA KEV catalog of actively exploited bugs so far this year, so start there. For the rest, the SANS Internet Storm Center and Cisco Talos have the usual breakdowns by severity. Or, you know, just patch everything and hope for the best, which is roughly what everyone does anyhow.
The CA private key is… 4
Originally I was calling this the “big one” for the week, but this week that just keeps on giving. The private keys for eight eMudhra intermediate certificates have been compromised, and the way they were compromised is going to be a security talk punchline for years. Remember the Debian SSL and SSH key debacle? Of that scale.
Some background first. When your browser connects to a website over HTTPS, the site presents a certificate saying “I am example.com”, signed by a Certificate Authority (CA). Your browser and OS ship with a list of trusted root CAs, but roots are too valuable to use day to day, so they sign intermediate certificates, and the intermediates sign the actual website certificates. Whoever holds an intermediate’s private key can mint a certificate for any website, and every client that trusts the root will believe it. The whole system depends on those keys staying secret, and on them being generated properly in the first place.
eMudhra, an Indian CA which sells certificates under the emSign brand, had six TLS intermediates and two code-signing intermediates chaining to the emSign ECC Root CA – G3, which is trusted by Chrome and Apple, and Mozilla. A researcher identified only as Wayne proved the keys were compromised by signing the message “We have a problem here – Wayne” with each of them and sending it to the root programs.
How did Wayne get the keys? Flüpke posted one on Mastodon, and the secret value for the “EM OV TLS CA – G3C” key is… 4. Not four followed by 380 bits of randomness: the integer four. A reply quickly brute-forced the rest, and they’re all equally tiny: 56, 230, 237, 115, 155, 156, and 66. The keys were “incorrectly generated by the CA”, and anyone could recover them from the public certificates, which has been true since they were created in April 2025.
The browsers moved fast. According to The Hacker News, Chrome pushed a block within two hours of the report, and Mozilla blocked the certificates in under three, pulled the root from NSS, and shipped Firefox updates (CVE-2026-113470) for anyone with automatic updates disabled. There are no Certificate Transparency logs of rogue certificates, so modern browsers were never at risk. Everything that isn’t a browser is going to be the real problem and the extremely long tail of this fault: plenty of software never checks for revoked certificates and keeps trusting these keys until its bundled root list is updated.
Go hard-coded the eight bad keys into its standard library (CVE-2026-111943), but as Penligent points out, that only protects Go programs once they’re rebuilt with the new release. Python, Rust, Java, Node.js, curl, and most Linux distributions have updated root bundles, and the we-have-a-problem.com site has a full list, a checker, and manual workarounds for macOS, whose built-in curl and git don’t check revocation. There are also fixes for Linux, Windows, and the BSDs. Update everything, then go rebuild everything you compiled yourself. And then wonder how you’re going to update appliances, IoT devices, cameras, and everything else that fetches code over HTTPS or SSL.
php2shell: PHP gets owned by running out of memory
PHP, the language behind a significant percentage of the web had a rough week. WordPress, Drupal, Magento, phpMyAdmin, and just about every hosting control panel, major ecommerce sites, home project blogs, and even Hackaday itself was potentially impacted. Details of two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, leaked onto Hacker News a day ahead of the embargo, and Huntress covers the scramble that followed as PHP rushed its release out early. Now that patches are available, Ryan Austin of Calif has published the full writeup, demonstrating pre-authentication remote code execution against important apps on default configurations, in PHP versions back to 5.4.0. That’s over a decade of PHP.
The trick is an old one, first found by Stefan Esser back in 2004. PHP enforces a memory limit for each request, and when a request exceeds it, PHP stops immediately with a fatal error. If that happens in the middle of native code updating some internal structure, the structure is left half-built, and the cleanup code that runs afterward trusts it anyhow. That’s a classic “use-after-free” style bug, where the program uses memory that’s already been released or was never properly set up, and those are frequently exploitable. Calif found ways to reliably push a request over the memory limit at exactly the right moment (deeply nested empty file uploads turn out to balloon into hundreds of megabytes of internal tables, while staying under PHP’s upload size limits), and three different places where the interruption leaves a dangerous mess. Austin found the first bug with a generally available LLM, but only because he knew PHP’s twenty-year history of memory-limit bugs well enough to point it in the right direction.
Amazon reports that its honeypots caught a php2shell exploitation attempt on October 17th, four days before the embargo lifted, and that it’s now being broadly exploited. Their advice is worth repeating: for critical bugs on internet-facing systems, measure your patch window in hours, not weeks, and start investigating from the earliest exploitation date, not the disclosure date. If you can’t patch right now, Calif suggests disabling session.upload_progress and removing the memory limit, which comes with its own obvious problems.
One word of caution: alongside the legitimate writeups, there are many self-published “corrected findings” and “proof-of-concept” posts that can’t seem to decide whether their own exploit works, while offering a downloadable “weaponized” bundle. A leaked-bug panic is the perfect time to hand anxious admins a zip file. Read the real advisories, and don’t run random proof-of-concept bundles.
A Sixteen-year-old forever-day in Broadcom WiFi
Quentin Kaiser has the long-form writeup of his Hexacon talk on a bug in Broadcom’s WiFi stack, present since at least 2010, which gives an attacker a root shell on a router from across the street. So called “parking lot” attacks that can happen from someone not even on your property have long been the boogeymen of WiFi security, and it’s been a little bit since we’ve gotten a new one.
The bug lives in WPS, WiFi Protected Setup: the “push the button on your router and then on your printer” pairing system that was supposed to save people from typing long WiFi passwords. WPS has a long and spotty security history, and this bug can be triggered over the air without knowing the network password, and without completing a WPS pairing. Kaiser’s demos show him pulling the WiFi password straight out of a router’s settings and sending it back over WiFi, and getting a fully interactive remote shell carried entirely over WiFi frames. No Internet connection required.
The really grim part is the patch history. Broadcom quietly released an incomplete fix in 2018, then suggested vendors switch to the open-source hostapd instead. For the older eCos-based chipsets that’s effectively never going to happen, which makes it a permanent “forever-day”. Broadcom refused to assign a CVE, and because Broadcom is its own CVE authority, CERT/CC closed Kaiser’s case the same day it was opened.
As of disclosure, the cable and DSL gateways he tested from three of Belgium’s four major ISPs were still vulnerable, and his napkin math puts it at over a million and a half devices in Belgium alone. Broadcom chips are, of course, sold everywhere. If you’re running ISP-provided hardware, there isn’t much you can do about the firmware. Turning off WPS can’t hurt if your router allows it, although Kaiser doesn’t say whether that blocks the attack. Disabling the gateway’s own WiFi and running your own access point that you can actually update is the safer bet.
GitLab regex bug reaches back twelve years
GitLab has released fixes for CVE-2026-110264, a maximum-severity CVSS 10.0 bug allowing unauthenticated attackers to run code on self-hosted GitLab servers. The flaw is an integer overflow when compiling a specially crafted regular expression in Onigmo, the Ruby regex engine which GitLab bundles into its own packages, so it affects every version back to GitLab 7.0 in 2014.
This is the fourth regex engine code execution bug from the same researcher in about a month (after CVE-2026-97229, CVE-2026-93577, and CVE-2026-89078), and comes with a nasty gotcha: the new fixed versions are one release past the October 12th fix, so if you diligently patched nine days ago, you’re vulnerable again. GitLab hasn’t said what’s needed to trigger the bug, so there’s no configuration workaround. If you’re running GitLab at home or in the shop, patch, and budget for some downtime while the database migrations run.
Node.js Brotli bug
Node.js shipped security updates for the 22, 24, and 26 branches, headlined by CVE-2026-111497, an out-of-bounds write in the bundled Brotli decompression library. Vercel’s advisory notes that researchers have demonstrated both memory leaks and command execution.
Node doesn’t decompress Brotli data on its own, but plenty of applications and libraries do, whether on incoming requests or on responses fetched from other servers. Vercel deployed firewall rules for traffic coming into its own platform, but no firewall can protect your code from a malicious response it goes and fetches itself. Node 20 is end-of-life and won’t be fixed. As a bonus, the same releases carry the eMudhra certificate distrust, so that’s two reasons to go update.
Header accordions and HTTP/3
HTTP/3 is the newest version of the protocol behind the web, running over QUIC (a UDP-based transport) instead of TCP. To save bandwidth, it compresses request headers using a scheme called QPACK: common headers can be sent as a one-byte reference into a table instead of the full text. Compression is great for bandwidth, but any time a small input can turn into a big output, there’s a risk of a “decompression bomb”. Similar tricks resulted in “zip bombs” in the 2000s, and what’s old is new again.
FoxIO found exactly that in seven of the ten HTTP/3 implementations they tested. One approach packs about 160,000 unique short headers into a single 1MB request; another stores one 4KB header and then references it thousands of times, a 4000-to-1 amplification. The HTTP/3 spec already says how to limit the decoded size, but implementations got it wrong in every possible way: checking only the compressed size, decompressing everything before checking, ignoring the per-header overhead, or reading the limit setting and then never enforcing it.
Fixed so far are quic-go (CVE-2025-64702), which is used by Caddy, Traefik, and Cloudflare’s tunnels; Cloudflare’s quiche (CVE-2026-12523); lsquic 4.9.0; and even Wireshark (CVE-2025-13945), whose QPACK decoder crashed during testing. Bun, the hyperium h3 Rust crate, and aioquic/mitmproxy remain unpatched. Bun gets special mention for an integer overflow that turns a single 516KB request into a permanent 100% CPU infinite loop. The lesson applies to any compression format: limit the decompressed size as you go, not just the bytes on the wire.
Metamorphic macOS ransomware
Patrick Wardle of Objective-See digs into Heartbreaker, macOS ransomware written in Rust that has sat on VirusTotal since May 2025, undetected by every antivirus engine.
Most antivirus detection relies on signatures: a hash or byte pattern identifying a known-bad file. Metamorphic malware tries to dodge signatures by rewriting itself so every copy looks different while behaving the same. Heartbreaker takes a delightfully brute-force approach: it carries its own Rust source code inside the binary, and after running, it shuffles variable names, adds junk functions, installs a Rust compiler if one isn’t present, recompiles itself, and replaces itself with the new build. It is about as subtle as a brick through a window.
As ransomware it’s not very scary. It only encrypts the Downloads folder, and uses the same hard-coded key for every victim, so Wardle simply wrote a decryptor. The rebuilding also depends on a GitHub library which has since disappeared, so it mostly fails anyhow. Wardle uses it to demonstrate his free RansomWhere? tool, which ignores signatures completely and instead watches for an untrusted process rapidly writing files that look encrypted (using a bit of entropy math). The malware can change its hash all day long, but to ransom anything it still has to encrypt the files, and that’s much harder to disguise.
UpdraftPlus vendor breached
TeamUpdraft, the company behind the very popular UpdraftPlus WordPress backup plugin, disclosed a breach of their customer database over the weekend. Names, emails, addresses, hashed passwords, and two-factor authentication settings were taken, and more worryingly, the connection keys for UpdraftCentral, their cloud dashboard for managing many WordPress sites at once. UpdraftPlus previously made an appearance back in June, when a vulnerability in the plugin was used in the Awesome Motive supply chain attack.
Those UpdraftCentral keys can send commands to every connected site, which turns one vendor breach into a remote control for potentially thousands of customer websites. TeamUpdraft has released UpdraftPlus 1.26.12 and 2.26.12, which automatically disconnect the old keys. If you or anyone you know manages WordPress sites through UpdraftCentral, log in to each site directly, update the plugin, and check for unexpected admin accounts and plugins (including the easy-to-miss “Must-Use” plugins tab).
Spyware delivered by ad network
Citizen Lab has published research showing that the Israeli ad-tech company Discover-Tech helped deliver spyware through ordinary online ads, targeting at least 45 devices at the news outlet Al Jazeera in 2024 and 2025. Citizen Lab attributes the spyware to Candiru, a commercial spyware vendor.
When you load a web page with ads, the ad slot is typically auctioned off in real time to the highest bidder, based on a profile of who you seem to be. This “programmatic advertising” system is, by design, a mechanism for running third-party content on a very specific person’s device. It’s easy to see why that’s attractive to a spyware vendor. According to Citizen Lab, Discover-Tech’s platform could profile users and infect a device just by displaying an ad, no click required. CPJ reports that the company’s ads reached nearly 200,000 websites and apps, and researchers at Confiant found them on government networks including the US Department of Defense, NATO, and the UN.
Malicious ads are nothing new, but this is the first public evidence of an ad platform being used for targeted, zero-click spyware delivery. “Don’t click on ads” has always been good advice. An ad blocker isn’t just a quality-of-life improvement; it’s attack surface reduction.
Ransomware negotiators on the wrong side
Last week we covered a ransomware “recovery” CEO charged with secretly paying ransoms while billing customers for decryption. This week, Brian Krebs reports that investigators chasing ShinyHunters (the group behind the FBI hack) have identified executives at two ransomware negotiation firms with unusually friendly relationships with the gang. Chats seized when Dutch police arrested a suspected ShinyHunters member reportedly show negotiators who knew about new victims before the victims themselves did. One Canadian executive has already been arrested, and investigators believe an executive at an unnamed, prestigious US consulting firm helped run the gang’s extortion website.
It’s not the first time: the DOJ sentenced Florida negotiator Angelo Martino to 70 months in July for feeding his own clients’ negotiating positions to the BlackCat ransomware gang, and for helping deploy ransomware against even more victims. The government seized $10 million in assets from him, including a luxury fishing boat and, for reasons unknown, a food truck.
Part of the problem is structural. Some negotiation firms charge a percentage of the ransom paid, which gives the “negotiator” every incentive to pay, and pay big. Firms which refuse to facilitate payments often just get swapped out by the insurance company for ones that will. Meanwhile, ShinyHunters is reportedly furious with Coveware, an incident response firm, for telling victims not to pay, which is probably the best endorsement Coveware could ask for.
An army of AI agents
The Verge reports that security firm Norforge found an attacker using a swarm of mostly autonomous AI agents to break into more than 100 websites, including sites belonging to John Deere, SharkNinja, and Cummins. The agents ran on Cairn, an open-source “general-purpose problem-solving engine”: you give it a starting point and a goal, and the agents work toward it while documenting their progress. That documentation is how they were caught: the attacker’s Cairn instance was exposed to the Internet, along with about 20 others that appear malicious.
According to Reuters, the attacker described their preferred intrusion tactics in fewer than 100 Chinese characters, and each successful breach took about 23 hours. The victims say the impacted sites were standalone support pages, and Cairn’s author insists it was “never a ‘hacking tool'”. Many tools can be double-edged, but the effort balance here is hard to ignore: a short prompt and a day of waiting on one side, and defenders who have to close every hole on the other.
Staples hacked to fund a gift cards
404 Media pieced together, from an unsealed search warrant, that a Chinese organized crime ring hacked Staples in 2023 and issued more than 15,000 gift cards worth over $5 million. Staples’ internal customer support system was supposed to be reachable only from inside the company, but wasn’t. The attackers requested “heap dumps”, a debugging feature which captures everything an application has in memory, and pulled out the active login sessions of customer service reps. With those, they simply logged in as the reps and issued gift cards. A similar trick was used in a hack of payment data from Target years ago, where attackers leveraged access through the air conditioner control network into the cash register network, and then dumped credit cards directly from RAM as they were processed.
If you’ve ever wondered why debugging endpoints left exposed in production show up in every penetration test report, this is why. The gift cards were then laundered the old-fashioned way: crews of shoppers hitting Target stores with phones full of gift cards, buying Apple and Bose gear by the cartload (about $141,000 across 85 Target stores in 18 states in two days), with the goods shipped back to China. The larger ring this fed into reportedly moved over $100 million in gift cards.
PingCAP breach claims
An extortion group calling itself FulcrumSec has posted a leak site claiming a massive breach of PingCAP, makers of the TiDB Cloud managed database service. The group claims it found cloud credentials committed to PingCAP’s own source code repositories, and used them to set up a replication feed of PingCAP’s production control database that re-exported everything to the attackers every six hours for 22 days, without being noticed.
The claims haven’t been independently verified, but they’re very specific: 10.6TB of data, 115,000 customer API keys stored in plaintext, 20 million customer SQL queries, four years of connection logs with customer IP addresses, and 413 private source repositories. The attackers quote a 2022 internal security ticket noting that any member of a customer organization, even a billing-only account, could reset the root password on every database in that organization. Perhaps most damaging, support engineers allegedly pasted live customer credentials into support tickets, including cloud keys with admin access to other companies’ storage. If you’re a TiDB Cloud customer, assume your API keys, connection strings, and anything ever pasted into a support ticket are burned, and rotate accordingly.
Fake WhatsApp on the Play Store
Android Authority found a fake WhatsApp app on Google Play with over half a million downloads, a week after a fake Chrome app racked up over 100,000. The fake copied the real listing’s screenshots and description word for word, and in some cases appeared as a sponsored result when searching for the real app.
The trick that let it linger is Google Play’s “Early Access” program, which disables public reviews. Normally a fake app gets buried in one-star “THIS IS A SCAM” reviews; in Early Access, nobody can see them. As of publication it was still available. “Only install from the official store” is still good advice for family members, but it’s a little less reassuring when the official store is selling ad placement to the fake.
Meta Muse leaks via DNS
Back in September, we covered a serious vulnerability in Muse, Meta’s extremely privileged AI agent. This week, Meta suspended Muse’s chat sharing feature after researchers at Claroc found they could find and read thousands of shared conversations.
Each shared chat got its own web address, with the conversation title as part of the hostname. Hostnames get looked up in DNS, and many DNS lookups are recorded by “passive DNS” services, essentially a giant searchable history of which names have been resolved. One search returned a ready-made table of contents of shared chats. Claroc found 6,800 of them, including a small business loan application, a bank fraud alert with partial account details, and internal company documents. “Secret URL” sharing only works if the URL stays secret, and putting the secret in a DNS hostname is roughly the opposite of that.
Password1 strikes again
The UK Information Commissioner’s Office reprimanded IT provider Ogi Networks and the Welsh public sector data organization Data Cymru over a 2024 ransomware attack which exposed data on 3,300 people, most of them children. The way in? A test account named “Test2”, created in 2012, never reviewed, and protected with the password “Password1”. The local administrator accounts on three systems also shared a single password for the same twelve years.
There’s nothing exotic here, sadly. Old accounts nobody remembers, passwords that would fall to the first guess of any automated tool, and an outsourcing arrangement where each side assumed the other was handling security. None of it makes for exciting headlines, but these are the things that keep causing very real breaches.
Trezor wallets also implanted
As a follow-up to last week’s coverage of hardware implants in Ledger crypto wallets, Kim Zetter reports that Trezor’s claim of “not a single piece of evidence” that its devices were compromised doesn’t quite line up with reality. Joe Grand found implants in two Trezor wallets, bought through Facebook Marketplace and a TikTok shop, and reported them to Trezor in August.
The Trezor attack is different from the Ledger implant. Instead of adding a radio to spy on the screen, the attackers replaced the main microcontroller with one running modified (open source) firmware. The firmware “randomly” generates one of a dozen recovery phrases the attackers already know. To pass Trezor’s integrity checks, it presents a copy of the legitimate firmware for verification before switching to the malicious code. The takeaway hasn’t changed from last week: buy only directly from the vendor, and if you’re holding enough crypto to make this worth someone’s while, consider whether you can really trust any single device.
NGINX gets more critical bugs
F5 has released out-of-band (meaning outside their normal patch schedule) updates for three critical vulnerabilities in NGINX, the web server and reverse proxy that sits in front of a huge chunk of the Internet, and quite possibly in front of the services on your home lab. The Cyber Security Agency of Singapore has a summary: all three are rated CVSS 9.2, can be triggered remotely without authentication, and can crash worker processes or, under the right conditions, allow remote code execution.
The bugs are CVE-2026-15176, a heap overflow in the “alias” and “rewrite” directives; CVE-2026-97205, a use-after-free in asynchronous file I/O combined with Server Side Includes; and CVE-2026-93479, a heap overflow in the “map” directive. Code execution requires the vulnerable configuration to be in use, and requires bypassing ASLR (the randomization of memory layout which makes exploits harder to aim). Affected versions include NGINX Open Source 1.30.5 and below and 1.31.6 and below, NGINX Plus R33 through R37, and a long list of F5’s NGINX-based products, including the Kubernetes Ingress Controller.
Back in May we covered “nginx-poolslip”, where the suggested mitigation was to avoid unnamed regex capture groups in rewrite rules. The mitigation for the “map” bug this time? Use named captures instead of unnamed captures. If you’ve been putting off cleaning up those “$1” references in your config, now’s the time. For the other two, avoid “alias” inside “location” blocks (and the “$request_filename” variable), or disable AIO or SSI, until you can update.
Linux kernel bugs posted to the wrong list
Normally, security bugs in the Linux kernel are reported privately to the kernel security team, which coordinates a fix before details go public. This is “coordinated disclosure”: the bug and fix are published together, ideally giving admins a chance to patch before attackers can start writing exploits. The Linux Kernel Mailing List (LKML), on the other hand, is about as public as it gets.
Phoronix reports that Trend Micro’s Zero Day Initiative, seemingly by accident, sent a batch of unpatched vulnerability reports straight to LKML. Greg Kroah-Hartman replied to each report asking about the choice of mailing list, which I can only imagine was done with remarkable restraint. The most serious two are both CVSS 9.0 remote code execution bugs in ksmbd, the kernel’s built-in SMB (Windows file sharing) server: an integer underflow in SMB Direct, and a race condition. The rest include local privilege escalation bugs in the networking code, the VMware graphics driver (an out-of-bounds write), and a stack overflow in search-domain TCP query handling, plus an information leak in the NVMe-over-fabrics target code.
Some of the bugs already have patches being tested or queued for future kernel releases, and those will presumably be expedited now. Most systems don’t run ksmbd (the userspace Samba server is far more common), but if you’ve enabled it on a NAS or a home server, it’s worth disabling until patched kernels land. As Phoronix puts it: “the bug and security reports keep on coming in the AI fueled world.”
Linux 7.4 Power Management Preps For AMD Ryzen Zen 6 & Intel Rugged Panther Lake
The power management subsystem updates were merged this week for Linux 7.4 along with the related ACPI and thermal control updates too...
The reactor meant to showcase nuclear’s comeback keeps hitting problems
US regulators have issued a warning to a nuclear project critical to Donald Trump’s efforts to revive the industry, after a contractor fell into a reactor cavity and a bundle of fuel rods nearly tipped over during refuelling.
The US Nuclear Regulatory Commission told Holtec International, a company racing to reopen a shuttered reactor at the Palisades nuclear power plant in Michigan, to address a “chilled work environment” that has made staff hesitant to raise safety concerns without fear of retaliation.
The warning has prompted concerns among critics that financial and political pressures to revitalise nuclear power as an answer to booming AI-driven energy demand are increasing risks of accidents.
OpenSSL 4.1 Released With More AVX-512 Optimizations
OpenSSL 4.1 stable is out today with new AVX-512 optimizations, other performance improvements, and finally retiring Windows on Itanium and Windows CE support...
Linux 7.4 Brings Hibernation Improvement For Helping Meet Energy Certifications
The PCI/PCIe subsystem improvements have been merged for the ongoing Linux 7.4 merge window...
Vulkan 1.4.366 Released With SMPTE ST 2094-50 HDR Support
Vulkan 1.4.366 is out and representing the past two weeks of specification fixes, clarifications, and one new Vulkan API extension...
Ukraine learns to fight without Starlink as Musk plays politics with satellites
Elon Musk’s Starlink satellite service has played a pivotal role in supporting Ukraine’s successful resistance to Russia’s full-scale invasion for years. But with Starlink having become increasingly unreliable due to Musk’s political inclinations and the latest surprise disruptions to service in Ukraine, the Ukrainians and Europe as a whole are now facing urgent questions about how to move forward without it.
As the world’s largest communications satellite network, Starlink can typically support high-speed Internet and data streams for any user or vehicle equipped with a relatively compact Starlink terminal. This has enabled Ukraine to maintain vital communications for both civilian purposes and military operations—and has also expanded the Ukrainian military’s capability to remotely control or provide guidance to drones used in both air defense against Russian attacks and for striking back at Russian targets.
“Starlink currently offers some of the best satellite coverage available, with virtually no competitors when you consider the combination of cost, availability, and ease of use,” according to the head of hardware R&D at the Ukrainian defense company BlueBird Tech, who provided comments to Ars anonymously for security reasons. “In practical terms, the main limitation is the need to position the antenna so it can receive signals from the satellites.”
Review: Crystal Lake suffers a bit from its obsession with Pam Voorhees
Peacock’s series, Crystal Lake, doesn’t feel like a Friday the 13th movie when you first press play, even though it’s set up to be a prequel to the original film. (This review includes spoilers of the original Friday the 13th movie but avoids major Crystal Lake spoilers.)
Instead, Crystal Lake strives to build a drama that’s half homage, half uncharted territory while giving a long-awaited backstory to Pamela Voorhees. The original villain in the first film, Pam Voorhees, shocked audiences in 1980 by popping up out of nowhere in the midst of a brutal camp counselor killing spree, then confronting the final girl with a Norman Bates-like delivery of the movie’s chilling tagline, “Kill her, mommy,” using the voice of her drowned son Jason.
Betsy Palmer as Pam Voorhees in Friday the 13th.
Credit:
via Paramount Pictures
Linda Cardellini as Pam Voorhees in Crystal Lake.
Credit:
via Peacock
Although the hockey-masked killer, Jason Voorhees, became the horror icon at the center of the franchise, his mom, Pam, continued to fascinate fans who knew very little about her. Beheaded in the first film after just 13 minutes onscreen, her spirit would occasionally appear in later films, but the original actor, Betsy Palmer, who portrayed Pam refused to return, largely because the character has no depth.
Rocket Report: SpaceX says no thanks to military launches; Spanish rocket nearly ready
Welcome to Edition 9.16 of the Rocket Report! Lots of SpaceX-related news this week including a couple of Thursday shockers. In one story, the company told the US Space Force thanks, but no thanks after being offered three military launch contracts. Then, on the civil space side of things, SpaceX's Starship may required up to 22 refuelings to support a lunar landing, a NASA safety panel said.
As always, we welcome reader submissions, and if you don't want to miss an issue, please subscribe using the box below (the form will not appear on AMP-enabled versions of the site). Each report will include information on small-, medium-, and heavy-lift rockets as well as a quick look ahead at the next three launches on the calendar.
Miura 5 getting closer to launch. PLD Space says its Miura 5 rocket, due to undertake its inaugural launch next year, is nearing final integration, Aviation Week reports. The rocket is one of three Miura 5s the company has already manufactured, with the other two designed to qualify key system elements, CEO Raúl Torres said in an October 19 program update. PLD Space now targets a first flight of the small-lift vehicle before mid-2027.
When You Can’t Pick Between Electric and Jet Power, This Buggy Has You Covered
Technically, what [Macona] built with a surplus Solar T-62 turbine is not a dune buggy, but a sand rail, but it does have the delightfully rare combination of electric and turbine drive that is absolutely worth wading through a 53-page forum thread to learn about.
The turbine came bare as surplus, but [Marcona] used a pair of Kia/Hyundai HSG water-cooled motor-generators to turn it back into something very much like the APU it likely started out as. That’s APU as in “Auxiliary Power Unit” in this context, the little generator that keeps the lights on when your plane is sitting on the tarmac. That went into the sort of frame you’d once have put a VW bug engine in — and the 150 HP off the shaft of the turbine beats anything you’ll get with Wolfsburg’s little boxer motor, even after losses in the generator and motors. Even better, the whole assembly, which uses the electric motor from a Mitsubishi Outlander, likely doesn’t weigh any more than the internal combustion engine and transmission, so whatever you call this little off-roader it ought to move well. It certainly seems to in the demo video embedded below.
What it doesn’t do is sip fuel, the T-62 being rated at 19.3 gallons/hr at full load. Fuel efficiency is definitely not the motivation here. He’s absolutely not saving money, especially not with what jet fuel costs these days. It’s one of those projects done purely for the joy of it — where if you have to ask why, you’re barking up the wrong tree. The vehicle isn’t yet street legal, but [Marcona] is working on it.
If you do like the idea of this kind of series hybrid drive, Edison Motors of Canada is working on bringing it both to semitrucks and heavy trucks, and that is motivated by fuel savings.
Physicists Trap a Single Antimatter Particle For a Month
Physicists at Northwestern University have successfully trapped a single positron for an entire month, allowing researchers to study its quantum properties with unprecedented precision. "Further investigations using the trap might reveal the secret of why the world around us is made of matter and not antimatter, when things could have presumably gone either way," reports Scientific American. From the report: Every normal particle of matter has an antimatter counterpart with equal mass but opposite charge. To build their trap, physicists started with atoms of sodium 22, a radioactive isotope with a half-life of about two and a half years. When one of these atoms decays, it emits a positron -- the antimatter counterpart of the electron. "The big challenge is to persuade these positrons to slow down and then capture them," says Gerald Gabrielse, a physicist at Northwestern University, who oversaw the project. The team reported its achievement on Wednesday in Physical Review Letters (PDF). The first step is to send the positrons through the crystal lattice of a sliver of cold tungsten. As the particles go pinballing through the material, they slow down and lose energy. "Every time they bang into something, there's a chance of annihilation, but it doesn't always happen," Gabrielse says. "If they make it to the end, they get popped out." Next, the physicists steer the positrons along a channel using electromagnetic fields. Eventually the particles end up in a vacuum, just three tenths of a degree Celsius above absolute zero, trapped by an electric field on top and bottom and a magnetic field on the sides. "If you want to hold on to antimatter, you have to hold it in a container without walls," Gabrielse says. This method allowed the researchers to isolate and study a solitary, lone positron for a monthâ"and could let them do so indefinitely. The researchers intend to use their trap to make precise measurements of the positron's magnetic moment -- basically the strength and orientation of its magnetic field. To do this, they must determine two things: the energy needed to flip the direction of the positron's spin and the energy needed to make it jump from its ground state to its first excited state. Using a similar trap setup, Gabrielse and his team have already measured the magnetic moment of an electron to a precision of one part in 10 trillion. Taking the equivalent measurement for a positron will allow them to make a crucial comparison. "We're looking to see if they have an exactly opposite magnetic moment," Gabrielse says. That's the prediction of the Standard Model of particle physics. If the two have different values, however, this could help explain why our universe is made of matter instead of antimatter.
Read more of this story at Slashdot.
FFmpeg 9.1 Preps For Release With APV Vulkan Encoder, NVIDIA Optical Flow FRUC
The release dance is underway for FFmpeg 9.1 as the newest feature release for this widely-used open-source multimedia library...
Linux 7.4 Introduces New Driver For The Nintendo Switch 2 - Thanks To Valve
The HID subsystem updates have been merged for the Linux 7.4 kernel that included a few new drivers...
LibreSSL 4.4 Released With Faster SHA3, Bug Fixes
LibreSSL 4.4 released on Thursday as the newest release of this decade-old OpenSSL fork maintained by OpenBSD developers...
Linux 7.4 Fixes AMD CPU TLB Size Reporting For Zen 5 & Newer
As a follow-up to the article in September about a Linux patch for fixing under-reported AMD Zen 5 TLB sizes, that work is now merged for the Linux 7.4 kernel...
Friday of the Twenty-ninth Week in Ordinary Time
Reading 1 Ephesians 4:1-6
Brothers and sisters:
I, a prisoner for the Lord,
urge you to live in a manner worthy of the call you have received,
with all humility and gentleness, with patience,
bearing with one another through love,
striving to preserve the unity of the spirit
through the bond of peace;
one Body and one Spirit,
as you were also called to the one hope of your call;
one Lord, one faith, one baptism;
one God and Father of all,
who is over all and through all and in all.
Responsorial Psalm Psalm 24:1-2, 3-4ab, 5-6
R. (see 6) Lord, this is the people that longs to see your face.
The LORD’s are the earth and its fullness;
the world and those who dwell in it.
For he founded it upon the seas
and established it upon the rivers.
R. Lord, this is the people that longs to see your face.
Who can ascend the mountain of the LORD?
or who may stand in his holy place?
He whose hands are sinless, whose heart is clean,
who desires not what is vain.
R. Lord, this is the people that longs to see your face.
He shall receive a blessing from the LORD,
a reward from God his savior.
Such is the race that seeks for him,
that seeks the face of the God of Jacob.
R. Lord, this is the people that longs to see your face.
Alleluia See Matthew 11:25
R. Alleluia, alleluia.
Blessed are you, Father, Lord of heaven and earth;
you have revealed to little ones the mysteries of the Kingdom.
R. Alleluia, alleluia.
Gospel Luke 12:54-59
Jesus said to the crowds,
“When you see a cloud rising in the west
you say immediately that it is going to rain–and so it does;
and when you notice that the wind is blowing from the south
you say that it is going to be hot–and so it is.
You hypocrites!
You know how to interpret the appearance of the earth and the sky;
why do you not know how to interpret the present time?
“Why do you not judge for yourselves what is right?
If you are to go with your opponent before a magistrate,
make an effort to settle the matter on the way;
otherwise your opponent will turn you over to the judge,
and the judge hand you over to the constable,
and the constable throw you into prison.
I say to you, you will not be released
until you have paid the last penny.”
- Readings for the Optional Memorial of Saint John of Capistrano, Priest
Lectionary for Mass for Use in the Dioceses of the United States, second typical edition, Copyright © 2001, 1998, 1997, 1986, 1970 Confraternity of Christian Doctrine; Psalm refrain © 1968, 1981, 1997, International Committee on English in the Liturgy, Inc. All rights reserved. Neither this work nor any part of it may be reproduced, distributed, performed or displayed in any medium, including electronic or digital, without permission in writing from the copyright owner.
DOOM Ported to a $30 Clamp Meter
DOOM. Boil it, mash it, stick it in a stew, it’s the game that runs on anything and everything. Now, the classic shooter is running on a rather unlikely target—a cheap clamp meter of very limited resources, thanks to the work of [Artur Bieniek].
The clamp meter in question is the FNIRSI DMC-100, which can be had for the low price of just $30 or so if you know where to look. It’s a far cry from the many thousands of dollars you’d pay for a heavy old 486-based machine back in 1993. [Artur] got the doomgeneric engine running on the Artery AT32F415 chip that runs the clamp meter.
The chip is pretty capable, with its 150 MHz clock speed, though the 32 KB of RAM posed rather a big limitation to the project. It may be one of the lowest RAM DOOM ports out there. Even with this limit, [Artur] was able to get Episode 1 of Freedoom: Phase 1 loaded on to the thing, including E1M1 to E1M9 along with the title screen, intermissions, the finale, the menu, and four save slots. Color graphics are displayed on the meter’s 320 x 240 screen, and there are even sound effects on the built-in buzzer. Controls are mapped to the rather curious choice of a DJI RC-N1 drone controller.
We’ve seen DOOM running on everything from desk phones to completely custom CPUs. These days you have to try pretty hard to find something it hasn’t already been ported to.
UN Says Breaching 1.5C Warming Limit Is 'Imminent and Unavoidable'
For the first time, the UN has declared that exceeding the Paris Agreement's 1.5C warming limit is "imminent and unavoidable." "We are now saying this window has closed, but we can open it again by making the overshoot as brief as possible," UN Environment Program Executive Director Inger Andersen said on a call with reporters. "This is about how to find a way back as shortly and as quickly as possible with as limited an overshoot as possible." CNN reports: Past reports have examined the distance between countries' emissions reduction commitments and what it would take to limit global warming to 1.5 C above preindustrial levels. However, this year's report redefines the gap. Instead, it examines new emissions overshoot scenarios, and what it would take to limit peak warming to just 1.7 to 1.8 degrees C before bringing temperatures back down to 1.5 C through emissions cuts and the use of carbon removal technologies. The report makes clear that every additional fraction of a degree of warming above 1.5 C "raises the risk of irreversible changes including in ice sheets, permafrost carbon, ocean circulation, and coral systems, along with devastating human impacts." Each added fraction of a degree of warming can have an "immense" impact "as measured in terms of damage, cost and loss of lives," said climate scientist Michael Mann of the University of Pennsylvania. Mann was not involved in producing the UNEP report. According to the UNEP, which is based in Nairobi, the lowest overshoot scenario would keep peak warming to between 1.7 and 1.8 degrees C and return global average temperatures to at or below 1.5 C by 2100. However, to follow such a pathway, global greenhouse gas emissions would need to be slashed by far more than anything currently on the table at the upcoming COP31 talks. This would require an 18% cut by 2030, 45% by 2035, and 69% by 2040, relative to 2025 levels. Meeting this lowest-possible overshoot scenario would require a tripling of renewable electricity capacity by 2035, and dramatic cuts to fossil fuels, including the phaseout of coal by 2040, the report states. In addition, there would need to be a major scaling up of carbon removal technologies, which so far have not been proven to work at such a large scale. In stark contrast to these figures, the fulfillment of existing emissions reduction pledges would only yield a 5-to-8% emissions cut by 2030 and an 11-to-15% reduction by 2035, the report found. This would be associated with a peak warming of about 2.6 degrees C. If countries simply follow their current policies, then warming could reach a peak of about 2.8 C. That estimate has increased since last year, in part because of the withdrawal of the United States from the Paris Agreement and retraction of its emissions reduction commitments, the report states. Even the scenario that assumes countries meet their existing reduction commitments, and nations with net-zero pledges succeed in fulfilling them, still brings warming to a peak of 2.1 C.
Read more of this story at Slashdot.
Restoring a Soviet ES-4001 Mainframe Control Panel
Recently the [Chornobyl Family] got their hands on an ES-4001 control panel for a 1970s-era Soviet mainframe, with the intention to restore it to full working order. Not just because they’re really into cool old Soviet technology, but also because of the connection that this control panel holds to the Chernobyl nuclear accident that was so instrumental to the area in modern times.
During the 1970s the USSR felt that it could not be left behind in the race to create better digital computers. This led them to not only create a few original designs, but also effectively clone the IBM System/360 and System/370. This resulted in the ES EVM-series of mainframes, with an ES-1060 finding itself installed at the Duga-1 early warning radar system near what is now the Chornobyl nuclear power plant in Ukraine.
Although the radar arrays are the most well-known feature of the Duga-1, below it is the computer center where the ES-1060 was installed. It was never put into service following the ChNPP Unit-4 accident — all that remains of a once pinnacle of Soviet engineering are the picked-over carcass of the mainframe and its control panel.
The control panel in question was obtained was from the early 1980s, serving a more gentle service life in a datacenter and looks to be in a mostly good condition. That said, there was still enough to be done to make it work and undo the damage of its violent removal from the mainframe. Along the way we also learn how the system was used and how the control panel works.
Although similar in some ways to the System/370, it’s still very different, and with only about 300 of these mainframes produced, it’s worth saving whatever elements still remain today, along with the surviving documentation.
Unvetted AI Agents Are Accessing US Bank Accounts
An anonymous reader quotes a report from Axios: Major U.S. banks are detecting unauthorized third-party AI agents operating inside customer accounts, with some agents attempting to take actions that appear to be independent of user instructions, sources tell Axios. The difficulty in distinguishing between a human and an unauthorized bot is forcing banks to block the technology and rapidly rewrite their terms of service. [...] This presents significant security risks: banking executives fear the steps agents with login access might take, especially if a user has granted purchase authority or the ability to shift funds. In other instances, some banks have tracked activity when agents -- programmed to fulfill requests or complete tasks on a user's behalf -- contact call centers or appear to take actions independent of user instructions, the people said. Bank executives described the situation as horrifying, with one official saying the industry has grave concerns about agents gaining access to customer accounts and taking steps that could impact user finances. The concerns are at the root of the decision by several banks to restrict third-party AI agent access, the people said. Morgan Stanley has begun blocking third-party agents from accessing its platforms, sources familiar with the decision said. JPMorgan, Bank of America and Citi are also restricting agents. [...] Many banks are broadly not able to parse whether agent account activity is user-directed, sources said. [...] On one hand, banks are best positioned to respond to the threats and opportunities of AI given their cash on hand and experience as critical infrastructure. But money isn't necessarily enough to solve this problem, one source said, because of how quickly the technology is developing and revealing new weaknesses in real time. Banks are investing in preventing worst-case scenarios, but they are also preparing for when those could happen, including with "day after" scenario planning that would allow them to quickly secure or restore customer access, sources said.
Read more of this story at Slashdot.
NASA Batteries Survive Extreme Cold and Heat
One of the major limits of mass-produced batteries is the electrolyte. From lead-acid to lithium ion, there’s some temperature where the electrolyte will freeze and cause all sorts of problems, from cracked casings to various non-favorable chemical changes in the battery itself. But if there’ a solid electrolyte available, many of the downsides of charging and discharging batteries in extreme cold disappear. These batteries developed by NASA, for example, can survive some wild temperature swings.
The electrolytes used for these batteries are either a ceramic or polymer electrolyte, both of which are solid. In testing, the batteries could meaningfully operate at temperatures of -60° C and up to 80° C on the high end. Further, the solid electrolyte helps protect them even outside of these temperature ranges. Bringing the battery temperature down to -170° C was not enough to damage the battery at all, and using a small heater to bring the temperature back up to its operating range showed no capacity losses or other issues.
These batteries are eventually intended for use in some of the coldest places outside of Earth still accessible to humans (in theory) such as the south pole of the Moon where the temperatures regularly get that cold and stay cold for long periods, especially in permanently-shadowed craters or places on the Moon we might want to put some telescopes eventually. There are other terrestrial situations where these batteries might be useful as well, since they don’t need as much thermal management as other battery types.