Last week brought us at least two broken embargoes: php2shell leaked onto Hacker News a day early, and a batch of Linux kernel bugs landed on the public kernel mailing list instead of the private security list. This week has been slightly less exciting overall, fortunately, but Akamai’s security team published a pointed essay titled “TLP Is Not a Suggestion”, and it’s hard to argue with the timing.

When a researcher finds a serious bug, the usual process is “coordinated disclosure”. The developers get time to build a fix, and downstream vendors get advance notice under embargo so patches and protections are ready the moment details go public. The Traffic Light Protocol (TLP) is the vocabulary everyone uses to say who may know what: TLP:RED for named recipients only, TLP:AMBER for an organization and its clients on a need-to-know basis, TLP:GREEN for a trusted community, and TLP:CLEAR for anyone. It has no legal teeth whatsoever. It’s not classified data in a legal sense. It works because everyone involved agrees to make it work.

Akamai’s complaint isn’t really about the original php2shell leak, but about what came after: vendors and researchers racing to confirm, reproduce, and publish first. According to Akamai, a researcher published a reconstruction of the bug before the patch existed, and exploitation attempts started before most admins knew there was anything to patch. They draw parallels to Heartbleed in 2014, where a handful of companies got early notice and then advertised that they were already safe while Linux distributions were caught flat-footed, and to Meltdown and Spectre in 2018, where a six-month embargo collapsed six days early.

In the rush to publish, it’s also become less clear what the actual severity of the bug is in the real world. It clearly exists, and is of concern, but groups are still struggling to prove a complete exploit path, with several challenges showing results but nothing definitive so far.

Their advice boils down to “protect first, publish second”: push the detection rules and virtual patches, tell your customers privately, and save the blog post for after the official advisory. With AI tooling shrinking the time between “details exist” and “working exploit” to hours, the cost of a broken embargo is going up, not down.

UEFI network boot bug in most servers

Speaking of broken embargoes, Ars Technica reports on CVE-2026-97631, a CVSS 9.5 code execution bug in TianoCore EDK II, the open source codebase which nearly every firmware vendor builds on. That includes AMI, Insyde, Phoenix, and Microsoft’s own Project Mu fork.

UEFI is the current iteration of what we knew as the PC BIOS: the firmware that runs before your operating system, initializes the hardware, and hands off to the bootloader. It’s also where Secure Boot starts its chain of trust, and where the TPM gets set up. Code running in UEFI runs before any of the operating system’s defenses exist, which makes it extremely attractive to attackers. The Preboot eXecution Environment (PXE) is the UEFI feature that lets a machine boot from an image downloaded over the network, which is common in data centers and labs with large numbers of identical machines.

The bug is a 16-year-old buffer overflow in how the PXE driver stores ICMP error messages: it copies incoming errors into a fixed 504-byte buffer without properly checking the length. An attacker who can send a packet to the machine while it’s network booting can overwrite adjacent memory and, if they know the specific firmware build, run code at the highest privilege level before Secure Boot ever gets a say. Buffer overflows are nothing new, in fact they’re one of the oldest bug classes turned into exploits, but most operating systems today offer protections to reduce the severity.

The pre-boot environment of UEFI has no such niceties, making the attack simple and completely effective. HD Moore told Ars it could be used to break disk encryption for an attacker with short-term network access, and that it will likely be a “forever” bug living on in out-of-support systems. If this sounds familiar, it’s because PixieFail found a similar family of PXE bugs in the same EDK II network code in 2024, and, as Ars notes, the fuzzing projects that followed missed this one.

The disclosure was supposed to wait until January, but AMI published a pull request with the fix last month, and once the researchers noticed, TianoCore had little choice but to publish an advisory. If your machines boot only from local disks, you’re not affected, and that covers most home and small office systems. If you do use network boot, check with your firmware vendor, and consider turning off PXE booting where you don’t need it. Fortunately, this one is largely irrelevant for home users unless your network somehow gives direct access from the Internet to a server pre-boot environment, but it’s got potential to be a real issue for server hardware.

Certificate authority fallout continues

Last week we covered the eMudhra intermediate certificates whose private keys turned out to be tiny integers. This week, eMudhra announced that it is exiting the global SSL/TLS certificate business entirely. The press release insists the company “handled the recent incident diligently”, that its infrastructure was never compromised, and that TLS was only about 1% of revenue anyhow, but that “the level of social media amplification around this incident has brought scrutiny that is out of proportion.” Having your keys guessable by anyone with a few minutes of free time will do that.

Meanwhile, GoDaddy has self-reported to Mozilla that it couldn’t meet the deadline to revoke 404,607 certificates that didn’t match its own published certificate policies. The rules browsers and CAs agree to, the CA/Browser Forum “Baseline Requirements”, say a CA must revoke a mis-issued certificate within five days. GoDaddy managed to revoke 170,566 by the deadline, and about 227,000 a day later.

Mass revocation is genuinely hard: every one of those certificates is installed on someone’s server, and revoking it before it’s replaced breaks their website. That’s exactly why the browser root programs care so much about CAs being able to do it on time. Short-lived certificates, the kind Let’s Encrypt has been pushing for years, make this a lot less painful because a bad certificate expires on its own in days instead of months. We’ll be living the revocation long-tail experience with eMudhra certificates for years with devices which don’t, or can’t, check revocation lists for the long-running CA certificates.

Tailscale wormability

Tailscale and headscale, its self-hosted, open source control server, have become extremely popular. This is especially so in the maker and homelab world, where they are used for building private networks between devices. Under the hood, Tailscale builds a mesh of WireGuard VPN tunnels between every device, with a central control server deciding who can talk to whom. It also offers “Tailscale SSH”, which replaces the normal SSH server on a device and authorizes logins based on which device is connecting, rather than passwords or keys.

Erica Windisch of Cyberdione Labs has published a report called Tailworm detailing a series of findings in Tailscale and headscale. The most serious is in Tailscale SSH, which runs as root: socket forwarding requests are handled with root privileges and are subject to race conditions, letting an ordinary user with SSH access to a device replace or connect to privileged sockets (like the Docker socket or the init system) and gain root. Combined with capturing the keys used to enroll new devices, Windisch reports that a single compromised device could spread automatically to every device the access policy allows, at under a second per hop, with no passwords or stolen keys required. She also found an experimental app connector feature that can be used to reach destinations the network policy never allowed, including cloud metadata services that hand out credentials. And to top it all off, Windisch discovered unauthenticated memory exhaustion attacks against internet-facing headscale servers.

Notably, the researchers didn’t follow coordinated disclosure, arguing that “infrastructure is vulnerable today” and that rapid awareness will speed up fixes. Whether you agree with that or not (see the first story this week), the mitigations are practical: use per-device access rules for SSH rather than broad tag or group rules, disable SSH forwarding where you can, and expire node keys on servers. Fortunately it doesn’t seem like the bug is vulnerable to the Internet at large. A compromised device inside your Tailscale network could reach other devices in your network, but it won’t melt the Internet, yet.

A One-Byte Typo in Embedded TLS

FoxIO is back with three TLS bugs in GoAhead, a small embedded web server that runs the management interface on an enormous number of devices: routers, printers, firewalls, and industrial controllers from vendors including Palo Alto Networks, D-Link, HP, Canon, Honeywell, Siemens, and Rockwell.

The most severe (CVE-2026-115881, CVSS 9.1) is that GoAhead’s OpenSSL integration loads the configured certificate revocation list, but never actually turns on revocation checking, so revoked client certificates keep working, but the most fun is in the Mbed TLS integration: a copy-and-paste error passes the size of the one-byte Diffie-Hellman generator as the size of the 256-byte prime modulus. The result is a “2048-bit” key exchange using a prime of 255, which leaves exactly eight possible shared secrets. An eavesdropper can simply try all eight. (Clients like OpenSSL reject the broken parameters, but more permissive embedded clients happily accept them.) A third bug (CVE-2026-115884) lets an overly long certificate chain bypass a depth check when built against older LibreSSL. Feels eerily similar to the eMudhra one-number password, and the timing is spooky.

It’s a good reminder of Apple’s infamous “goto fail” bug in 2014, where a single duplicated line silently skipped certificate verification. Crypto code fails quietly: the handshake completes and everything looks fine. GoAhead 6.1.1 fixes all three, but for the hundreds of millions of embedded devices running it, the fix depends on every vendor shipping a firmware update, and on owners installing it. Which will surely happen rapidly and effectively, right?

Volt Typhoon’s Chain of Routers

Kim Zetter reports on new research from Lumen’s Black Lotus Labs into how Volt Typhoon, the Chinese state hacking group that US officials say has been “pre-positioning” inside American critical infrastructure, actually gets in and out.

Attackers rarely connect to a target directly from their own systems. Instead, they bounce through chains of compromised devices, often called “ORB networks” (operational relay boxes), so the traffic appears to come from somewhere innocuous. The sudden burst of news about Residential Proxy Network tools in the Spring and early Summer of 2026 could have been related: proxy networks provide a way to appear inside a country, or state, or even specific city.

Volt Typhoon’s version, which the researchers named Silent Train, is unusually disciplined: each chain of compromised servers, home routers, and IoT devices is assembled and used for a single intrusion, then dismantled and wiped. All this often in under two minutes, suggesting automation. Devices outside the US are never the same models as devices inside the US, presumably so no single vendor’s telemetry can see the whole chain. Targets included government agencies, defense contractors, telecoms, emergency communications, satellite operators, and energy, water, and rail operators, clustered in Hawaii, California, and Texas.

The chains included more than 27 classes of devices, including TP-Link and Netgear consumer routers, with a new device type added about once a month. Most of these were compromised through known, already-patched vulnerabilities. If you’ve got an old router or IoT gadget that hasn’t seen a firmware update in years, it may well have spent some time as a train car. Update it, retire it, or upgrade it with OpenWRT or another modern embedded distribution.

Discover-Tech and Starlink

Last week we talked about Citizen Lab’s research showing the Israeli ad-tech company Discover-Tech used targeted ads to deliver Candiru spyware. Gizmodo reports that the same company appears to be the top bidder for ad impressions on Starlink connections in 105 countries.

Research from TrendAI found an entity it labeled SHADOW-EARTH-79 won about 12% of ads shown to Starlink users, compared to a 3% baseline elsewhere, and over 80% of Starlink ad wins in Argentina, the Philippines, and Japan. It was also the top bidder in Syria, Libya, Yemen, and South Sudan, markets where, as TrendAI put it, “the demand for legitimate Western advertising in sanctioned or active-conflict states is effectively zero.” Reuters later reported that SHADOW-EARTH-79 was TrendAI’s internal name for Discover-Tech. The company spent about $109,000 on bids over four months with no recorded conversions, which is not how a business that wants to sell things behaves.

Real-time ad bidding shares device and location details with every bidder, whether they win the auction or not. Users of satellite internet are exactly who someone would want to locate in places where it’s restricted or politically sensitive, and the ad market will happily tell you where they are. Ad blockers continue to look less like a convenience and more like a necessity.

Quad9 leaves France

Quad9, the free, privacy-focused DNS resolver run by a Swiss nonprofit, is withdrawing service from France on November 24th, after losing a court case brought by the sports broadcaster beIN.

A DNS resolver turns names like “hackaday.com” into IP addresses. Quad9 doesn’t host any content, but the court ordered it to block resolution of domains beIN says are pirating its broadcasts, for users in France. Quad9 says it can’t comply: it doesn’t track who its users are or where they are, and the only alternatives are blocking the domains for the entire world, applying French law globally, or trying to geolocate users by IP address. It tried geolocation in a similar case brought by Sony in Germany, and was fined for contempt when Sony’s lawyers simply used a VPN. (Quad9 eventually won that case, after several years and six figures of legal costs.) With about 20 similar cases pending in France, it decided to leave.

As the EFF points out, none of this removes a single infringing website from the Internet; it just takes a malware-blocking privacy service away from French users, who can switch to another resolver in about thirty seconds. Making infrastructure providers act as copyright enforcement is a tool that’s very easy to repurpose for blocking other things. A net loss for Internet-savvy users in France, but kudos to Quad9 for standing up for principles.

Crime Stoppers Tips Leaked

The CBC has analyzed data stolen from P3, the tip management platform used by Crime Stoppers programs internationally, and found more than 1.5 million Canadian tips from the past 25 years. More than half contained personal information, including addresses, phone numbers, license plates, and banking details for cash rewards. Over 4,300 tipsters identified themselves by name, and even tips flagged by staff as having exposed the tipster were stored unredacted.

The data was stolen in March by a hacktivist group that said it wanted to disprove the platform’s claims of being “anonymous” and “secure”. After the CBC’s report, Toronto Crime Stoppers paused its program and at least six Ontario police services suspended their partnerships. Toronto’s chair, Sean Sportun, told the CBC, “It clearly seems that you have more data than us, which is a little concerning,” saying the platform’s owner, Navigate360, never provided the text of the stolen tips despite months of requests.

The most fundamental problem here may be retention. A system that promises anonymity kept 25 years of tips, including closed cases, in one place. The safest data is data that you don’t have.

DHS Employee Directory Leaked

WIRED reports that Distributed Denial of Secrets has published records on more than 41,000 Department of Homeland Security employees and contractors, including ICE and CBP. DDoSecrets says the data came from DHS’s Okta login system; Okta told WIRED it has “no evidence our data or systems were compromised.”

Beyond names, emails, and phone numbers, the leak includes over 55,000 access permission groups, which map out which people have access to which internal systems, including groups referencing certified undercover operations, wiretap programs, phone forensics tools, and AI services. A security expert quoted by WIRED called it “an extraordinarily valuable intelligence resource for those seeking to penetrate DHS”. Following ShinyHunters’ claimed theft of personal data on nearly every FBI employee, it’s been a rough autumn for federal identity systems.

FEC filing system knocked offline

The US Federal Election Commission took its electronic filing system offline a week before the November 3rd elections, after what an FEC filing officer described in an email seen by Reuters as “a bad actor attempting to breach FEC systems.”

The FEC doesn’t run elections, so there’s no impact on voting, but the outage blocks the 24- and 48-hour spending reports that show how much super PACs and other groups are spending on specific races in the final days. With the midterms already the most expensive US election ever, that’s a meaningful blind spot, at exactly the moment it matters most.

AI-orchestrated Bank Attacks

Last week we covered an attacker using a swarm of AI agents to break into websites. This week, Straiker published an analysis of CARLIY0S, a system it says the long-running CyberCartel group used to attack more than 400 financial targets across Latin America. CARLIY0S was built on PentAGI, an open source automated penetration testing framework, and assigned different jobs to different commercial AI models, including Kimi, Grok, and Claude. Four Claude-based roles were set up to evaluate attack options, debate targets, and return a decision through a designated “arbiter”.

According to Straiker, the group got around model safety policies by framing requests as authorized red team work or capture-the-flag exercises, and even instructed the models to never output the group’s name to frustrate attribution. Straiker says it accessed the group’s stolen credential database, with thousands of records including API keys, database credentials, JWT signing keys, and backdoors. Anthropic has since revoked the credential the group used to reach Claude, and xAI is investigating.

The “it’s just a pentesting tool” defense is going to get a lot of use in the coming years. Automated offensive frameworks are genuinely useful for defenders, and unfortunately also genuinely useful for anyone else who can convince the model they’re a defender.

Bulletproof Hosting Seized

The DOJ has seized the domain of Virtualine, a “bulletproof” hosting provider. Bulletproof hosts sell servers and domains to criminals with the explicit promise of ignoring abuse complaints and law enforcement requests, and they’re the plumbing behind a lot of phishing, malware, and spam.

Virtualine wasn’t subtle about it. According to the DOJ, it advertised on cybercrime forums that customers could use it “for all illegal/black hat activities (including phishing, carding, email spam, port scanning and all others)”, offered an “additional protection plan” that would move a customer’s infrastructure to an unaffiliated shell company after a law enforcement request, and bragged that it “ignored more abuse than your last three therapists.” Despite a supposed ban on child abuse material, it continued hosting a site selling exactly that after repeated notices from law enforcement in multiple countries. Marketing copy is evidence, it turns out.

Multiple crypto-tracing firms say notorious North Korean hackers TraderTraitor may be behind the largest digital heist in history—with billions of crypto likely gone for good.

In the streaming era it’s easy to forget that there’s still a lot of stuff being broadcast over the radio for anyone who cares enough to dial in their receiver. Give me an antenna big enough and a tower on which to place it, and I shall listen to the world.

Of course, so you can’t actually listen to everything being blasted out all over the planet yourself. But if you’d like to at least have a little taste, check out Impermanence Series A — a project by [Sam Scorsby] that randomly combines bits and pieces of audio pulled down from shortwave and FM broadcasts with some web streams, live microphones, and even a bit of the Internet Archive each day into a one of a kind album. We’re not sure we’d call it music, exactly. But it’s certainly fascinating to listen to, a bit like randomly spinning the dial on a planet-wide radio receiver.

[Sam] has shared the Python scripts that pull together each day’s album, and he’s not shy about the fact that the project was created with the help of artificial intelligence tools. In fact, that’s sort of the point. [Sam] puts himself somewhere in the middle when it comes to the current debate over AI, and acknowledges that while computers are good at processing raw data, it still takes a human touch to put it all into context.

So each day [Sam] will listen to the latest computer-generated album and pick his favorite tracks, and once the project has run its course, he’ll put together a human-curated “Best Of” collection. Man and machine working together, each doing what they do best.

We know something of opinionated folks on the Internet, and our experience tells us that Impermanence Series A is unlikely to change anyone’s minds when it comes to AI. But we do appreciate the thoughtful approach [Sam] has taken with the project, and look forward to hearing what he comes up with in the end.

You’ve no doubt heard the saying, “If something is worth doing, it’s worth doing well.” But there’s actually a counter-perspective to this particular philosophy that says it’s also worth doing things badly, with the general idea being that even a semi-successful attempt at something is better than no attempt at all.

We’re not sure if that’s the principle [José Luis Monteiro] and his father had in mind while working on a way to play the classic Snake on a seven-segment LED display salvaged from an old DVD player, but surely the end result is the same. It’s not so much that the display isn’t a good fit for the eponymous snake, in fact, it actually makes a strange amount of sense. Each of the segments can stand in for a piece of the ever-growing serpent, and they’re already arranged in a roughly rectangular grid that makes moving around straightforward enough.

The issue is that the resolution — such as it is — of the display it pretty unforgiving for anything else. Namely, the “food” that your sake is after is naturally identical to one of its own segments, so it doesn’t take long before it’s all rather confusing visually. But in those brief opening moments, it actually works pretty well.

Even if you’re not interested in Snake, between the documentation, source code, and the video below, this project is a great primer on reverse engineering these types of displays. With a microcontroller, a datasheet, and a bit of patience, you could put together an unattractive and frustrating gameplay experience of your very own! If that’s not the dream, what is?

Some MiSTer users put a small secondary “marquee” display on the FPGA board that can show information about the system such as the currently loaded core and what game it happens to be running. Generally these take the form of a small monochrome OLED display, likely the one most of us have sitting in a parts bin somewhere.

But [Erico Mendonca] wanted a something with a bit more style, so he’s come up with a firmware for the ESP32-C3 that connects to MiSTer’s existing secondary display protocol but works with slightly more visually impressive panels such as the round GC9A01 that so many hackers have been playing with as of late. If the whole circular display thing isn’t your…thing, you can even run the firmware on the Cheap Yellow Display for a turn-key rectangular experience.

Because [Erico] didn’t want to fiddle with anything on the MiSTer side of the equation, his firmware has to do the heavy lifting when it comes to the art that shows on the display. So there’s a web-based editor that lets you put together your own artwork to show on the marquee based on what command the MiSTer has actually sent out. Flashing the firmware on the ESP32 can be done through the browser as well, as is becoming increasingly common these days, making it relatively easy to get this project up and running.

With this project it’s also possible to control multiple client displays over WiFi from one system, just in case you wanted to show off what console you were booting up in multiple places.

We’re fans of the round display here at Hackaday, so it’s been great to see more folks putting them to use as of late.

We’re living at an interesting time here in 2026, when microcontrollers are becoming powerful enough to surpass the capabilities of “real” computers from a time when those real computers were starting to become useful. We’ve seen plenty of microcontrollers emulating machines from the 1990s, but what if instead they were giving all their power to the OS? It’s a question [Thomas] is trying to answer with SylphideOS, a general purpose GUI operating system aimed at multiple microcontroller platforms.

On the surface it has a GUI that appears to owe a lot to the early Macintosh machines, but underneath it has the FreeRTOS kernel, something that has been around for quite a while. You can argue among yourselves as to whether this make it an OS in its own right or a FreeRTOS distro. Aside from driving a screen through a framebuffer it also has the hardware interfaces you’d expect, for keyboard and storage. There’s support for RP2350 and selected ESP32 platforms so far, as well as an emulator.

We have already seen a few operating systems for microcontrollers that provide a user interface for a binary bootloader rather than persisting under whatever programs are running, so this marks an interesting departure. Only time will tell if it becomes a success, but perhaps it’s one to watch.

Experience is a great teacher. Ask [Jeneus], who, in high school, tried to make a program that played Othello. It didn’t go well. But years later, the idea produced an impressive Othello robot. At first glance, the robot looks a bit like a 3D printer with an aluminum extrusion XYZ motion system. But there’s a lot more to it, not to mention the software to play the game. Check it out in the video below.

The Z-axis has a vacuum system that can pick up clear tokens and place them on the board. If you know the game, you might remember that on a real board, players have to flip the tokens as they “capture” pieces. The robot has a smarter way to go. The tokens are clear because they are lit with one of two colors. So flipping the token is a simple LED color change. The LEDs also flash a different color to show you where you can move.

The device uses laser-cut components and 3D printed parts in PLA and TPU. Of course, there is a camera for the computer — a Raspberry Pi — to see the board. Overall, a very nicely done project. We’ve seen several checker and chess robots. We wonder if some of them could also play Othello?

You’re likely familiar with Google’s Cardboard, and the legions of cheap virtual reality headsets it spawned. By sticking a smartphone to the wearer’s head, all these headsets needed were some basic optics to provide a surprisingly effective VR experience. You may even know about Google Daydream initiative that came a few years later, which not only improved the basic Cardboard design but brought with it new software features such as VR-specific improvements to the Android operating system and a version of the Play Store dedicated to 3D games and applications.

But unless you’re a true Google devotee, what you may not know is that the search giant partnered with Lenovo to produce a stand-alone Daydream headset called the Mirage Solo in 2018. A full year before the Oculus Quest hit the market, the $399 device combined the guts of a smartphone with a 2560×1440 display running at 75 Hz, a pair of cameras in the front that let it see the world around the user in three dimensions, and a gyroscopic handheld controller to provide an immersive VR experience without having to be tethered to a computer. In addition to the standard consumer version, there was even a “Business Edition” of the headset specifically marketed to schools, offices, and hospitals as a way to deliver VR content without having to invest in any additional infrastructure.

So why isn’t the Mirage Solo better known? Because in classic fashion, just a few years after it was released, Google decided they were no longer interested in virtual reality and shuttered the entire Daydream program. The software components it introduced were stripped out of Android, the 3D Play Store was taken down, and the back-end mechanisms necessary to register new headsets were turned off. Almost overnight, the Mirage Solo became a stereoscopic paperweight.

Or at least that was the official story, anyway. I recently came across a Lenovo Mirage Solo at a thrift store for $25, and despite my initial Internet searches strongly indicating that it would probably be worthless, it seemed worth the gamble to find out for myself.

Know Before You Buy

Usually I’d just jump into the cool stuff, but I think in this case it’s probably wise to get some details clear before continuing. There’s a good chance that some of you may decide to pick up a Mirage of your own after reading this, or perhaps you’ve already got one and wandered in from an Internet search. However you’ve come to read this article, I don’t want to give you the wrong impression about the realities of the situation.

So let’s start with the most important thing: do not buy a Lenovo Mirage Solo unless it has the motion controller! I really can’t stress this one enough, as to my knowledge, there is no way to navigate the UI of the Mirage without it. Many of the cheap units you’ll find on the second-hand market are only priced that way because the controller is missing, so be careful. If you’re wondering, the controller doesn’t need to be the original one that was sold with the Mirage for it to work, but spare controllers are understandably in high demand and are usually priced accordingly.

The second thing to remember is that Daydream is a dead platform, and the software running on the Mirage is now at least six years out of date. Anything that still works on it only does so because whatever upstream service or API it relies on hasn’t yet changed enough to break anything. As of this writing, I personally believe enough of the software still works to make the Mirage worth picking up if you can get a good price on one, but that’s not necessarily going to be true forever.

Escaping Captivity

Alright, let’s assume you’ve just pulled a brand new Lenovo Mirage Solo out of the box in 2026 and want to use it, what does that look like?

The first time you boot it up, you won’t get very far. After it asks you to connect the controller and does some internal housekeeping, you’ll be presented with a dialog that walks you though connecting to a WiFi network and adding it to your Google account. Unfortunately, this process will never complete because Google has flipped some switch on their end — although you wouldn’t know it on the device, as the only feedback you’ll get is a pop-up message advising you that there’s been an unspecified problem and that you should try again later.

Thankfully, somebody over at Google left us a backdoor. If you click on the four corners of this dialog, starting with the top-left and working clockwise, you’ll be able to bypass the provisioning process. After some more loading and a bit of a tutorial about using the controller and navigating the user interface, you’ll be facing (literally) the next problem.

You are standing in an open field west of a…wait, no. Sorry that’s something else. You will be in a virtual forest though, and if you look around you’ll see waterfalls, a winding stream, and birds flying around.

It’s all very slick, but the thing we’re mainly worried about right now is the huge message in front of us saying the system can’t connect to the internet. What’s actually happened is that the system can’t connect to the mothership because the Daydream API has been turned off, but apparently there was no canned error message to convey that condition so this is what we get.

But again, the developers at Google have provided us a way forward. If you navigate to the settings screen there is an option for Beta Features, and underneath that section you’ll find an entry that says Access 2D Apps. Once you select it you’ll be warned that the behavior of standard Android applications in Daydream may be unpredictable, and the Mirage will reboot.

This is where things start to get interesting. Once the headset restarts there will now be a new tab in the application launcher labeled 2D, and under it you should see an icon for the standard Play Store. Once you go into the settings and add your Google account, you’ll be able to browse the Store and download whatever games or applications you want — so long as they don’t mind running on Android 8.0, anyway.

Android Apps…in Space!

Gaining access to standard Android applications opens up a huge world of possibilities. While the older hardware of the Mirage Solo and the outdated OS means you won’t necessarily be able to run the latest and greatest pieces of software, there’s still a lot you can do, from watching Netflix to working with spreadsheets in Google Docs and connecting to your Linux box over SSH. The on-screen virtual text input is good enough for simple tasks, but connecting a physical keyboard over USB or Bluetooth makes the whole experience vastly more enjoyable.

When running 2D applications in Daydream, they will appear as a giant display floating in front of you. Some of the apps will only work in portrait mode as if they think they are running on a normal phone, but in most cases you can grab the corner of the window and stretch it out into a landscape orientation that better fits the fairly impressive field of view offered by the Mirage.

The only real issue with using 2D Android apps on the Mirage is how simplistic the window management is. You can move the window and resize it, but there’s no provision for having multiple windows open at the same time. In fact, under normal circumstances there doesn’t even appear to be a way to switch between running applications without having to go all the way back to the main menu — although I did discover that when you have a physical keyboard connected you can use Alt-Tab to bring up the stock Android task switcher, which helps.

Entering the Third Dimension

At the start of this article I explained that the 3D Play Store was shuttered, and with it, all the games and applications that were actually designed to take advantage of virtual reality. But as we all know, nothing is every really gone on the internet, and thanks to some dedicated fans at the Opendream project, much of the Daydream software has been preserved and can be installed on the Mirage.

I’ll leave exploring the catalog of available Daydream software as an exercise for the reader, but at the very least you should install Firefox Reality. It’s not only a far more capable browser than Android’s stock version of Chrome, but it’s an excellent example of how immersive Daydream could be when the software took advantage of the platform.

The browser still shows up as a giant floating display, but now you’ve been transported into a darkened environment and have far better control over how everything looks. It also features a far more pronounced 3D effect, with pop-ups that actually hover over the page, and a 3D render of the remote that moves around in space in front of you as you swipe around the pages. There’s even support for curving the entire display, which makes for a very unique browsing experience.

Speaking of a unique experience, I’ve saved my absolute favorite for last — YouTube VR. It’s so well implemented and immersive that I’ve actually watched whole movies with this thing on my head. While there’s plenty about Daydream that clearly needed some more time to cook, Google really pulled out all the stops for this one.

Everything works as you’d expect, including 360 degree videos and even purchased content that’s attached to your Google account. At least for me, I’d go so far as to say that the experience is good enough that it’s worth getting a used Mirage Solo just for watching YouTube alone.

Nothing Lasts Forever

As I said at the start, it’s important to understand that the Lenovo Mirage Solo still having any sort of functionality in 2026 is something of a fluke. It’s supposed to be a dead product, and neither Google nor Lenovo want anything to do with it. There are no updates coming, no tech support, and no warranty.

At any moment, the YouTube API could make some kind of breaking change, or your favorite apps might get an update that prevents them from working on such an old version of Android. You’d be absolutely crazy to buy this headset at anything near its full retail price.

That being said…if you can get a good deal, and by that I mean certainly under $100 and closer to $50 – $70 USD, I think there’s enough life left in the device to make it worth picking up. If you end up getting one and doing something cool with it, I’d love to hear about it.

Illicit software on the computers of some of the world’s best online poker players allowed the accused cheater to see what cards were in the victims’ hands—and trounce them at the tables.

Bluesky tells WIRED it blocked links to a leaked archive of information on 41,000 ICE, CBP, and other DHS workers because it contains people’s contact information, shared without their authorization.

Although the term ‘quantum battery’ is a bit of a vague term, the cell that [Kieran Hymas] et al. demonstrate in a recent paper does seem to suggest that it uses quantum effects to charge faster than would otherwise be possible, with this rate increasing faster than its volume, meaning at a superextensive rate.

The general idea behind a quantum battery is that these somehow use a quantum effect to store and release energy faster than would be possible using classical physics. First proposed in 2013, the initial Dicke model saw its theoretical quantum advantage shot down by 2020, leading to the search for alternative models.

We have previously seen claims of a quantum advantage in batteries based on the Sachdev-Ye-Kitaev model, such as by [Davide Rossini] et al., but this new paper may be the first prototype cell demonstrating a reproducible effect.

In the here demonstrated cell a microcavity is created with strong light-matter coupling, allowing for both energy storage and discharging, with the illuminated particles super-absorbing the light with what the researchers claim to be due to these particles cooperating using a quantum mechanism. Effectively scaling up the cell would thus scale up the charge- and discharge rate faster than in a conventional chemical cell.

Whether this demonstration can be replicated and expanded upon remains to be seen, naturally. The stored energy in this experiment was very small and the storage time only very brief, so for now it serves primarily as an interesting experimental result for researchers to dig through.

Although e-paper displays are famous for being low-power and lasting essentially forever if not damaged physically, the recent push to drive even cheaper e-paper displays at a framerate like 30 FPS for a decent monochrome gaming experience does raise a few questions. The first being what this does to the power usage of these displays, and the second whether this will wear out the display in short order. To investigate this, [Bo Made It] set up a few experiments.

Subject of this test was a Waveshare ESP32-S3-ePaper board, which had previously been demonstrated running a Game Boy emulator at 30 FPS. With this software running, the board consumed on average about 115 mA, which would run down the device’s 400 mAh battery in about 3.5 hours. From here key was to isolate the power consumption of the display itself, with the system minus the display updates consuming about 90 mA.

Running the frame calculations for the greyscale mode without rendering to the screen pushed that up to 107.6 mA, with even in the 30 FPS greyscale mode the display thus only consuming about 7.4 mA, which is vanishingly small. Clearly the low-power claims of e-paper remain intact even at higher framerates.

As for lifespan, one datasheet gives the typical lifespan as one million updates. This would translate to about 9.3 hours at 30 FPS, though that assumes a full display refresh. Since a smart driver only updates changed pixels, obviously this will be longer, but the question is how much longer, and what will degradation look like?

After running 2.16 million frames of a custom endurance test featuring repeating patterns, some ghosting was apparent, but repeated refreshing made this go away again. This means that so far no permanent damage has been detected within the no doubt conservative limit provided by e-paper manufacturers.

It should be noted that Waveshare itself also recommends against running such high-FPS applications on their device, meaning that this is definitely one big longevity experiment. If actual damage occurs, this means that obviously this won’t be covered under any warranty.

The critical flaw in UEFI firmware—used by most server vendors and data centers—allows attackers to execute code early in the boot process.

The leaked records include the locations of ICE and CBP facilities, workers’ cell phone numbers, and the members of groups tied to wiretap programs, Palantir software, and xAI’s Grok chatbot.

If you’ve got an MX-style keyboard and want some retro charm, you might like a recent project from [Levente Szabadkai]. It’s a set of C64-style keycaps that you can print yourself at home!

The project started as an attempt to produce a set of C64 keycaps for an Ajazz 75% keyboard layout, but [Levente] kept pushing until it developed into a universal set. The keys have C64 legends, plain legends, or blank, and work for ANSI boards from 60% to full size. There are a few ways they can be printed. — you can do two-color printing with an FDM machine, or you can print the caps alone and fill the legends with paint, either in FDM or resin.

As a part of this work, [Levente] had to obviously create the glyphs to print upon all the keycaps. He thus decided to release that as the C64 keyboard font, in fact. It’s available in TTF and OTF formats, and you can preview the font in your browser, if so desired. It includes the function key labels, the 63 PETSCII graphic font legends, and various symbols, punctuation, and selected accented letters, too.

We’ve seen lots of vintage C64 parts recreated from scratch. It’s been at the point for a while where you can build a new machine with what’s available off the shelf. They said Amiga would never die, but it’s the earlier Commodore that really lives on today…

Upcycling smartphones makes a lot of sense, especially since they contain so many components that remain useful long after their desirability as a smartphone has faded. In the case of [Mountain DS Lab], they opted to use an 8-year old Xiaomi Mi 8 phone to add long-range FPV video link and remote control functionality to an RC plane, using the phone’s LTE cellular connectivity.

The smartphone was bought used for $23, with the default Xiaomi ROM overwritten by LineageOS to get a more lightweight and up to date Android installation on it. From the video it’s clear that this phone has seen better days, with the glass back cracked and a few ugly lines running across the display. Fortunately all that is needed is the motherboard itself.

One gotcha here is that the OS checks for the display on boot and will time-out if it’s not present, potentially halting the process entirely. The workaround requires disabling the display in the device tree, which is done by modifying the boot.img file as explained in the video. Next a custom bracket for the motherboard was printed so that it could be fitted inside the target airplane.

To communicate with the avionics, a USB-to-UART adapter PCB was created with a CH340 IC on it. This was then connected together for an initial test, with the extended front camera being used as the FPV camera for the custom Android application. Using the controller via the remote LTE link worked with the flight controller, so next the airplane was assembled for initial testing.

From this point it’s all pretty standard RC airplane assembly and testing, just with the typical RF-based control and FPV link replaced with the LTE link. Unfortunately flying drones isn’t permitted in the immediate area where the creator lives, so only some taxiing was tried prior to its maiden flight at a local airstrip that will be featured in an upcoming video.

Naturally, this isn’t the first time that someone has tried this type of remote control, with the ongoing Russo-Ukraine war being a prime example of LTE-based remote control of drones. Although we do not advocate wiping out a third of a nation’s strategic bomber fleet with upcycled smartphones, ultimately this is the same technology and a good way to create an RC drone that can last more than the few kilometers eked out from a 2.4 GHz link or so. Just be prepared for the LTE link to add a few milliseconds of latency.

You might fondly remember the days of the Intel 486, but you probably don’t have one on your desk anymore. If you’d like to emulate that classic hardware, you can now do it in your browser, thanks to [Jan de Jager].

What [Jan] has built is a 100% browser-based emulator for an Intel 80486DX2-66 PC. Obviously, it’s not just a CPU that’s being emulated here—[Jan] has gone so far as to throw in the motherboard and ISA/VLB adapter card emulation necessary to make this a real and functioning computer that runs inside a solitary browser tab.

It’s all written in ES6 JavaScript. It will happily run SeaBIOS, VGA BIOS, FreeDOS 1.3, and a whole bunch of classic games, like Wolfenstein 3D, Duke Nukem, and DOOM. There’s even a control panel where you can configure the PC how you like, from storage to expansion cards and all the rest.

Once upon a time an emulator was an application you had to download and run, hoping all the while that your new machine had enough grunt to emulate the classic hardware of your desires. These days, we have endless piles of CPU cycles to throw at everything and you can do it all within a browser. Or even on a tiny microcontroller, if you feel like it!

There are plenty of “robot” projects out there that are really just a small remote control platform of some sort. We often like to think of robots of having some sort of autonomy though. [Luca Fagioli] demonstrates a great example of this with his explorer robot that uses Simultaneous Localization and Mapping (SLAM) to navigate its environment.

The robot is a built on a small plastic chassis, with one gear motor per drive wheel. Running the show is an Arduino Uno R4 Wi-Fi, paired with the Sensor Shield 5.0 and an L298N motor driver board. There’s also an HC-SR04 ultrasonic sensor module onboard, mounted atop an SG-90 servo motor so it can be panned around. The ultrasonic sensor determines the range between the robot and surrounding walls, and a map is constructed at the same time as the robot is localizing itself within it. There are also infrared sensors on the bottom of the robot for detecting tape marks on the floor for checkpointing purposes.

Often, SLAM mapping is done with advanced laser rangefinders or time of flight sensors, but there are many ways to go about it as this project demonstrates. We’ve even seen it done in a distributed manner with coordinated drones combining their efforts. Overall, it’s a highly useful technique for robot navigation and wayfinding.

Having watched some fun videos on repurposed satellite dishes on YouTube, [Melan] wanted to get in on the action, managed to source an Intellian i4 — a dish built for marine use — and set about hacking it.

[Melan] first needed to convince the antenna that it was still on a boat by using an RP2040 microcontroller and an RS-422 module to send NMEA sentences. This was necessary to tell the i4 the “heading” of the “boat”, even though [Melan] was really using the rig stationary on land. From there, a simple email to the company itself sufficed to get the Intellian software running on the antenna.

But could it be controlled without the software?. Sniff the communications between the software and the Antenna Control Unit, and decompile the code. This done, it was relatively straightforward to put together a protocol description and figure out how to command the antenna where to point simply by issuing commands for azimuth and elevation.

We’ve featured other great bits of satellite equipment before, like this truck tracker teardown from a few years ago. If you’ve got some nice equipment on the bench that listens in on (or transmits out to) birds in space, don’t hesitate to let us know on the tipsline.

Many readers will be familiar with Douglas Englebart’s 1968 so-called “Mother of All Demos”, in which he described many of the devices and technologies we would be using two or three decades later. Among these was a primitive computer mouse, but while famous it was by no means the earliest pointing device. At the recent Vintage Computer Festival Berlin, [Dmitriy Kostiuk] delivered a fascinating lecture of the history of the pointing device.

It’s a long video that we’ve placed below, and it’s an exhaustive examination of the topic from the earliest examples to the 1990s when mice became commoditized. It’s a surprise to find that the first pointing device was a trackball built for a 1950s Canadian warship, with a surprisingly modern-looking optical encoder. Englebart’s 1966 wooden block with its pair of wheels and potentiometers had a less-well-known and much more stylish competitor in the same year from Telefunken.

We visit the various design iterations as the form of what we’d call a mouse today took shape. It’s unexpected to find that those Sun mice with the spotty mouse pad weren’t from Sun at all, they were from Mouse Systems. The first mice from Microsoft and Apple make an appearance, as do some awful designs for 8-bit computrs. Remembering those in particular perhaps it’s as well we didn’t have the cash to buy such a disappointing product for ourselves.

The video is long, but interesting. Give it a watch.

---

Header image, Douglas Englebart’s prototype, Michael Hicks, CC BY 2.0.