Optical cavities – two mirrors arranged to reflect light multiple times between them – form the basis of lasers and certain optical filters. Since any angle between the two mirrors results in light being scattered away, parallel alignment is essential, yet difficult to maintain. Nevertheless, [Timothy Giles] managed to 3D-print and align such an optical cavity, and used it to detect minute shifts in space and wavelength.
The cavity has two semi-transparent mirrors facing towards each other. One mirror is held in a 3D-printed mount, and the other is attached to the diaphragm of a speaker with a hole drilled through the center. The hole avoids the speaker coil, and allows light exiting the optical cavity through the semi-transparent mirror to appear on a paper target, which is monitored by a webcam. On the other side of the optical cavity, a laser diode coupled to a single-mode fiber shines in through the other mirror. Alignment is challenging, but the webcam makes it easier; as the mirrors tilt relative to each other, the pattern seen on the paper target changes, providing feedback for more precise adjustment.
Light reflected within the cavity can interfere constructively or destructively with incoming light, changing the brightness of the emitted beam. [Tim] used the speaker as a linear actuator to vary the cavity’s length, which, by counting the peaks in brightness, allowed him to measure the diaphragm’s displacement. This also demonstrated a laser diode’s wavelength instability: when the cavity was set to a constant length and the laser started up, the output brightness would cycle a few times. As the diode was warming up, its output wavelength was shifting, creating the same changing interference pattern.
To get a Gaussian beam distribution, [Tim] used a fiber-coupled laser; if you’d like to build one, we’ve seen a coupling mechanism built before. Most lasers are built around an internal optical cavity, but some instead use an external cavity.
I'm frustrated with various companies because we live in a time when everything is licensed to us; we don't own it after making the purchase. Amazon has never been one of my favorite corporations. But, like many of you, I've bought things from them numerous times over the years. That includes quite a bit of my current music collection.
Singapore has required SIM identity checks since 2005. As the FCC proposes similar US rules, Singapore's scam data shows verification alone isn't enough.
The post What Singapore’s $913M Scam Problem Says About FCC SIM ID Plans appeared first on TechRepublic.
Streaming has taken over the music industry, and Spotify has come out as the champion—but it's lost a lot of love along the way. I personally want a streaming service that provides a better experience both for me and for artists, one where I still have the option to actually buy music to call my own.
Today, Anthropic rolled out Opus 5, the newest update for the model that has recently become a popular choice for coding and other software development tasks, among other things.
While this is a noteworthy bump for Opus, it doesn't seem to be an Opus 4.5-level breakthrough in agentic coding performance.
© Anthropic
As we move further and further away from the heydays of the audio CD, things are getting a little muddled. Perhaps it wouldn't matter so much if physical media like vinyl, CDs, and cassettes were making a niche comeback among certain groups of people.
[Ayush Paul] posts about extracting data from Claude agents while it accesses web data to fulfill user requests.
But it wasn’t that easy. [Ayush] discovered that Anthropic anticipated many of the attacks, and set up guardrails in an attempt to keep the agent from accessing arbitrary web sites. For Claude to access a website, the user has to specify it, it must be the results of a web search, or it must be referenced by a website previously specified by the user or returned in a search.
To convince the Claude agent to navigate a malicious site designed to extract data, Ayush formed a false warning that Cloudflare was blocking the agent for authentication purposes, and asked it to spell out the name of the agents owner by clicking a list of alphabetical links. Of course Claude trusts Cloudflare and wants to be helpful, so it cheerfully completed the task.
Once the agent is trapped in the false authentication loop, it can be interrogated for all sorts of information it knows about the owner: Ayush was able to convince it to disclose employer, and even data about the user that could be linked to security questions, like their home town.
Since Claude can be detected by the user agent (the field attached to web requests that tells the web server what sort of browser is requesting the page) custom information can be fed to the bot while users see a normal website; clicking a link looks completely normal, but asking an agent to summarize the site triggers fooling the bot into spilling the beans.
After reporting the issue, Ayush was told that Anthropic had already identified the issue internally, and eventually prevented the attack for now by preventing the agent from following links on external pages.
Cereblab discovered that the Grok coding agent uploaded the entire content of the codebase it’s working with – and all Git history – to xAI servers, almost immediately. Even when told to never upload a file, the agent would reply “OK”, and then begin uploading the code bundle anyway.
If uploading your code to a remote server isn’t bad enough, and this could be extremely bad in some situations involving sensitive company code, including the entire Git history means that previously deleted files, like accidentally committed secrets or authentication credentials and tokens, were also leaked. Attempting to opt out by disabling options to improve the model by uploading code had no effect.
After gaining attention, Grok has added a privacy option to opt out of data retention. xAI has committed to deleting the retained uploaded code, but it is unclear if users will be told when their data has been removed. To actually prevent the agent from uploading local files to the xAI servers, even temporarily, a global flag “disable_codebase_upload” is required. Watch out, the privacy retention flags are only per-session!
Court filings in Washington state this month revealed an attempt to steal cryptocurrency using malware uploaded to the Steam gaming platform. Publicly identified and taken off the store in 2025, the filing alleges the same individuals were behind multiple games containing crypto stealing trojans: “Dashverse”, “Lunara”, “PirateFi”, “BlockBlasters”, and “Lampy”.
PC World covered the initial discovery of the malware on Steam. While Steam, overall, seems to do a good job preventing malware titles, 2025 had several high-profile cases. Prosecutors say the malware netted approximately $200,000 in stolen cryptocurrency wallets as well as other stolen credentials including Steam accounts.
Okta posts about a denial of service in OpenSSL where a single pre-auth packet is able to cause an allocation of up to 16 megabytes of RAM.
The “11 bytes” headline is very catchy, but more important than the actual number of bytes is the general asymmetric behavior; an attacker can send a very small amount of data and achieve a disproportionately large result. The OpenSSL vulnerability only has local impacts, exhausting server memory rather than generating network traffic, but similar attacks in the network space can fuel denial of service storms when extremely small requests result in amplified results.
The bug is ultimately due to being insufficiently suspicious of remotely supplied content, in this case the pre-authentication fields in the connection message that define the length of the incoming client message. Since the memory is pre-allocated in the server, the client doesn’t need to actually transmit that much data – it simply needs to hold the connection open. Keeping the connection open isn’t even required for causing problems – repeatedly allocating large blocks of different sizes can lead to memory fragmentation where the memory allocator keeps grabbing larger and larger ranges of memory because there isn’t sufficient ram available in a contiguous chunk.924899
Fortunately this bug has already been addressed in OpenSSL 4.0.1 and backported to maintenance releases of previous versions.
Saiflow has a report on a range of exposures via the electric vehicle charging infrastructure.
In CVE-2026-9039 Saiflow exposes the risks in some CCS2 EV charging stations. As part of the standard, communication is established between the charging station and the operator network, which is typically strongly secured via TLS and VPN use. A second connection, however, is established over the charging plug between the charging station and the vehicle; the vehicle is assigned an IPv6 address for communicating with the charger for various charging protocols.
The XCharge C6 charging station exposes SSH and basic telnet network services on all network interfaces, including the interface connected to the vehicle. To make it even worse, they allow root login, with password “root”, giving full admin access to the charging station.
Once inside the charging station, an attacker has access to the network connection from the charging station to the company network, as well as root control over the charging station itself, with the possibility of damaging the charger, changing the power output levels, or getting free charging. If a future vulnerability was found in the management interface of the vehicle, a compromised charger could be used to attack future connected vehicles.
The main lessons for vendors seem to be ones we’re familiar with already: never leave default credentials, especially not “root” and “root” in a product, and be aware of what networks you expose services on. Good lessons for all of us; let those who have never left a Raspberry Pi with default credentials on a network cast the first stone.
In news that has likely been impossible to avoid, Axios reports on a compromise of the Hugging Face platform by an OpenAI model. The reports around the incident echo the frequently weird boastful statements from OpenAI, who state “We consider this to be an unprecedented cyber incident” and they “are responding accordingly”, despite being the originators of and cause of said incident.
Multiple vulnerabilities in the Hugging Face API were combined to accomplish the breach, including an unknown vulnerability in the package registry system. OpenAI says that safeguards on their model had been disabled for the test, which seems irresponsible given the outcome. Under almost any normal situation, conducting an unsolicited test of the security of a company because safeguards were ignored is considered illegal hacking, not fodder for a pre-IPO press release and humble-brag.
Possibly feeling that Microsoft has all the press for a record-breaking Patch Tuesday last week, the Linux kernel developers have announced 442 CVEs related to the kernel.
With this many vulnerabilities in one report, it’s nearly impossible to isolate at a glance which ones are truly impactful and which are simply incorrect behavior. While CVE entries have been created, none have been assigned severity scores yet.
It appears the majority of the vulnerabilities were found with Sashiko, an agent developed by the Linux Foundation and trained on the Linux kernel for finding vulnerabilities in new submissions.
After recent negative press (some of which we covered here) about the prevalence of residential proxy apps on the LG platform, Krebs on Security now reports that LG is banning the behavior from apps on the platform.
This comes after Spur reported that 42% of apps on the platform contained libraries to enable always-on residential proxies, which allow access to the network the television is connected to. Residential proxies can be used as a pivot point to attack companies and bypass geographic IP restrictions, commit ad fraud, or access the internal home networks of users.
CISA, the US cyber security agency, has issued a warning that Iranian based attackers are targeting industrial control systems made by Rockwell Automation, Schneider Electric, and Siemens.
These sort of controllers are found in manufacturing, waste processing, water treatment, and other industrial processes, and attackers have been able to upload custom control logic, overriding “safe operating parameters” according to the report. Most of us will never be responsible for these systems, but they impact our lives all the time.
Finally, Cisco has released a set of open-weight models to aid in searching a codebase for known vulnerabilities. The Antares models are open-weight models designed to run fully locally and search a code base for vulnerabilities related to lists of known CVE issues. Cisco has published the models on Hugging Face.
Are you using AI tooling for security scans or research? How is it going?
Moonshot's giant new model puts open-weight AI back in the spotlight. For Australian enterprises, the sovereignty story matters more than the model.
The post Kimi K3: The Open-Weight AI Question for Australian Enterprises appeared first on TechRepublic.
1Password just gave Claude access to Australian logins without the passwords — right as Canberra moves toward mandatory AI rules.
The post Could Australia’s AI Rules Challenge AI Agents That Can Log In? appeared first on TechRepublic.
Trump Media's planned Truth API is drawing regulatory scrutiny as lawmakers question whether premium access to market-moving Truth Social posts creates fairness concerns.
The post Why Trump Media’s New API Is Raising Questions on Capitol Hill appeared first on TechRepublic.
Viettel is gaining early access to Qualcomm’s developing 6G platform, but the agreement does not yet amount to a commercial chipset or network launch.
The post Viettel Becomes Qualcomm’s First 6G Early Access Partner appeared first on TechRepublic.
We enjoyed [Beej’s] trip down memory lane looking at a BASIC game, The Wizard’s Castle, written for the Exidy Sorcerer. It appeared in a 1980 magazine that included the title graphic above. It reminded us how, back in those days, we did things with BASIC that you shouldn’t be able to do and it often looks, today, rather cryptic.
In particular, even if you know modern BASIC, these few lines might give you a pause:
10 REM"_(C2SLFF4 40 POKE 260,218: POKE 261,1: T = USR(0): T = PEEK(-2049) 80 Q = RND(-(2*T+1))
Line 10 is a comment, but a strange one. Certainly that doesn’t matter, right? Actually, it is a key part of the action. On line 40, you can see some pokes to write directly to memory and a peek to read some memory value back. The USR function calls some machine language program. You may realize the whole thing is to get some value T to seed the random number generator in line 80.
This leads to a few obvious questions. First, how does USR know what to call? Second, where is the machine language program? The details varied by system, of course, but in this case, the program knows that location 259 has a jump instruction that USR called. So poking an address into 260 and 261 was telling USR where it should go.
But what’s at that address? Keep in mind that an old computer like the Sorcerer didn’t have megabytes of memory being swapped about by an operating system. That means that things tended to be in known places and that BASIC had to be judicious about storing source code.
As was common at the time, a line like “10 PRINT 1+1” would get tokenized. In this case, each line would get a pointer to the next line, a two-byte line number, a single-byte token for “PRINT” and then more bytes to represent the rest of the line. In the case of text in a string or a remark, the bytes were just the text with a zero to terminate the string.
The first line entered would always be at address 469. So? If you consider the format of the REM statement, there will be a pointer at 469 and 470, the line number at 471 and 472, and the REM token at 473. That means the other bytes just get poured into address 474 and beyond.
That might seem like an odd number until you look at the pokes in line 40. Keep in mind that POKE works on bytes, not words. So poking 1 into 261 gives you an address of 256 + whatever is in the low byte, in this case 218. Add 256 and 218, and you get… 474! So USR is going to call that odd string in line 10!
There is more to the detective story, but if you want to know exactly what the REM did, you can read the original post.
Login