In this specially-numbered podcast episode that lines up quite nicely with our Retrocomputing Challenge, Elliot Williams and Kristina Panos met over surprisingly low latency and loud beverages to bring you the best of the previous week’s hacks.

But first, the news. German company Isar Aerospace can now claim that they’ve launched the first spacecraft into orbit from Europe. Be sure to check out the in-link, where we reported on the building of the spaceport.

In Hackaday news, the aforementioned Retrocomputing Contest had 64 entries at last check, which is just perfect for Episode 386. Will yours be the 65th?

Supercon Ten tickets are selling out, and per Elliot, the talks have been chosen, pending approval by each submitter.  Keep an eye on the blog for the official announcement!

After reviewing the news, Elliot reached into the ol’ Mailbag and found two missives, including another from [Vik Olliver] regarding the printing of LEGO. The other is from [Mendel Munkis], who has been enjoying Wikipedia offline since 2018, thanks to a 32-bit ARM9 processor. Then, it was on to the hacks.

Check out the links below if you want to follow along, and as always, tell us what you think about this episode in the comments!

Download in lovely MP3.

Episode 386 Show Notes:

News:

• The First Spacecraft Launched To Orbit From Europe
• Announcing The 2026 Hackaday Retrocomputing Challenge
• Retro Computing Contest
• Wikipedia: Unusual articles

Mailbag:

• This week, we have a double feature!

Interesting Hacks of the Week:

• Making A Pole Balance Itself With Propellers
  • 3D-Printed Self-Balancing Robot Brings Control Theory To Life
• Free Your Rotary Telephone From Its Wire
  • • Simplify Your Life With This Pocket Rotary Cellphone
    • The Open Source Rotary Cell Phone, Two Years Later
    • Using Old Phones As An Intercom In Your VW Bus (or Anywhere Else)
    • Wikipedia: Intercept messages
    • This Is a Recording
• Printing Micron-Scale Benchies With Resin And Turmeric
  • GitHub – 0x23/MicroManipulatorStepper: A sub-micrometer 3D motion control plattform. · GitHub
• This Clavichord Is A Well-Tempered Project
• The Different Ways To Look At Negative Resistance
• There’s A Whole Computer Inside This Mouse

Quick Hacks:

• Elliot’s Picks:
  • If It’s Electronic Paper, Why Not Print To It?
  • 3D Printable Lenticular Indicators
  • The Helicopter With Radioactive Blades
• Kristina’s Picks:
  • A Split Keyboard Designed For Human Hands
  • Take Tool Photo, Generate Custom Gridfinity Bin
  • Anti-Doomscroll Tamagotchi Only Lives If You Do

Can’t-Miss Articles:

• Hackaday Europe 2026: Outdoors With Robots
• Hunting The Wild Vibrotruck

Several times this summer, Microsoft’s Patch Tuesday, the monthly roundup of major security patches for Microsoft products, has included record-breaking numbers of security fixes. The August 2026 patch set actually seemed to catch up. Was this a sign of the bug apocalypse lessening? Ha, nope!

Brian Krebs at Krebs On Security once again brings his excellent roundup of Patch Tuesday events, with this months patch set absolutely crushing previous numbers with nearly 1,000 security fixes.

Two of the fixes are for zero-day vulnerabilities under active exploitation in the wild, both allowing privilege escalation on Windows. Privilege escalation bugs turn general vulnerabilities in applications and games into full administrator access to gain persistence and deploy ransomware, and generally make any vulnerability significantly worse.

Krebs also calls out a CVSS 9.8 (so close to a perfect 10!) vulnerability that allows remote code execution in the Windows shell with no user interaction and no authentication, a remotely exploitable DNS bug present since Windows Server 2012 and Windows 10 which will likely see exploitation in the wild soon, and over a hundred other bugs are ranked “Critical”.

How the sheer volume of vulnerabilities in this patch will fit with recent Microsoft recommendations that companies should apply the patches immediately remains to be seen. (Likely: not very well, depending on what new behavior and issues the fixes cause!)

Is Your LG TV Spying on You?

Gamers Nexus continues their trend of high-quality investigation, and they have posted another tremendous multi-hour investigatory video. This time Gamers Nexus focuses on the ecosystem of LG televisions and monitors.

It shouldn’t likely surprise many here that “smart” devices are usually more to the benefit of advertisers than consumers. Similarly, it shouldn’t be a surprise that a “smart” device harvests user data to sell to advertises. What may be surprising is the degree to which LG devices appear to collect data, how much data is sent even when collection is turned off, and how overt executives at the company are, with multiple executives making statements in pitches to advertisers that LG “owns the glass”, “owns the living room”, and is designed to correlate devices, inhabitants of the environment, and viewing habits so that ads can be served to the TV and mobile devices in the same room simultaneously.

With tracking enabled, the smart TV captures telemetry of what applications are used, as well as continually capturing the video displayed and reporting fingerprints to LG servers and ad partners. The screen content is tracked not only for TV, but for the HDMI inputs, including if the TV is used as a PC monitor. If voice control is enabled, the TV also records audio and analyzes it. The TV also continually scans the local network and nearby Wi-Fi networks, reporting all the devices it finds on the local network, including host name, MAC address, and sometimes software running depending on the MDNS advertisements. Near-by Wi-Fi networks are sufficient for very precise geolocation, so LG effectively knows the location of every customer, as well.

Gamers Nexus makes the point that while the invasive ad tech is gross, it’s mostly limited if the user does not agree to the end-user license agreement – but the infrastructure required to enable it is riddled with security flaws, both discovered and likely additional undiscovered issues. A smart TV is basically a computer, usually running either some flavor of Android or Linux, with the attendant flexibility, power, and problems. A vulnerability in the TV operating system or its apps can provide a route into your internal network. (Not that this required an exploit: LG was called out earlier this summer because 42% of apps on the official app store contained residential proxy systems to sell your home Internet connection.) But it can also access any of the attached hardware, like the microphone.

Gamers Nexus demonstrates that a LG TV can be exploited to gain local root, and from there, it can record audio from attached devices – even when the primary microphone is muted. Gamers Nexus also discovered that muting the microphone on some models does not disconnect or disable the microphone, it simply sets the gain levels extremely low; recording is still possible, and with amplification, audio is still recoverable.

Spy tech and ad tech goes hand in hand; it will be interesting to see if LG responds by at least hardening the security on the devices, or if another company finds traction in selling modern televisions and monitors without the “smart” advertising.

Shai-Halud NPM Worm Returns

Aikido.dev reports that after 111 days, the Shai-Halud worm returned to the NPM repository.

Shai-Halud was one of several worms hitting package repositories in the Spring of 2026, installing backdoors, stealing cryptocurrency wallets, and taking every login credential and authentication token it could find before infecting every package the tokens linked to. Since then, infections have remained quiet, and repositories like NPM have stated that they now scan every package as it is uploaded.

Charlie Erkisen at Aikido.dev observed that on September 7, 2026, four additional packages uploaded to NPM were infected with Shai-Halud; not a variant of the worm, but the original code, matching the known public signatures. Whatever scanning is in place in the NPM repository didn’t filter them, and if an exact match for a known, major worm isn’t caught by the infrastructure, it’s unclear how a new threat would be.

Boston Scientific Hack Continues

The apparent ransomware attack against Boston Scientific continues to have impacts, with Boston Scientific filing a report with the SEC that the attack is expected to have an impact on the company earnings.

Boston Scientific makes medical devices, like pacemakers, stents, and monitoring equipment. It has not yet been publicly disclosed what happened, or if customer data was compromised, but the SEC filing confirms that unauthorized access on “certain systems” causing an outage. After several weeks of outages, the company reports that it is able to ship almost at capacity, and that the sterilization facilities for medical devices are online. While there is no estimate provided for full recovery, efforts are ongoing.

Commerce Sites Vulnerable

Adobe released a security bulletin that the Adobe Commerce and Magento platforms are under active exploitation from CVE-2026-75650, a flaw in the template engine.

These platforms power tens of thousands of commerce sites, and vulnerabilities in them are usually used to steal payment data or serve malware to customers during the checkout process. Previously this year, Magento patched another vulnerability which allowed uploading executable files to any store, and indications are that the current vulnerability has been exploited in the wild since early September 2026.

The current vulnerability allows implantation of PHP code by injecting custom styles into a query, which is then executed when Magento generates a failure email and renders the template. The attackers then download and install a control binary written in Rust which masquerades as a kernel thread task, which then monitors the store and collects payment data.

The vulnerability was publicly known and used for several days before Adobe made official statements of a fix being available, leaving any store running on Magento vulnerable with no official fixes, but as of writing this, Adobe has published patches and an advisory.

Microsoft to Block Unpatched Servers

Microsoft plans to block emails to to the cloud-hosted Exchange Online from unpatched on-premises Exchange servers.

Apparently the urge to self-host Microsoft Exchange is coupled with antipathy about actually patching it, to such a significant level that Microsoft is taking the steps to detect incoming mail from servers that have not patched since October 2025. While Microsoft updates rarely apply with zero problems, nearly a year is more than enough time to have tested and deployed a security fix.

“This update released nearly a year ago, and all organizations should have updated to it”: so say we all.

Hackers Pose as Recruiters

Government-backed groups in Iran have been posing as recruiters trying to infect targets with malware.

The group, designated “Nimbus Manticore”, is known to develop custom malware and remote access tools (RATs), and typically target specific individuals via spear-phishing attacks. The latest malware from the group is cross-platform and can infect Windows, macOS, and Linux, installing services to run websocket-based remote access tunnels, SSH tunnels, and a command-and-control client that allows live control of the infected device.

The group contacts targets posing as recruiters, but first the target must solve a coding challenge contained in a zip file. The zip contains a trojaned Node.js project which infects the victim system when compiled, deploying the remote access tools and setting up persistence to relaunch them if disabled. Multiple variants have already been spotted, generally targeting different countries, predominately Egypt, Afghanistan, and Ethiopia.

The latest version of the malware package also looks for settings and data from major security vendors like Symantec, CrowdStrike, and SentinelOne, as well as the contents of directories related to Google and Microsoft services.

The fake recruiting method has also been used by other groups in Iran and North Korea. Remember: any project with a build script can execute any commands as part of the build, and most IDE project files also allow embedding custom plugins and commands into the project. Triggering a compile on a project is the same as running arbitrary commands!

150 Million US Drivers Licenses Stolen

As many outlets are now reporting, a major ID validation company was compromised, leading to the theft of scans and data of 150 million US drivers licenses.

IDScan provides drivers license and identification card scanning services used by car rental companies, bars and dispensaries, hotels, concert venues, and a multitude of other businesses. If you’ve ever had to hand your ID over for validation, there’s a high chance you’ve interacted with IDScan or a similar company.

Evidence points to IDScan being compromised for at least a year, with full scans of licenses continually exfiltrated. The scans include everything visible on a typical license or ID card, including name, license identification number, ID photo, and home address, but also the date that it was scanned in. The collection even includes additional scans of the ID in ultraviolet and infrared to catch any watermarks. With 150 million entries, the data set contains everyone from the security researcher Brian Krebs who broke the story, to government officials like Pete Hegseth.

The data has been available for sale, individually or in bulk, although with the recent press coverage the site claiming to sell the data has gone offline for now. Before disappearing, the site claimed that all data was exfiltrated into their own databases, which means it’s still available somewhere, and shutting them out of the IDScan service won’t protect data already stolen.

Many aspects of this echo the scanned ID data stolen from validation services used by Discord and other online services: almost like scanning unchangeable government IDs is a bad plan?

American Meteor Society Knocked Offline

It’s all fun and games until they come for the geek hobbies. The American Meteor Society Fireball tracking program is was knocked offline, seemingly from a ransomware attack. Fortunately it looks like as of writing this, the admins were able to restore a backup and the site is online again.

This week Jonathan chats with Olivier Vernin of Updatecli, the tool that helps you update everything! Need to roll out dependency updates intelligently? Or even automatically deploy to a server on changes? Updatecli can help!

• https://www.updatecli.io/
• https://github.com/updatecli/updatecli/

Did you know you can watch the live recording of the show right on our YouTube Channel? Have someone you’d like us to interview? Let us know, or have the guest contact us! Take a look at the schedule here.

Direct Download in DRM-free MP3.

If you’d rather read along, here’s the transcript for this week’s episode.

Theme music: “Newer Wave” Kevin MacLeod (incompetech.com)

Licensed under Creative Commons: By Attribution 4.0 License

Yesterday, Isar Aerospace secured its place in the history books when the upper stage of their Spectrum rocket put a payload of CubeSats into low Earth orbit (LEO). Not only does this make them the first European company to achieve such a feat, but it also marks the first time a booster departing from continental Europe has reached orbit. Not bad for a second attempt.

Standing 28 meters (92 feet) tall, the two-stage Spectrum rocket is just shy of half the size of the SpaceX Falcon 9 and designed to put a maximum of 1,000 kilograms (2,200 pounds) into LEO and 700 kg (1,500 lb) into the Sun-synchronous orbits used by Earth observation satellites. That puts its performance considerably ahead of other commercial launchers such as Rocket Lab’s Electron. Although the booster is not reusable, Isar Aerospace has stated they’re targeting a respectable launch cost of €10,000 ($11,700) per kilogram. The German company notes there are several more Spectrum vehicles currently in production, and when their new factory is operational, they’ll have the capacity to produce up to 40 of them each year.

In other European space news, BepiColombo has now entered what the European Space Agency (ESA) is calling the “arrival phase” of its nearly decade-long journey to Mercury. On Thursday, the spacecraft jettisoned its ion propulsion module as it had achieved the necessary trajectory and velocity to be captured by the planet’s gravitational field when it swoops by in November.

Launched in 2018, the BepiColombo mission is actually carrying two separate craft: the ESA’s Mercury Planetary Orbiter and the Mercury Magnetospheric Orbiter from Japan. After the two separate from each other in December, they will operate independently to study their respective aspects of the solar system’s innermost planet for the next year, although, as is often the case for missions like this, an extension is always possible if things are still going well at that point.

On the subject of hardware outliving its original design lifetime, an active community of hackers has done a fantastic job of keeping the Spotify Car Thing up and running after the company officially pulled the plug on it just two years after its 2022 release. They’ve got a full Linux distribution running on it featuring a slick UI that can launch apps, check the weather, tap into Home Assistant, and of course, play music. The community is currently running a contest with cash prizes to spur on development of new open source software for the liberated Car Thing, and we’re eager to see what comes of it.

Speaking of keeping things open, the Free Software Foundation (FSF) has joined Bluesky — but they aren’t exactly thrilled with it. Being federated and largely comprised of free and open-source software, the FSF admits that Bluesky is the lesser evil when compared to something like X or Facebook. But they still can’t recommend others join the service, as the actual signup process requires your browser to run non-free JavaScript code.

One may wonder why the FSF would join Bluesky if they can’t recommend the service to others, and the answer is simply because they want to get the word out to a wider audience. While the FSF already operates an account on Mastodon, there’s a good chance that anyone who’s willingly regularly using said platform doesn’t need any additional convincing when it comes to the evils of proprietary software.

This is as good a time as any to point out that Hackaday is on Bluesky and Mastodon as well, and unlike the FSF, we’re also on Facebook, although the automatic sharing of new posts hasn’t worked for quite some time and honestly we can’t be bothered to figure out why. For our readers with a particular aversion to grass, we’ve even got an official IRC channel on libera.chat where you and nearly 50 others can feel superior to the thousands of immoral heathens that have joined our Discord server.

Finally, it’s been 50 years since the introduction of the ColorChecker — that little card with 24 blocks of colors that’s placed in the frame of a picture or video to provide a visual reference point. In honor of the milestone, Calibrite has put together a timeline that walks you through its history, starting with its inception in the 1976 paper “A Color-Rendition Chart” by C.S. McCamy, H. Marcus, and J.G. Davidson and running up to how the handy tool evolved for the digital age.

There are plenty of facts and trivia about the ColorChecker that you can bring up the next time you want to impress a photographer, and we especially appreciated the breakdown of what each of the original 24 colors was meant to represent.

See something interesting that you think would be a good fit for our weekly Links column? Drop us a line; we’d love to hear about it.

As the calendar turns a leaf into September, Elliot Williams is joined by Jenny List for our weekly look at all things Hackaday.

In the news, our retrocomputing competition is well under way, but there’s plenty of time to get an entry in if you’ve got a cool old-style project to show us. And then Elliot’s been chasing seismic surveyors in Munich, where they’re looking for geothermal energy.

In the stand-out hacks there’s a discussion of smoothing 3D prints using frickin’ lasers, the effect of unreasonably high RAM and storage prices on the single board computer ecosystem, and an unfortunate air conditioning system that’s tricked into believing it’s a hot day. Finally, we look in depth at PETG, and take a dive into reverse Polish notation.

Download your own personal version of the podcast right here.

Episode 384 Show Notes:

Mailbag:

In out mailbag this week we had [Kevin Opalka] asking about roadtrip hacks and [Matthew Rowberry] explaining that most versatile yet underrated prototyping medium: the humble Lego brick. Which in turn gives us the chance to mention Lego House: Right Next To Denmark’s Legoland, But Way Cooler, a trip we made back in 2019.

Got something to say? Send an e-mail or an audio clip to mailbag@hackaday.com.

News:

• Announcing The 2026 Hackaday Retrocomputing Challenge
• Seismic investigation for Munich’s geothermal project.

Interesting Hacks of the Week:

• Laser Your Way To Smoother FDM 3D Prints
  • Has FDM 3D Printing Hit Its Peak?
• Has the time of esoteric operating systems arrived?
  • Haiku OS Releases Beta 6
  • ReactOS Gets An Upgrade
  • Amiga-Inspired AROS Goes Bare Metal On Raspberry Pi
• Tricking An Air Conditioner Into Cooling
• Wikipedia On A Cheap Yellow Display
• HDMI For The Color Computer 2
• RAM And EMMC Prices Are So High, Pine64 Has Stopped Linux Device Production

Quick Hacks:

• Elliot’s Picks:
  • Doubling Thermal Printer Resolution By Wiggling
  • A Defrag Simulator In Your Browser
  • Reactive Heat And Wind Come To VR, Thanks To Smart Plugs
  • Get Your Monitor Transmitting VHF With A Browser Tool
• Jenny’s Picks:
  • Digital “Film” For Your Pi Camera
  • Giving The NES An Optical Data Storage Add-On
  • How A 1981 RAM Expansion Worked

Can’t-Miss Articles:

• PETG: The PLA Filament Alternative That Just Works
• “I’m Not Dead Yet!” Reverse Polish Notation Calculators You Can Still Buy
  • Teardown With A Twist: 1975 Sinclair Scientific Calculator
  • Reverse Polish Notation And Its Mildly Confusing Elegance

The AI platform ServiceNow which offers both hosted and on-premises versions just patched a trifecta of CVSS-10 vulnerabilities.

CVSS rankings are determined by the severity of a flaw, the ease of exploiting the bug, if authentication is required for exploitation, if the vulnerability exposes confidential data, and other criteria. A CVSS of 10 is as bad as it gets, and having three of them at once is certainly attention-getting. Of the three vulnerabilities fixed, one allowed unauthenticated modification of data in the hosted instance, a second allowed arbitrary code execution via the GraphQL interface, and the third allowed arbitrary SQL commands that could modify the database.

ServiceNow claims Adobe, Lenovo, Fedex, and Fujitsu among their high-profile customers. With luck, the vulnerabilities were patched before significant public exploitation could happen.

Router Malware

Previously in 2026 the US Government warned against embedded malware found in consumer routers, which may be linked to the FCC enacting bans against certification and import of foreign-made consumer devices. This week, the NVD (National Vulnerability Database) reported specific embedded malware in the Zbtlink and MoreQuick brands of devices.

Multiple versions of the firmware, for multiple lines of products, contain a backdoor service that uses unencrypted UDP to connect to a command and control (C2) service. The service, or anyone able to intercept the network traffic, since it’s unencrypted, can execute commands as root, allowing them to change configurations, open tunnels, or steal ISP credentials.

The malware is baked into the firmware, so removing it is impossible for most users: a factory reset wouldn’t do. In theory if third-party firmware like OpenWRT supports these devices, the hardware could be made safer with a custom install.

Given how commonly the same device is marketed under dozens of names, likely the same devices and firmware have yet to be identified under other brands.

Vulnerability in Qubes

The security-focused distribution Qubes has an important security bulletin for recently discovered issues.

Qubes is built on top of the Xen virtualization system, where each application can be given a dedicated container. The utility to copy files from the primary container into an application container, qvm-copy-to-vm, displays a message if there is an error copying the file. To show the message, the utility launches kdialog with the error as arguments, but fails to ensure that the error doesn’t include shell commands.

The system call used to show the alerts has the dangerous side effect of calling the command as if it was a normal shell. This is extremely powerful, but equally risky: a shell typically allows multiple commands per lines, require quoted strings to protect arguments with spaces or complex text, and can expand variables. Generating an error that escapes out of the message and runs arbitrary commands was all it took.

Qubes already has a fix ready and everyone getting standard updates should have it waiting.

Were US Military Freezers Hacked?

The controls for the freezers used in the commissaries of a growing number of US military bases may have been compromised.

Independent researchers noticed growing reports in Reddit threads that freezer units were out of service, with other service members and families reporting the same. At least fourteen bases throughout the United States appear impacted, and the story has been picked up by the official military newspaper “Stars and Stripes” as well as by mainstream media outlets.

Posts by staff at the bases clarify that it was not a power loss or cooling loss, the fridges and freezers were placed in defrost mode where they self-heated. The commissaries are operated by the Defense Commissary Agency, with central monitoring and control of facilities. Central monitoring makes complete sense when you need to ensure devices are keeping food at a safe temperature, but something definitely seems to have gone wrong.

Diving into it further, M. Elizabeth finds a post from August 9, 2026 describing vulnerabilities in the Danfoss controllers that allow unauthorized access to the refrigeration controller, and a second paper by the same team exposing over 20 vulnerabilities in Copeland refrigeration controllers that included full control of the unit settings. M. Elizabeth is careful to point out that without confirmation from the commissary agency, it’s impossible to know for sure that this was a hack of the control system, but the evidence is mounting.

BGP and SSL Hijack Used to Push Bad Updates

Virtualizor, a web interface for managing virtual machines in an enterprise (bring-your-own AWS), was recently targeted in a global route hijacking scheme.

Border Gateway Protocol (BGP) is a core routing system underlying the Internet at large. Service providers use BGP to announce the ranges of IP addresses they handle and how to reach them. BGP is operated as basically a global gentleman’s agreement: the protocol itself lacks any authentication or encryption. If you think this sounds vulnerable to disruption, you’d be completely right.

Global disruptions have happened accidentally, like when an ISP in Pakistan took down YouTube, deliberately, such as when thieves hijacked the routes to cryptocurrency exchanges, and mysteriously, like when China hijacked parts of the Internet repeatedly with no explanation.

This time, the BGP attack targeted the IP range used by Virtualizor, and was combined with spoofed SSL certificates for the Virtualizor servers to push spoofed updates. The BGP announcement was targeted to a specific class C: a relatively small allocation of 253 addresses, similar to what a home network would use. BGP gives precedence to the smallest announcement for an IP range, so all systems that received the spoofed announcement routed those addresses accordingly. The network advertising the false route was based in Romania, though of course they could also be a victim.

With control over the IP range, the attackers were able to generate a certificate via Lets Encrypt, which was sufficient for browsers and the updater to accept the rerouted addresses. The attackers then published a malicious package that appears to install additional services. The company has not provided details about the trojaned update, so it’s not clear what other risks it poses.

Virtualizor does not have a public list of customers, but one has to assume it includes high-profile companies to make such an attack viable. Hijacking BGP is extremely obvious, and isn’t frequently used for such obvious spoofing attacks.

Linux Zoom Steals Clipboard Contents

Simon Tatham, the author of the extremely popular PuTTY SSH client among other projects, posted on Mastodon an interesting observation about the clipboard behavior of recent Zoom clients on Linux.

Relatively recently, some operating systems have added the ability to alert the user when an application access the clipboard. Unfortunately, Linux is not yet one of them, but thanks to other clipboard management tools, Simon noticed that the recent update to Zoom 7.1.5 copies the contents of the clipboard as soon as they change. What happens to the clipboard contents once copied is currently a mystery.

Considering that the clipboard can often contain passwords, authentication tokens, or simply data you might not want to share with Zoom, automatically scraping the contents isn’t what you’d hope for.

Plex Vulnerabilities

The Plex media streaming software sent out an advisory this week warning about security updates for the server and desktop application.

Details are currently thin, with the promise of future details once CVEs have been assigned. For now, make sure you’re on version 1.43.4 or newer. The Plex post has additional directions for updating on platforms that may not have pushed new packages yet.

AI Accelerates Exploit Development

Security company CrowdStrike has released their 2026 report on threats, focusing on the proliferation of AI tools in exploit writing.

CrowdStrike observed that 88% of exploits happened with 48 hours of the proof of concept code being released, crediting AI tools for shortening the adaptation. Typically proof of concept code is designed to demonstrate the vulnerability without providing an immediate mechanism for malicious use, and the window from exploit announcement to wide-spread risk was on the order of weeks. The report notes some vulnerabilities being widely exploited in 20 hours after public disclosure.

The tightening window makes patching even more important, but rapid patching caries the risk of instability when the patches themselves haven’t had extensive testing. Unfortunately there’s no simple solution; faster exploitation via AI tools drives faster patching, often also with AI tools that can introduce more bugs as well.

Oftentimes, when we’re using a microcontroller, we’re whipping up some very specific code focused on executing a particular task. The device is set up to execute code that does exactly what we want with minimal overhead. However, sometimes, there are scenarios where it pays to go with a somewhat heavier setup, wherein the microcontroller runs an operating system for the benefits that offers.

Federico Terraneo came to Hackaday Europe to discuss this very topic. He talks about kernel architecture, real-time operating systems, and how to best use C++ in the world of microcontrollers.

Microcontrolling

The talk begins in a helpful place. Federico starts by explaining what an operating system actually is. Basically, it’s the software that exists between the hardware and the applications that run upon it. Breaking it down into parts, an operating system typically consists of a main kernel, atop which sits things like the basic system services, libraries, and device drivers, along with utility programs necessary to maintain and work with the system. The user interface sits on top of all that, which allows the user to select and run applications and generally use the operating system to get things done.

Of course, different operating systems differ in the specifics of their architectures. Monolithic kernels, such as Linux relies on, keep a split between kernelspace and userspace. This is where where the kernel has full hardware access running on the CPU in system mode, while the applications run in user mode without such direct access. Monolithic kernels typically only run on architectures with memory management units (MMU)—think full-scale computers with proper CPUs, like your laptop or desktop. Unikernel operating systems, like FreeRTOS, are a little different, where applications and the operating system are collapsed down into a single executable binary that runs with raw hardware access. There is no abstraction, no memory protection, or anything like that, which makes the architecture easier to run on typical microcontrollers. There are also microkernels, which aim to minimize the amount of code that runs in system mode, pushing things like drivers and filesystem access into userspace. This architecture still needs an MMU, and is mostly only seen in niche uses where high security and/or attention to safety is critical.

When it comes to microcontrollers, unikernels are the most relevant architecture to think about. However, they have limitations–in stability, in security, in the fact that there is no run-time code loading or any way to easily partially upgrade the system. The fluid kernel, which Federico came to explain, aims to solve some of these issues. It hopes to offer a scalable operating system solution that works across the world of embedded computing, where sometimes microcontroller resources are limited and where memory management units seldom exist. It’s also intended to be compatible with standard APIs—think POSIX, C++ standard libraries, and all that. Federico calls it the “UNIX on a chip” concept.

The fluid kernel aims to exist at the intersection of the monolithic kernel and the unikernel. It allows hosting applications in kernelspace or in userspace as needed. A fluid kernel is also built to be POSIX compliant twice—with the same API whether you’re operating in kernelspace or userspace. The fluid kernel concept is designed around achieving process abstraction via the hardware Memory Protection Unit (MPU) common in modern 32-bit microcontrollers. It’s not quite an MMU, and can’t do all the same fancy virtual memory tricks, but it’s enough to provide a basic level of memory protection on a microcontroller platform. The fluid kernel can also become a unikernel if so desired as a compile-time option, which takes away process support while reducing code size significantly. It allows for unikernel devleopment that can be upgraded into a fluid kernel later by flipping the compile-time option the other way.

Federico does a great job of explaining the pros and cons of the fluid kernel architecture, and explores the security implications inherent in going this route. The Miosix RTOS is discussed as the practical implementation of this philosophy, and there’s even a helpful diversion into the efficient use of C++ on microcontrollers. If you’re getting serious about embedded development, or you just want to learn about a new architecture you might find useful one day, it’s a great talk to dive into on your next lunch break.

This week Jonathan chats with Benjamin Samuels of Trail of Bits! The conversation focuses on Patch the Planet, a new initiative to help Open Source projects deal with the fallout from AI coding and vulnerability research. What’s the unexpected dichotomy driving the polarized response to LLMs? And what does the future look like for Open Source in the age of AI? Watch to find out!

• https://trailofbits.com/patch-the-planet/
• https://blog.trailofbits.com/2026/07/02/field-reports-from-patch-the-planet/

Did you know you can watch the live recording of the show right on our YouTube Channel? Have someone you’d like us to interview? Let us know, or have the guest contact us! Take a look at the schedule here.

Direct Download in DRM-free MP3.

If you’d rather read along, here’s the transcript for this week’s episode.

Theme music: “Newer Wave” Kevin MacLeod (incompetech.com)

Licensed under Creative Commons: By Attribution 4.0 License

A typical response to the previous article on why PLA filament is so darn brittle. This has led some people to not use PLA filament at all, while others promote using PLA only for prototyping and throw-away parts, especially in light of PLA being compostable under the right conditions. For many mechanical parts, people turn to PETG.

Much like the PET polymer used for everything from food containers to drink bottles, PETG is durable, more resistant to degradation through mechanisms like hydrolysis and its filament form doesn’t need to be coddled like PLA does. PETG, on the other hand, tends to come from crude oil and shrugs at industrial composting conditions.

In terms of durability, degradation mechanisms and recyclability, is PETG the basic FDM filament which we should all just be using?

Polyethylene Terephthalate

PET (backbone: C₁₀H₈O₄) is a polyester, just like PLA (backbone: C₃H₄O₂). Due to how common PET is in both packaging and textile applications it’s usually just called “polyester” when used for textiles, where it is often blended with cotton and other fibers. When used in packaging PET has the sometimes rather unfortunate property of being permeable to oxygen and carbon dioxide, so that it may have to be combined with an additional oxygen-blocking layer.

This aspect of using PET for packaging is detailed for example in a 2017 review paper by Youri Michiels et al. in Applied Sciences. The main drive for using polymers like PET in packaging is due to these being more economical than traditional materials like glass and aluminium, both of which are highly impermeable to oxygen and carbon dioxide.

Consequently, a number of active and passive barriers were developed, something that is also essential in organic electronics like OLED displays when the traditional glass layers are replaced with polymers for making something like flexible displays. Active barriers can be oxygen scavengers, while passive barriers would be the application of additional materials to the basic PET film or bottle, usually in the form of a coating. This also helps to prevent the infusion of PET with colorants and aromas from food or drink, which is a common issue with recycling PET bottles.

Naturally, this can pose issues when trying to use PET materials for 3D printing, as you cannot be certain what percentage of PET waste is actually PET and what other polymers make up the remainder. This was studied by Mikołaj Garwacki et al. in a 2024 paper in Materials, with a PET-PETG blend containing PET film waste. They found it necessary to add an elastomer additive (IM) to prevent brittleness.

And this is how we get the “G” in PETG.

Triple Copolymer

The name polyethylene terephthalate (PET) already suggests that it’s more than just a polymer of purified terephthalic acid (PTA) monomers. Thus, in addition to said PTA we also see ethylene glycol (EG) monomers. This creates the basic PET copolymer as we know and love it. When we talk about PETG (polyethylene terephthalate glycol-modified), we thus do not mean the addition of glycol, but rather the replacement of said EG monomers with another monomer.

Thus PETG has a third monomer added, usually in the form of cyclohexanedimethanol (CHDM), which replaces some of the EG monomers in the resulting copolymer. In addition to PETG the ratio of CHDM monomers can create additional copolymer types:

• PET    -> PTA + EG.
• PETG -> PTA + EG + <50% CHDM.
• PCT    -> PTA + CHDM.
• PCTG -> PTA + EG + >50% CHDM.

Typically PETG is chosen for its high transparency and toughness properties, which is a property that’s rather useful in packaging like bottles. Although PETG FDM filament is basically PETG, something like a plastic ‘PET’ bottle can thus be PETG as well, and likely is due to the aforementioned properties.

Stability

One of the complaints with PLA filament is generally that it’ll become brittle no matter what, owing to the combination of increasing crystallization reducing movement within the polymer matrix, and hydrolysis shortening the polymer backbones. PETG filament has a much better reputation here, with it usually considered to be basically immune to brittleness.

The bad news here is that PETG still attracts moisture from the environment and – it being a polyester – still has a backbone that is susceptible to hydrolysis. Another common degradation mechanism is that of photo-oxidation, along with thermal degradation.

This is detailed in this 2020 review paper by Ali Chamas et al. in ACS Sustainable Chemistry & Engineering on the degradation mechanisms of various plastics within a range of environments.

As noted in the paper, hydrolytic cleavage of PET chains is very slow under neutral pH, but strongly enhanced in acidic environments. Fortunately carbonated drinks stored inside PET(G) bottles aren’t at too much of risk here, as the carbonic acid from dissolving CO₂ in water is only a mild acid and thus shouldn’t hasten degradation too much.

In order for thermal degradation to occur, fairly high temperatures are required, above that for PLA, while exposure to UV light can cause photodegradation as is typically observed with many plastics. Overall long-term stability of PET polymers is not a commonly cited concern, with the cynical take of discarded PET single-use bottles potentially outliving human society being not too far from the truth.

Barring PET polymers ending up in a particularly acidic, UV-irradiated and high-temperature environment, it’s remarkably stable, even if not as much as polypropylene or polyethylene. While there are now enzymes that can dispose of PET polymers, such as PETase and MHETase, these probably are no real risk factors to your spools of PETG filament and rather just convenient ways to dispose of misprints and waste in the future.

Sample Size Of One

In addition to the above theory and the perusal of the scientific literature on the topic, I figured that I would also try printing with a rather old spool of PETG filament. It dates back to the time when I was still printing on the Creality Ender 3 v2, with receipts showing a purchase date of March 2023. This spool has spent considerable time just lounging about on the FDM printer’s spool holder before being stuffed back into a sealed plastic bag and forgotten about until recently.

Digging this Reprapper-branded spool of clear PETG filament out of storage, I was momentarily dismayed at it having been stored by past me in just a resealable bag with no attempt at a vacuum, just with a probably expired baggy of forbidden silica candy tossed inside the bag. Let’s consider this a worst-case scenario.

Feeling particularly adventurous, I decided to not even dry this much-abused spool of PETG filament and just see what happens when printing on my Neptune 4 bed slinger. After some initial fiddling with loading issues I fixed this by snipping off of the dodgy tip of the filament, presumably due to its mangling by the Ender 3 v2’s extruder gear and hotend.

I still had my worries about the extruder teeth marks from the previous printer and the presence of a few bends in the filament that made me suffer PLA-related flashbacks, but after slicing up a cable chain model that I had printed many times in PLA before, the printing was very much uneventful.

As can be seen in the photo, I was greeted by a happy print result. While keeping an eye on it for the first layers I did notice a bit of oozing, but after a few minutes it normalized and the cable chain elements were printed cleanly, including the big overhangs. I was able to clip the elements together as well without any brittleness or other issues.

I probably should have turned on the auxiliary cooling fan on the Neptune 4 as PETG prefers things cool unlike PLA, but even with this YOLO printing attempt with a neglected spool of PETG I was left impressed. After my recent experiences with PLA I was bracing for at least a few hours of troubleshooting, but this was almost boring.

Vibe Check

With this printing experience and the scientific literature put side by side, I think that they concur. Despite me taking no precautions at all, even a more than three-year old neglected spool of PETG filament printed just fine. There were no signs of stringing or other issues that would prevent me from just queueing up another print. Although I’d still advocate at least for keeping PETG spools in at least a sealed bag or container, it’s not nearly as fragile as PLA.

Since my previous article on PLA’s brittleness, I have opened its still factory-sealed twin in the form of black PLA and found that although it’s not nearly as brittle as its white sibling, it too began to snap off if left at anything beyond a gentle curve. Clearly this puts a pretty big expiration data on PLA filament, but it’s still an open question whether it was just this particular batch of Sunlu PLA filament.

In light of all this, I think it is fair to say that PETG is by far the most ‘no fuss’ filament for general use, with PLA only having its theoretical composting advantage. Yet when taking into account that this is only guaranteed for pure PLA without additives, and PET-degrading enzymes exist, that theoretical advantage doesn’t seem so convincing anymore.

The average hot water is a relatively simple appliance to understand. It uses gas or electricity to dump energy into water in the form of heat, keeping it at a pleasant temperature for uses like bathing and cleaning. Basic mechanisms are in place to ensure the water stays at a relatively constant temperature, neither too hot where it could cause burns, nor too cold such that it wouldn’t be fit for purpose.

One of the problems, though, is that sometimes storing water at the desired temperature can create the perfect breeding ground for bacteria. However, a neat little trick developed by NIST could solve that problem rather elegantly.

You’re Hot And You’re Cold

One of the interesting problems of our modern era is that changing our water usage has changed the risk profile for pathogens growing in hot water. NIST has noted for some time that while the pipes in our walls haven’t changed size, things like our shower heads have changed their flow rate to save water. Less flow rate in the same sized pipes means that water stays in the pipes for longer, increasing the time in which harmful pathogens have to grow in that environment.

Chief amongst these pathogens? The one most commonly feared is legionella pneumophila, the bacterium responsible for causing Legionnaires’ disease. The severe form of pneumonia comes with a fatality rate of 10%, and infection typically comes from inhaling aerosolized droplets containing the bacteria.

Of course, a great way to create aerosolized droplets filled with bacteria is to spray not-quite-hot water through a shower head. This is why hot water systems, particularly in large multi-occupancy buildings, are a risk for such infections. Legionnaires’ disease is rare, but it’s always out there, with 6000 confirmed cases showing up in the US each year. It’s possible that the true number is up to 10 times higher because the disease isn’t routinely tested for. The disease’s rarity is in part because engineers and tradespeople put in plenty of work to minimize the ability for the bacterium to breed in hot water systems. As NIST’s work demonstrates, though, there is possibly even more that could be done to tackle this problem.

Ideally, your hot water pipes in your house would not host any nasty bacteria. But often, hot water systems sit around 49 °C (120 °F), a temperature that’s hot enough to be useful and pleasant without a major scalding risk. Legionella pneumophila won’t easily grow at that temperature; the bacteria thrives between 20 °C to 45 °C (68 °F – 113 °F). Unfortunately, though, it’s not hot enough to kill the bacteria completely. Furthermore, water cools as it travels through pipes to an outlet, and thus pipes can be a perfect environment to spur further growth.

The simple solution would be to simply jack up the hot water system to store water at a much higher temperature, say around 70 °C (160 °F).  This could be undesirable in many contexts, though, as water that hot can more easily cause burns. It would be ideal to store the water at a higher temperature, while making sure it was delivered at a slightly lower temperature so it didn’t hurt anybody when it left the tap or shower head.

It turns out that there is a remarkably simple way to achieve this. NIST developed a simple heat exchanger which can be mounted atop any old hot water system. It’s designed such that the hot water leaving the tank passes through a heat exchanger where it’s surrounded by cold water which is running to the water heater’s intake pipe. This has dual benefits. The hot water inside the tank can be stored in the tank at 70 °C, which kills almost all legionella peumophila almost instantly. That water, though, is then cooled to a slightly safer temperature as it passes through the heat exchanger and out to the tap or shower. The hot water remains at a safe temperature for the user, and contains far less harmful bacteria, and cooling it doesn’t introduce any pathogens from another source. In turn, the cold water coming into the tank is pre-warmed slightly by the hot water, so the energy isn’t simply wasted.

This trick isn’t just simple, it’s also cheap. NIST engineers were able to fabricate a prototype unit to fit to a residential water heater using just $100 of components. It could be a useful addition for homeowners looking to make their hot water service a little cleaner. However, the real benefits are likely to be for larger operators of multiple-occupancy facilities, like nursing homes and hotels. These facilities often have to take great care to avoid the build up of harmful bacteria in building-wide hot water systems. Having the ability to increase the tank temperature to the point that legionella pneumophila bacteria simply die off would be a huge boon to this effort.

Sometimes, it’s possible to make great gains with a simple hack. Using the cold water service to cool hotter outgoing water is a smart trick that uses only minimal additional equipment to offer a safer hot water supply. It could yet become a common install for hot water systems in order to fight the good fight against a harmful disease that likes to lurk in our pipes. If you happen to see a heat exchanger atop a hot water heater in future, you can smile that someone has done the work to try and make that hot water supply just a little safer going forward.

The big news today is, of course, the successful launch and deployment of NASA’s Nancy Grace Roman Space Telescope earlier this morning. The space agency’s latest observatory lifted off at 7:26 AM Eastern from Launch Complex 39A at Kennedy Space Center aboard a SpaceX Falcon Heavy, and by 8:00 AM it was separated from the rocket’s upper stage and flying on its own.

While the sound and fury of launch is exciting, it’s just the beginning of the journey for Roman. It will take several months for the spacecraft to complete its roughly 1.5 million-kilometer trek out to Earth’s second Lagrange point (L2), where it will set up shop near — in cosmic terms, anyway — the James Webb Space Telescope (JWST). Along the way, it will switch on and test various systems and components, with its primary 300 megapixel infrared camera scheduled to power up in three weeks or so.

There’s a lot to cover about the Roman Space Telescope. Built from spy satellite spare parts donated by the National Reconnaissance Office and featuring a field of view 100 times greater than that of Hubble, its launch is widely considered to be one of the most important scientific milestones of the decade. We’ll be bringing you more about the past, present, and future of this flagship mission as it progresses.

From real space missions to virtual ones, this week the developers of EVE Online announced that 2.4 million lines of code that keep the massively multiplayer online role-playing game running would finally be making the switch to Python 3. Given the immense complexity of the codebase, it’s been stuck at Python 2.7 since their last overhaul back in 2010, a situation which has become increasingly difficult to manage as time goes on.

The announcement goes into a surprising amount of depth about the state of Python in EVE. We imagine most players couldn’t care less, but naturally the developers have strong feelings about the situation and perhaps thought it would benefit others in a similar situation to get their thoughts out there.

While there’s certainly an argument to be made that the only justification they really need for making the migration is that 2.7 hit end-of-life back in 2020, the developers explain that the more immediate problem for them was that various tools and libraries they wanted to use were no longer compatible with the Python 2.x series. They also point out hopes that speed improvements made in the latest version of Python will eventually translate into better game performance down the road.

In more terrestrial news, this week the necessary regulatory amendments were passed to make plug-in solar systems legal in the United Kingdom. Assuming the wiring meets the necessary requirements, consumers can pick up the hardware and install it themselves without involving an electrician, although they may still need to contend with landlords and local ordinances that may limit their ability to physically mount the panels. The rules as they stand now allow each residence to have four panels with a total combined output rating of no more than 2,000 watts, although critically, the system is only allowed to generate a maximum of 800 watts at the inverter. As the government and consumers get more comfortable with plug-in solar systems, these numbers will likely increase over time.

Solar isn’t the only area where DIY approaches are moving into the mainstream. This week, Citrix pitched a “different approach to endpoint resiliency”: an isolated Linux-based operating system called UniconOS that users can boot into should the computer’s primary Windows installation become compromised or otherwise inoperable. The idea is that an independent, read-only backup OS kept on its own partition will reduce downtime, since the computer can still be used while IT figures out what the hell happened.

This solution will sound suspiciously familiar to anyone who’s booted a live Linux system from CD/DVD/USB in the last few decades. Try not to keep yourself up all night wondering why you never pitched the idea to some hungry venture capitalists in exchange for a yacht in the Bahamas.

Finally, on the theme of new technology embracing the old ways, we bring you Defrag98, a web reincarnation of Microsoft’s dial-up era Disk Defragmenter tool. While it won’t actually improve the performance of your modern solid-state drive, you may find your own mood boosted by the wave of nostalgia when you see — and hear — the classic tool go to work.

That’s right, not only do the blocks dutifully flip from red to blue just like you remember, but all the while you’ll be treated to the unmistakable whirs and clicks of a spinning hard drive circa the turn of the millennium. Never forget what they took from us.

See something interesting that you think would be a good fit for our weekly Links column? Drop us a line; we’d love to hear about it.

Whether you like it or not, the use of LLMs to write code is kind of a big deal at the moment. We’ve been asking ourselves what, if anything, this means for us here at Hackaday. Should we try to figure out what percentage of a project was done by an actual human and how much was done by a machine? Does it really matter? What is our AI policy anyway?

Clearly, Hackaday is pro-human. We’re in it for the hackers as much as for the hacks. Our community is, like Soylent Green, made of people. It’s your inspirations and innovations that keep us reading and writing every day. And we produce 100% of our content the old-fashioned way, with projects selected through the taste and judgement of our writers, and their own words telling the story.

What about the hacks? We’ve seen a lot of projects recently that were coded with the help of an LLM. Does that diminish the work? In the end, what rings truest to us is what has always been Hackaday’s editorial guiding star: Is there something special in the hack that makes it worth talking about? Then we write about it. Was it written using vim or emacs? Did the author consult friends or a chatbot while working on the project? That’s not really relevant.

But in the past few years, the BS-generation machines have found our hobby, and we’re finding a lot more projects that don’t have any spark to them. We’re seeing circuits that make no sense, and claims that defy physics. Of course, we always have. The LLM-nonsense project is today’s version of the perpetual motion machines of old. Just like we never trust a hardware project that is all renders, seeing only AI-generated images is a huge red flag. It’s our job to separate out the wheat from the chaff for you all, but it’s something that you must be doing everyday as well.

We’ve seen amazing hacks over Hackaday’s 22-year history. Hackaday is older than YouTube and older than Stack Overflow. We’ve seen technology come and go. We’ve seen C-beams glitter in the dark near the Tannhäuser gate. (OK, maybe not.) And in the end, our AI policy is our same-old policy: we write up hacks that inspire us in the hope that they inspire you.

So if you’re using Claude to help you with the UI bits, or if you’re hand-writing it all in assembly, or wiring up the logic in diodes, we just want to see your cool hacks. And we hope that our collective signal will be so loud that we drown out the noise, at least in our own little corner of the hacker universe.

What did Hackaday editors Elliot Williams and Al Williams read in Hackaday last week? Probably everything, but you can tune in and hear about their favorites on this week’s podcast. They heard from lots of listeners this week, and also saw DIY projects running from a 3D-printed Stirling engine, to clogs, to LEDs.

There are some over-the-top hacks like a refit for a decades-old watch to do tap-to-pay and a — for lack of a better word — a record player that optically reads MOD files. Want to emulate an iPod? Talk to Eliza? Print a hand-operated rail car? Hackaday is the place to read about it all.

The can’t miss articles included a talk from Hackaday Europe about making magical PCBs and a not-so-brief history of space stations starting in the 1800s.

Check out the links if you want to follow along, and as always, tell us what you think about this episode in the comments!

Direct download in MP3 suitable for hand-decoding.

Episode 384 Show Notes:

Mailbag:

• [Joshua Wiebe] had questions about using MOSFETs to drive motors. The guys had their thoughts, but feel free to send in yours.
• [Jake Wachlin] wanted to talk about using AI in projects.
• [Caleb Butler] spammed us, but all in fun.
• [Alexander] wrote in to response to last week’s podcast talking about his experiece with an ultrasonic knife.

Got something to say? Send an e-mail or an audio clip to mailbag@hackaday.com.

News:

• Announcing The 2026 Hackaday Retrocomputing Challenge
  • Linux Fu: The Old School Terminal
• Supercon 2026!

Interesting Hacks of the Week:

• Thermoacoustic Stirling Engine Is Now Fully 3D Printable
  • Thermoacoustic engines paper (pdf)
  • Thermoacoustic Organ
  • A DIY Pulse Tube Cryocooler In The Quest For Home-Made Liquid Nitrogen
• Straight Talk On 3D Printing Footwear At Home
• The Shutter Makes This 3D Printed Camera Special
• Making LEDs In The Home Fab
• Encoding MOD Files Optically On Paper, Because Amiga’s Legacy Will Outlast M-Disks
• The Casio F-91W As A Contactless Payment Device.

Quick Hacks:

• Elliot’s Picks:
  • Making An LCD UI Look More Like Classic Indicator Lamps
  • Emulating The iPod
  • Quest VR Headset Becomes Unlocked Hardware
• Al’s Picks:
  • Artificial Intelligence As It Once Was
  • Neo-Cyclostyle: Automatic Document Copying Devices In 1890
  • 3D Printing A Railway Pump Car

Can’t-Miss Articles:

• Hackaday Europe 2026: PCBs With A Plot
• An Early History Of Space Stations: The Brick Moon Made Real
• An Early History Of Space Stations: Where’s My Wheel?

On GitHub, [AyaanB] details buying a cheap Android TV streaming device, looking for, and finding, baked-in malware.

Multiple warnings have been issued by the FBI and CISA regarding malware on media box Android devices. Many devices have been caught participating in botnets providing residential proxies, ad-click fraud, and DDOS services. [AyaanB] sets out to discover if a $30 set-top streaming box is pre-infected with malware, and extracting it – without ever letting the device talk to the Internet or access other devices on the local network.

Picking a device named in the advisories, [AyaanB] discovered that it was, indeed, preloaded with multiple app stores and applications that wouldn’t typically make sense on a set-top TV box. After identifying the serial port test pads and obtaining a low-voltage serial adapter, they were able to gain access to the bootloader and from there dump the contents of the MMC over TFTP.

With the entire filesystem accessible out-of-body, proving it was infected with malware at the factory becomes simple: the malware is signed as a system application, baked onto the system partition of the MMC, granted SELinux exceptions to mark it as a system binary with shell privileges, and has multiple launch scripts to make sure it is executed even if partially removed. With the malware identified, [AyaanB] continues to dig through to uncover the capabilities.

By installing hooks into the low-level Android process spawning system, the malware installs hooks into every application as it is launched: even if an application isn’t trojaned already, by the time it finishes executing, it’s definitely been subverted. The functions patched and the methods used match the Vo1d botnet, which is used for account takeovers, residential proxies, free “VPN” services, and other unfriendly behavior.

Further digging into the system showed hooks for ad-click fraud, where hidden browser windows are allowed to run unthrottled and display overlays are configured to obscure ads below where the user may click. Other included tools bid in real-time ad auctions, claiming to directly publish ads to the user which may or may not be visible. To cap it all off, a root level backdoor allows botnet operators to access the systems directly and install additional tools.

Be sure to check out [AyaanB]’s writeup for more details on exfiltration methods and other malware found on the devices.

Hijacking Calls to Military Bases with DNS

In the early 2000s, a domain name scheme was developed to directly map telephone numbers to DNS records for SIP and VOIP calling. (Who knew? I didn’t!) But [Lina] did, with an excellent writeup on accidentally positioning themselves to intercept phone calls by registering an expired domain.

The e164-arpa number to name scheme was never widely adopted, and quickly forgotten about. As is the way with all forgotten standards, the infrastructure slowly fell apart. [Lina] noticed that several country records were delegated to name servers hosted in expired domains, and by simply registering them, they were able to begin resolving queries. For a five Euro registration fee, [Lina] gained control over an abandoned DNS resolution protocol for Saint Helena, Diego Garcia, and Ascension Island. After watching the logs for some time and not getting any traffic, and running into the bureaucratic tangle of standards committees and the actual United Nations, the project was shelved.

Six months later, [Lina] examined the logs of the other domains, and found hundreds of thousands of records of attempted calls, and since you read the section header, you already know where the calls were headed. Clearly some phone systems still attempt to use the ill-fated e164-arpa calling scheme even in 2026, and because the DNS records control the destination of the call, it would have been possible to hijack all the calls transparently and mine them for information, and all for five Euros. With military bases involved, and with one of the bases targeted by missiles during recent conflicts, suddenly agencies cared significantly more, and the story has the happy ending of the domains being transferred to the National Cyber Security Center in the UK.

AliExpress Fingerprinting Browsers

AliExpress has been caught using a hidden fingerprinting technique to try to identify users.

The fingerprinting plays a waveform in the background of the page with the volume set to zero, and measures variances in the computed values. Variances in the computed waveform are introduced by the browser type, CPU, audio hardware, and even the driver versions. While most of the headlines have focused on the audio fingerprinting, AliExpress also used other fingerprinting techniques to build profiles of each browser, including WebGL, WebRTC, screen resolution, and other web integrations.

The purpose of the advanced device fingerprinting is unknown: AliExpress could use it for fraud prevention, but could also be using it to identify and track customers when they have disabled traditional tracking cookies. The audio fingerprinting was discovered when a user experienced trouble with Bluetooth headphones being attached to the silent audio stream.

Unfortunately with fingerprinting techniques which leverage standard features in the browser it can be difficult to block them. Sometimes, ad blockers may be able to identify and block some of the fingerprinting resources, as can disabling some features in the browser, but many features like audio and WebGL can’t usually be turned off.

[Tom Ritter], who works for Firefox, mentions that they head this fingerprinting method off at the pass three years ago as part of their anti-fingerprinting campaign. This is clearly not the case for all browsers.

Attacking Signal’s Contact Discovery

Most chat apps allow you to discover users from your contacts list who also use that app – but then you’ve given your contact list to the app, helping them build their marketing and social graphs. Signal of course handles it differently, allowing you to discover users from your contacts list while preventing the Signal corporation from being able to access your list of contacts. Well, mostly.

Signal runs the contact discovery process inside an Intel SGX Enclave. A SGX Enclave is an Intel extension similar to a Trusted Execution Environment (TEE) on Arm, where memory and execution can be partitioned for a restricted process. In theory, code and memory inside an enclave can not be read by other processes, root processes, or even a hypervisor or virtualization system. Signal uses enclaves so that the users encrypted contacts list and the encryption key itself are fully insulated. The Signal client is then able to validate the integrity of the enclave using known measurement values baked into the client releases.

Researchers using the V12 AI agent discovered this wasn’t always the case. Because a SGX Enclave shares resources with the rest of the system, a malicious host could create exploitable race conditions in the algorithm by generating page faults and pausing execution of the enclave. The malicious server running the enclave is still unable to directly read the contents, but it could extract the secret values needed to then create false servers which could fully expose the user contact list.

A second attack would allow a malicious host to manipulate the list of clients connected to the enclave, gaining full code execution inside the enclave with the predictable result of exporting contact data.

Both of the issues were reported to Signal and fixed before the public writeup, and there is no evidence they were ever abused: to attack either flaw, a compromised host would have to be running the Signal enclave code and be part of the Signal infrastructure that clients would connect to.

Boston Scientific Hit by Cyberattack

Boston Scientific reported in a SEC filing that it has been hit with an unspecified cyber attack impacting operations, causing the stock to drop by almost 5% in a day.

The company has been unwilling to release any details of the attack, but expects to be able to resume shipping of medical products in “less than three weeks,” which sounds like a pretty major disruption. Boston Scientific manufactures defibrillators, pacemakers, and surgical equipment. It’s unclear if any patient data has been compromised, though presumably regulations will require disclosure if that’s determined to be the case.

With no additional information about the attack, it’s also unclear if any source code or other data which could aid attacking medical devices was impacted, either.

Carhartt Hit by Ransomware

The Carhartt clothing company has also been hit by ransomware, with 13 million accounts leaked.

The ShinyHunters group claims responsibility; previous victims of the group include casinos, car manufacturers, medical companies, and government agencies. The leak claims to include over 50 gigabytes of customer and employee data, with customer data including email, phone numbers, and physical shipping addresses. The group demanded $3.3 million in ransom for the data, and published it when Carhartt didn’t pay.

Have I Been Pwned linked the data to a compromise of the Databricks instance used by Carhartt, which is a platform for linking business data and AI.

AI Agents Installing Unknown Code

Multiple AI agents (Codex, Hermes, and Claude) have been observed executing arbitrary instructions and code contained in the llms.txt files on websites.

Normally, llms.txt and llms-full.txt are used to instruct AI agents on how to summarize and index the sites content, but researchers in Israel indexed the files of Fortune 500 companies, defense contractors, and tech companies and found that over a hundred of them included directions to install packages which didn’t exist or referenced domain names that were not registered. The researchers were able to create packages with matching names and record agents inside multiple high-profile companies installing and executing them.

While documenting the reach of the exposed packages, researchers found at least one had already been replaced by attackers with live malware which would execute inside whatever context the agent was executing in, potentially exposing authentication tokens or company data. The attacks which have been rampant in the NPM and PyPI package repositories can make even legitimate packages dangerous to install, but agents blindly following instructions from arbitrary websites inflates the danger even higher.

Alleged Members of TeamPCP Arrested

Finally, security reporter extraordinaire Brain Krebs brings news that suspected key operators of the TeamPCP group have been arrested in Australia.

TeamPCP has been behind some of the worst of the supply chain attacks plaguing PyPI, NPM, and VSCode plugin repositories, and have released the source code to some of the worms used in the supply chain attacks to muddy the waters and recruit new members. TeamPCP has also been involved in compromising thousands of GitHub repositories, and is affiliated with multiple other crime and malware groups.

While the identities of the arrested individuals have not been officially released, in typical Brian Krebs fashion, dozens of connections are correlated showing their likely identities and links to TeamPCP and other groups. If nothing else, this should serve as a reminder that the best time to pay attention to operational security was ten years ago.

As TeamPCP doesn’t appear to be a state-sponsored group, or even strongly organized, the arrests of a few members are unlikely to drastically slow down the compromises. Krebs details conversations held with one of the arrested men, in which they discuss struggles with sobriety and plans to leave the malware scene, stating that others have already taken over leadership roles in the group.

This week Jonathan chats with Nathan Freitas of the Guardian Project! What is going on at the forefront of Open Source and privacy advocacy? Where are we on a true Tor browser on iOS? And what’s the ideal solution to the Android Lockdown issue? Watch to find out!

• https://cyber.harvard.edu/people/nfreitas
• https://guardianproject.info
• https://proofmode.org

Did you know you can watch the live recording of the show right on our YouTube Channel? Have someone you’d like us to interview? Let us know, or have the guest contact us! Take a look at the schedule here.

Direct Download in DRM-free MP3.

If you’d rather read along, here’s the transcript for this week’s episode.

Theme music: “Newer Wave” Kevin MacLeod (incompetech.com)

Licensed under Creative Commons: By Attribution 4.0 License

One of the stories of the last few weeks has been that AI companies have been scanning books in very large numbers in order to train their models with content guaranteed to have been written before 2002, and thus AI free. It’s caused some outrage, because of the size of the operation, and because the scanning process is destructive. In particular the phrase being bandied around is that these are rare books, and it’s this phraseology I find problematic. I think it’s time to unpack why that is the case.

It’s Not Book Burning, Folks

Before I worked for Hackaday I had a long career in and around the publishing industry, mostly on the electronic side, but from time to time crossing paths with my colleagues in the world of paper-based publishing. I understand the appeal of a good book, I’ve spend a lot of my life among bibliophiles, and let’s just say I own a few books myself. In particular I understand the symbolism of destroying books, bringing to mind as it does the actions of repressive regimes. I have stood in Bebelplatz in Berlin where the photo of Nazi student organisation members burning the library of Magnus Hirschfeld’s institute was taken in 1933, and if you know me, you’ll have an idea why that’s close to home. But for all that, what the AI companies are doing is not the same thing.

In this case they’re destroying the books for two reasons. Firstly, as I remember from a previous employer in the publishing world, it’s much easier to digitise a stack of papers than it is a bound book. Thus I’m pretty sure that’s one reason they remove the binding before digitising the pages. Then secondly, as I understand it it’s a copyright issue. If they buy a book, digitise it, and destroy the physical copy, they can legitimately claim that only one copy of it exists, and they hope, sidestep copyright claims from publishers.

When Rare Maybe Isn’t Really Rare At All

Perhaps the most pertinent question then is just what are the books being scanned and destroyed? They’re almost universally described as “rare”, but is that accurate or sensationalist? It brings to mind a dusty library filled with priceless tomes hand-transcribed by monks which it would be a crime to destroy, but there’s something that explodes that vision in an instant.

If you read the reports of what’s happening, they are ordering books by ISBN number. That’s an international system for identifying books, which was only introduced in 1970. If they’re ordering a book by its ISBN, it’s no medieval illuminated manuscript.

So the books being scanned and destroyed are relatively new, but can they still be described as rare? In that case just like anything else mass-produced since 1970, how many survive depends on the size of the original print run and how valued they have been since. So a few of these books can be physically rare in the sense of being uncommon, but if they are next-to-valueless, it’s fairly obvious nobody has particularly cared about their survival up to now. It’s likely that any books printed since 1970 which are both rare and of value will have their future assured, so the AI industry is not committing the wanton destruction of culture the reports would like to suggest.

You Need To Know Just How Many Books Get Pulped Every Year

I’m left feeling that a combination of the symbolism of destroying books along with a distaste for AI companies has inflated the status of these books well beyond their worth. If people truly had a care for old books they would be shocked to know how many are pulped each year by the paper recycling industry.

The publishing industry has been churning out mass-produced books for centuries now, so the world is awash with old books. Where do these newly-minted bibliophiles imagine they all go, to the Great Library In The Sky? I haven’t even touched yet upon the publishing industry, which pulps vast quantities of brand new unsold books every year. Where is the outrage, I ask?

We all love to dunk on AI companies, and Heaven knows, there are plenty of reasons to do so. Among all those reasons, sadly destructively digitising books is pretty low on the list. Please, ask the other questions, the ones they really don’t want to answer!

Header image: Yair Haklai, CC BY-SA 4.0.

If you’re blessed enough that you haven’t had blood drawn in a while, you might not have thought much about the process. You might imagine that a needle goes in, a syringe is drawn back, and the venous blood is thusly collected. Indeed, it can be done that way.

However, there is an altogether niftier and more efficient method of fast blood collection for pathology testing. It’s all about using vacuum and smart design to ease the work of phlebotomists, while maintaining a sterile and safe environment.

Vacuum, Contained

These days, if you get blood collected for testing, there’s a plenty good chance you’ll have it drawn into a vacutainer. It’s named as a portmanteau of “vacuum” and “container” because that’s fundamentally what the system relies upon. A vacutainer is a glass or plastic tube which holds a vacuum inside, sealed with a stopper. That vacuum can be used to help extract fluids to be stored inside the container—namely, blood, in most cases.

The method of use is relatively straightforward. A vacutainer needle is inserted into a patient’s vein to access the blood. The vacutainer needle does not have a typical syringe draw. Instead, the back end of the needle sits inside a plastic housing which accepts vacutainer tubes. There is a flexible rubber seal on the back end of the needle so blood doesn’t leak out when no tube is connected.

When a vacutainer tube is inserted into the housing, the vacutainer needle pierces the stopper of the tube. The vacuum inside then draws blood from the vein into the tube for collection. When full, the tube can be removed and it self-seals as the needle comes out of the stopper. Another tube can be quickly clipped into the vacutainer needle housing to draw further blood if more is needed, without leaks or mess causing contamination issues.

Vacutainer tubes are, by design, single use. They’re manufactured to capture a set quantity of blood for testing, based on the level of vacuum in the tube at the time it is sealed, and are disposed of after use. Labels are often included on the tubes allowing patient information to stay with the blood itself. Tubes have a shelf life, as with most medical paraphernalia, in particular since they may not maintain vacuum indefinitely.

The tubes are also typically filled with various additives in order to best preserve and prepare the blood while it awaits testing, and stoppers are color-coded to indicate this. The precise additives used are highly dependent on the testing required. A tube for a standard blood culture draw will typically be filled with sodium polyanethol sulfonate, which acts as an anti-coagulant, with growth media also present for microorganisms.

Coagulation tests will use tubes with sodium citrate inside, while a test for lead will often use a tube with sodium EDTA chelator inside. Some basic blood component tests will use a plain tube with no additives, while others are highly specific—tuberculosis testing often uses purpose-made tubes with antigen additives ready to go. Some tubes include special serum-separating agents which help with splitting blood into its component parts when shaken or centrifuged, useful for certain tests that look at different blood cell types individually.

If you’ve ever dared to watch while having your blood drawn in this manner, the technology can look quite swish. The tubes are easy to hotswap without leaking any blood and several tubes can be filled in under a minute once the phlebotomist has found an appropriate vein.

However, the technology is not particularly new. It was developed all the way back in 1947 by Joseph Kleiner, though other vacuum-based blood draw techniques existed previously. His goal in developing the technology was to ease patient discomfort and reduce the spillage of blood. This stemmed from his experience seeing his terminally-ill wife suffer multiple needle punctures whenever multiple blood tests were required, and seeing the mess caused when syringes were emptied into test tubes for processing and testing. His inspiration was seeing vacuum-sealed tubes used by the military to transport blood during World War II; the product he developed would later reach the market in 1949. They had the benefit of keeping the blood from exposure to air, reduced the number of punctures required along with the chance of needle stick injuries and infection, and ensured blood was collected in standard volumes and conditions, which aided clinical accuracy. Plastic versions were developed by medical supplier Becton Dickinson in the 1960s, and have become widely popular in the phlebotomy field since.

If you’re not in the medical field, and you’ve managed to avoid regular blood tests, you probably haven’t even noticed vacutainers. Alternatively, you might simply live in an area where their use is uncommon, or you’ve just been intently looking away while your blood has been drawn. In any case, they remain a neat little bit of technology that makes a messy, hazardous, medical process as clean and tidy as possible.

Featured image: “Drawing Test tubes different colors” by [Goldmund100].

We’ll start this week off with some disappointing, though not entirely unexpected, news — the ambitious commercial mission to save NASA’s Neil Gehrels Swift Observatory is officially a bust. The space agency provided an update earlier this week explaining that the attitude control issues with the LINK spacecraft that started a few weeks after it launched will prevent it from being able to safely dock with the Swift Observatory and boost its altitude. As such, the space telescope is now expected to reenter the Earth’s atmosphere and burn up before the end of the year.

Although LINK won’t be able to live up to its name, NASA did say operator Katalyst Space has been given permission to continue with the rendezvous attempt. The two craft won’t actually make contact with each other, but teams on both sides feel there’s lessons to be learned and data to be collected by seeing the orbital dance of these two vehicles play out for as long as possible.

Speaking of hardware that couldn’t quite hit its design goals, TechCrunch is reporting that a class action lawsuit has been filed against Oura by customers that say the company made misleading claims about the sleep-tracking accuracy of their smart rings. Namely, that the rings could somehow detect which stage of sleep the wearer was in with only the pulse and temperature sensors it has onboard.

The complaint argues that sleep stages can only be accurately determined with an electroencephalogram (EEG), and that there’s no way for the ring hardware to actually know what’s happening in the wearer’s brain. For their part Oura has released a statement defending their methodology, and say that the ability of their rings to estimate sleep cycles compares favorably with data collected from clinical sleep studies. It should be interesting to see how this one plays out.

On the subject of products not quite doing what you expected, there’s been a story buzzing around online about a number of computer games failing to work properly on Windows machines that have installed the August system updates. Microsoft has investigated the issue and is currently pointing the finger towards RGB lights as the potential culprit.

On the surface it might sound like some kind of exotic hardware clash or interference, but the actual issue is disappointingly mundane. According to Microsoft, the August update fiddles with a system component that the software which drives some of these lights ties into, namely inpoutx64. As a quick fix they’ve provided some instructions on keys that can be modified in the Windows Registry to prevent the conflict, but it sounds like such gefingerpoken und mittengrabben may prevent the blinkenlights from performing their critical function.

Finally, we’ll end this week with an update on the ASCII CITY project that’s been making the rounds online. For those who haven’t seen it yet, this is 3D engine implemented in a single HTML file that renders a cyberpunk 3D city for players to wander around in. The latest version brings many new features to the non-game, notably the ability to enter the various buildings scattered throughout the world.

Previously we could only admire this virtual world from afar. But now that developer Grow Now! Games has released a playable prototype, you can transport yourself into this new digital frontier like in Tron.

See something interesting that you think would be a good fit for our weekly Links column? Drop us a line; we’d love to hear about it.

On Hackaday last week, and on the podcast, we were talking about one of the educational toys of yesteryear that launched a thousand careers, at least if the comment section is to be believed: the Radio Shack 200-in-1 electronics kit. The “toy” itself was basically a bunch of components with spring terminals, but the secret sauce was in in the instruction book, and maybe the marketing.

Tom had one of these when he was a kid, and told a great story about wanting it desperately based on the ads he had seen with kids Morse coding to each other. When he got the kit, and found out that “it was just a bunch of wires” he was fully pissed off. But he worked through the examples, learned some basic electronics, and the rest is history.

What I really love about this story is the siren’s call of a good project. Tom was pulled in, and maybe even fooled, by the advertising, but it probably changed his life. It’s funny how many of our folks can remember the first project that got them hooked as well. With me it was some simple audio effects pedals and then maybe later some simple BEAM robots, and for younger hackers maybe it was a 3D printer or Arduino project.

Digital or analog, the common ground here is that we all thought that some project was cool enough to warrant the sweat of learning enough to do it. Good instructions are helpful of course, and having the parts on hand never hurts. But it’s the promise of making something that you really want that I think underlies all good first projects. (And heck, every subsequent project as well.)

So while Tom, and a bunch of our readers, were looking back with nostalgia at the 200-in-1, I’m thinking about how many more than 200 projects I’ve seen made by our community, and even featured here on Hackaday, that are out there to provide the motivation to get someone started. Keep on hacking!

In this week’s episode, Hackaday Editors Elliot Williams and Tom Nardi start things off by getting excited about the recently announced 2026 Retrocomputing Challenge. From there the conversation will cover efforts to improve desktop 3D printing with lasers, an expensive grill with an ESP32 controller and an open source firmware, open source tools underground, and some impressive techniques to squeeze a bit more utility out of the common QR code.

You’ll also hear about turning PVC pipes into flat stock, old school Radio Shack electronic kits, and VR soldering demos. Stick around to the end of the episode learn about the latest developments in over-the-counter hearing aids and the 1-bit CPU that’s enjoying an unexpected fandom nearly 50 years after its release.

Check out the links if you want to follow along, and as always, tell us what you think about this episode in the comments!

Direct download in DRM-free MP3.

Episode 383 Show Notes:

Mailbag:

• Alexander wrote in praise of buying ultrasonic knife guts. Donald Papp wrote up his experience with a hacked dental tool a few years back. Now you can get it over the counter.
• Joey wrote in asking if we can add video/visuals to the Podcast. We complain about how difficult that would be.  :)
• Mailbag still needs intro/outro music. Anyone want to whip something up? Send it to mailbag@hackaday.com.

News:

• Announcing The 2026 Hackaday Retrocomputing Challenge
• Using The Famicom Network System In 2026

Interesting Hacks of the Week:

• Laser Layers For (Almost) Isotropicly Strong Prints
  • 3D Print Smoothing, With Lasers
  • More On Wave Overhangs For 3D Printing
• Reverse Engineered Grill Controller Gets Open Firmware
• Hackaday Europe 2026: Open Source Hardware Goes Underground, Literally
  • GitHub – furbrain/STIC · GitHub
• Building Custom Backyard Solar Lights
  • PVC Pipe Transformed Into Handy Tool Box
• Compress Links For Optimal QR Codes
  • http://ha.mr#2)22
  • Store Tunes On Paper And Stream Them Over LoRA
• Radio Shack Toy Returns To Life

Quick Hacks:

• Elliot’s Picks:
  • Joy-Cons Plus WiiMotes Make For Switch 2 Wii-Cons
  • So, You Want To Fix An Old Camera
  • Watch Soldering Up Close And From Any Angle, In VR
  • May This Balloon Banjo Resonate With You
• Tom’s Picks:
  • Snooping Flume Water Monitor Data On The Wire
  • Smarting Up A Doorbell With Zigbee
  • Scanning For Lifesigns With ESP32 And Raspberry Pi

Can’t-Miss Articles:

• Smartphones And The Next Generation Of Hearing Aids
• Hackaday Europe 2026: The 1-Bit CPU That Ran Factories
  • Building An Industrial Control Unit With An Industrial Control Unit
  • A one-bit processor explained: reverse-engineering the vintage MC14500B
  • WDR-1-Bit-Computer
  • Too Cool For 8-bit Retro? Try 1-bit Gaming