Tracked as CVE-2026-0768, the security defect allows unauthenticated attackers to execute arbitrary Python code remotely.
The post Hackers Start Exploiting Critical Langflow Vulnerability appeared first on SecurityWeek.
While DOOM remains the undisputed champion of ‘game you play on every piece of hardware’ it seems that the role of ‘game you play on everything just because you can’ is slowly being shifted to Minecraft, as we have yet another Minecraft server somewhere Minecraft has no business being served– in this case, a Samsung Printer.
The hack actually requires opening up the printer to get at the debug ports to bang your way in via serial, but as any security expert will tell you, once the black hats have physical access to a machine, they own it. That isn’t to say it’s easy– [vimpo] had to dump the firmware and find an exploit. Since it’s 2026 [vimpo] tried to get an LLM to do all that hard work for him, and while it helped with identifying functions in the dump, ultimately the hacking still fell upon [vimpo]’s human intelligence, though not before burning through millions of tokens. Having found a good old fashioned UDP overflow exploit, he’s gets control of the printer and puts an improved version of his lightweight Minecraft server, UCraft, on it. Like the server, the exploit is also on GitHub but you’ll very likely need the exact same printer to get it to work: a Samsung C410W with firmware V3.00.02.20, DEC-15-2015. One important caveat is that while you can still use the printer as intended after this hack, you cannot do so while playing Minecraft: it crashes the server if you try. Good to know.
In case you’re wondering, yes, this is the same guy who got a Minecraft server running on a light-bulb, which arguably more impressive. Where he might mine and/or craft next is anybody’s guess. Somebody else already did the ESP32-C3, and while we suspect nothing will ever beat the 1960s Univac implementation for sheer impracticality, we’re willing to be surprised.
The critical-severity flaw allows attackers to send HTTP requests to internal endpoints and extract sensitive information.
The post MLflow Vulnerability Exploited for Cloud Credential Theft appeared first on SecurityWeek.
When it comes to 3D printing in the FDM world, you can go a long way just relying on standard settings that ship with your 3D printer and/or slicer. If you want to push the limits, though, it pays to better understand the hardware and materials you’re working with to know what you can get away with. To that end, [Robert Samples] put together the MeltCalc database to help.
The purpose of MeltCalc is simple—it collates data on hot ends and materials regarding factors like maximum flow rate, print speeds, and heater requirements. If you’re wondering whether a given hot end can flow a given filament at a given rate, for example, this tool is a great place to start. It features 64 different hot ends and 36 polymers typically used in the 3D printing world, and can spit out maximum flow rates and print speed estimations even accounting for fancy tech like Core Heating Technology (CHT) nozzles. It’s all based on thermodynamic modelling which [Robert] put together based on his experience as a chemist who works with polymers. His aim was to provide a tool with realistic flow rates for hot ends, so that end users don’t have to just rely on often-optimistic marketing numbers.
For those eager to dive deeper into the code and modelling, the project source is available on Github. We’ve featured all kinds of other useful hacks in this space lately, too, like our recent look at how to achieve wave overhangs. If you’ve got your own nifty 3D printing tools in the works, don’t hesitate to notify the tipsline.
Amazon Web Services revenue grew 37% last quarter, its fastest pace since the end of 2021, but the company is spending so much on data centers and infrastructure to fuel that growth that its free cash flow for the past 12 months turned negative for the first time since 2023.
Overall, the tech giant reported $200.6 billion in revenue for the second quarter, up 20%, with operating income of $27.5 billion, up 43%. That beat Wall Street’s expectations of about $196.4 billion in revenue, and topped the high end of Amazon’s own guidance.
Profits were $62.6 billion, or $5.75 per share. However, that included $53.4 billion in pre-tax gains, primarily on Amazon’s investment in Anthropic, which inflated the bottom line. Excluding those gains, EPS would have been about $1.95, above analyst expectations of $1.82.
Amazon shares rose more than 8% in after-hours trading following the report.
AWS revenue reached $42.2 billion in the quarter, a $169 billion annualized run rate. Operating income in the cloud division rose 64% to $16.6 billion, lifting AWS operating margin to 39.4% from 32.9% a year ago — evidence that the AI buildout is starting to convert into profit, not just revenue.
“AWS is booming,” CEO Andy Jassy said in the release, adding that the company’s AI and chips businesses “each eclipsed run rates of more than $25 billion.” The chips business, which Jeff Bezos called the next pillar of the company this week, was at a $20 billion run rate three months ago.
Amazon’s operations generated $161.4 billion over the past 12 months, but the company spent a net $169 billion on property and equipment — up $66.1 billion from a year earlier, an increase Amazon attributed primarily to AI investments — leaving a shortfall of $7.6 billion in free cash flow.
A year earlier, it had $18.2 billion left over for the prior 12 months, by comparison.
Free cash flow is what’s left after a company covers its operating costs and pays for things like data centers and warehouses. It’s an important measure of financial health, which investors watch closely because it shows how much cash a business actually creates after paying for its own growth.
Update: Amazon raised its capital spending forecast on its earnings call. Jassy said the company now expects to spend about $220 billion in cash capex this year, up from the roughly $200 billion it projected earlier, attributing the increase to the higher cost of memory chips.
He addressed the cash flow squeeze directly, framing it as a matter of timing. Data centers require capital about two years before servers can be installed and start generating revenue, he said, but once open, they can be monetized for more than 30 years without repeating that upfront cost.
Servers and networking equipment run on a shorter cycle, purchased a few months before going into service. Those take a little under three years to break even, Jassy said, against a useful life of at least five to six years.
He said most of Amazon’s AI capacity is now contracted for terms of five years or longer.
“We’ll spend a lot of capex and encounter free cash flow headwinds until these data centers come online, can be monetized, and we get a few years into these servers being utilized,” Jassy said.
Other notes from Amazon’s earnings release:
Online store sales rose 15% to $70.4 billion, up from 10% growth in the same quarter a year ago. It remains Amazon’s largest single revenue line at about 35% of total revenue, and it is the line most directly affected by the decision to move Prime Day into June, into the second quarter. Last year, the annual online sales event took place in the third quarter.
Advertising revenue rose 26% to $19.8 billion, up from 22% growth in the same quarter a year ago. It has generated about $76 billion over the past 12 months, making it one of Amazon’s fastest-growing businesses. Prime Day lifted this line as well, because the event drives a surge in spending by sellers and brands competing for placement.
Third-party seller services revenue, which includes commissions and fulfillment and shipping fees Amazon charges independent merchants, rose 16% to $46.8 billion, up from 10% growth in the same quarter a year ago. Independent sellers accounted for 61% of units sold in Amazon’s stores, roughly flat with recent quarters. Prime Day boosted this line as well.
Subscription services, which includes Prime memberships, grew 12% to $13.7 billion. The line has grown between 10% and 12% every quarter for the past year and a half. Analysts have been expecting a Prime price increase, which has not yet materialized.
An AI-driven threat actor called JADEPUFFER built ransomware that hunts AI model files specifically, entering through a known Langflow RCE and pivoting via an exposed Docker socket.
ENCFORGE Ransomware Targets AI Models After Langflow RCE Exploit on Latest Hacking News | Cyber Security News, Hacking Tools and Penetration Testing Courses.
TxFlow’s Probly Channel Puts Prediction Markets Back In The L1 Experiment Zone is a useful reminder that crypto coverage is not only about token prices. Sometimes the more important story is the infrastructure, regulation, security, or product layer sitting underneath the market noise.
The immediate point is straightforward: txFlow introduced Probly as a second channel for prediction markets. That gives readers something concrete to work with, rather than another vague sentiment update.
The timing matters because TxFlow is already part of a wider conversation across the market. Traders want to know whether the development changes liquidity or risk. Builders want to know whether it changes what can be deployed. Compliance teams want to know whether it changes how platforms operate.
In that sense, the story is bigger than one headline. It sits inside the ongoing shift from speculative crypto cycles toward more practical questions: who can use these systems, how safe are they, and whether the underlying incentives actually work.
The best way to read it is with discipline. It is not a guarantee of immediate upside, and it should not be treated as one. But it does add a fresh data point to the way the market is thinking about TxFlow.
For TxFlow, the important part is the specific mechanism. If this is a security issue, the risk sits in dependencies and user protection. If it is a listing or product launch, the question is access and liquidity. If it is a governance or research proposal, the question is whether the idea can survive implementation.
That is where this update becomes useful. It is not just a label attached to a trend. It gives readers a way to understand what might actually change if the development gains traction.
Crypto has a habit of turning every announcement into a broad market claim. This one deserves a narrower read. The value is in seeing how it affects the users, developers, institutions, or traders closest to the issue.
There is also a caution attached. Source material can confirm that a development exists, but it cannot prove that adoption will follow. A proposal still needs support. A product still needs users. A chart still needs confirmation. A compliance tool still needs integration.
That is why the responsible reading is not to oversell the story. The stronger takeaway is that this adds to a pattern. The crypto market is steadily becoming more professional, more technical, and more sensitive to real operational details.
Readers should also watch for follow-up signals. That could mean developer feedback, exchange support, regulatory response, wallet adoption, liquidity data, or simply whether market participants continue reacting after the first headline fades.
The next stage will decide whether this remains a narrow update or becomes part of a larger market theme. In crypto, that difference matters. Plenty of stories look important for a few hours and then disappear. The ones that last usually show up again through usage, liquidity, enforcement, governance, or developer adoption.
For now, this gives the market another piece of information to weigh. It is specific enough to be useful, but still early enough that readers should keep the caveats in view.
That makes it worth covering without pretending it settles anything. The story is a signal, not a final verdict.
The key is not to confuse coverage with certainty. TxFlow stories can move quickly, especially when they touch security, regulation, listings, infrastructure, or price levels. The useful approach is to track the next confirming detail rather than assume the first update carries the whole market story. That is how traders avoid chasing noise and how readers separate a genuine development from another passing headline.
This report is based on information from beincrypto.com.
This article was written by the News Desk and edited by Samuel Rae.
The critical libssh2 CVE-2026-55200 flaw inverts SSH security: the remote server attacks the connecting client, no credentials needed. A public PoC is out and the official patched release has not shipped.
libssh2 CVE-2026-55200 Shows Why Outbound SSH Is an Attack Surface on Latest Hacking News | Cyber Security News, Hacking Tools and Penetration Testing Courses.
Login