Cisco ha reso note due vulnerabilità critiche che interessano i propri firewall Secure Firewall Adaptive Security Appliance (ASA) e Secure Firewall Threat Defense (FTD), oltre ad altri prodotti di rete. Entrambe le falle consentono l’esecuzione di codice arbitrario e potrebbero portare al completo compromesso dei dispositivi coinvolti.

CVE-2025-20363 (Score 9,0)

La prima vulnerabilità, identificata come CVE-2025-20363 e con punteggio CVSS 9.0 (critico), riguarda i servizi web di:

• Cisco Secure Firewall ASA Software
• Cisco Secure Firewall FTD Software
• Cisco IOS Software
• Cisco IOS XE Software
• Cisco IOS XR Software

Nel caso dei firewall ASA e FTD, la falla può essere sfruttata da un attaccante remoto non autenticato. Per le piattaforme IOS, IOS XE e IOS XR è invece necessario disporre di credenziali a basso livello di privilegio.

L’origine del problema risiede nella gestione non corretta degli input nelle richieste HTTP. Un aggressore può inviare pacchetti manipolati verso i servizi web esposti da un dispositivo vulnerabile, ottenendo la possibilità di eseguire codice arbitrario con privilegi root. Una compromissione di questo tipo può determinare il controllo totale del sistema.

CVE-2025-20333 (Score 9,9)

La seconda falla, già entrata all’interno del catalogo del CISA KEV, catalogata come CVE-2025-20333, ha un punteggio ancora più elevato: CVSS 9.9 (critico). Colpisce esclusivamente i firewall ASA e FTD quando è attivo il server VPN web.

Il difetto, anche in questo caso dovuto alla mancata validazione degli input in richieste HTTP(S), può essere sfruttato da un attaccante remoto in possesso di credenziali VPN valide. L’esito di un attacco riuscito è identico al precedente: esecuzione di codice arbitrario come utente root e potenziale compromissione completa del dispositivo.

Advisory Cisco e raccomandazioni

Cisco ha pubblicato due security advisory ufficiale relativo alla vulnerabilità CVE-2025-20333 e per la CVE-2025-20363. Il Cisco Product Security Incident Response Team (PSIRT) ha segnalato di essere già a conoscenza di tentativi di sfruttamento attivo della vulnerabilità legata al server VPN. Per questo motivo, l’azienda ribadisce l’urgenza di applicare gli aggiornamenti.

La vulnerabilità è stata individuata durante la risoluzione di un caso di supporto tecnico Cisco TAC, con il contributo di diverse agenzie di sicurezza, tra cui:

• Australian Signals Directorate – Australian Cyber Security Centre
• Canadian Centre for Cyber Security
• UK National Cyber Security Centre (NCSC)
• U.S. Cybersecurity & Infrastructure Security Agency (CISA)

Per verificare se un determinato dispositivo è vulnerabile, Cisco mette a disposizione il Cisco Software Checker, che consente di:

• Identificare gli advisory che interessano una specifica release.
• Individuare la prima versione software che corregge il problema.
• Determinare la release che risolve tutte le vulnerabilità note.

Conclusioni

Le vulnerabilità CVE-2025-20363 e CVE-2025-20333 rappresentano rischi significativi per l’infrastruttura di rete aziendale. La possibilità di eseguire codice arbitrario come root rende i dispositivi interessati particolarmente esposti a compromissioni complete.

Cisco invita pertanto i clienti ad aggiornare senza ritardi i firewall ASA e FTD, seguendo le indicazioni riportate nell’advisory ufficiale disponibile al link:

L'articolo Due bug critici in Cisco ASA e FTD: score 9.9 e rischio esecuzione di codice remoto proviene da il blog della sicurezza informatica.

Perpetual motion devices are either a gag, a scam, or as in the case of this particular toy that [Big Clive] bought on AliExpress, a rather fascinating demonstration of a contact-free inductive sensor combined with a pulsed magnet boost for the metal ball. A cool part about the device is that it comes with a completely clear enclosure, so you can admire its internals while it’s operating. Less cool was that after unboxing the device wasn’t working as the detector wasn’t getting the 12 V it needs to operate, requiring a bit of repairing first.
The crucial part of the perpetual motion device schematic with the sensor, MCU and coil. (Credit: bigclivedotcom, YouTube)
Based on the label on the bottom of the device with the creative model identifier P-toy-002, its standby current is 10 µA which ramps up to 3 A when it’s operating. This makes sense when you look at the two core components: the industrial inductive detector, and a rather big electromagnet that’s driven by a bank of three 10 mF, 35V capacitors, turning it into something akin to a coilgun. Annoyingly, an attempt was made to erase most of the IC package markings.

The circuitry isn’t too complex, fortunately, with an adjustable electromagnet coil voltage circuit combined with a MOSFET to provide the pulse, and a 78L12 regulator to generate the 12 VDC from the coil’s voltage rail for the sensor that is monitored by a MCU.

youtube.com/embed/0mpxdDQHYDQ?…

hackaday.com/2025/09/25/surpri…

Once upon a time, home computers were low-powered enough that they barely needed any cooling at all. An Amiga 500 didn’t even have a heatsink on the CPU, while the early Macintosh got by with a single teeny little fan.

Modern smartphones are far more powerful than these ancient machines, packed with multi-core processors running at speeds of many gigahertz. Even still, they’ve generally been able to get by without any active cooling devices. However, as manufacturers continue to push the envelope of performance, they’ve had to scramble for ways to suck heat out of these handheld computers. Vapor chamber cooling has risen as a solution to this problem, using simple physics to keep your handset humming along at maximum speed for longer.

Cool Runnings

Keeping a smartphone cool is a unique challenge compared to other computing devices. In a desktop or laptop computer, designers can rely on fans, heatsinks, and even water cooling loops with radiators to get heat out of a device. However, for a phone, these methods aren’t so practical. Any air vents would be quickly blocked by pocket lint, and even the slimmest fan or heatsink would add a huge amount of bulk, which is unacceptable for a handheld device.
Samsung has been using vapor chambers in phones for almost a decade, relying on them to keep thermal throttling to a minimum. Credit: Samsung
Thus far, smartphones have largely avoided heating issues in two ways. Firstly, by using low-power chipsets that simply don’t generate a lot of heat in the first place. Secondly, by thermally coupling the main chips to metal heat spreaders and sometimes the smartphone’s external housing, to effectively create a simple heatsink. However, smartphones continue to grow more powerful, generating more heat during demanding tasks like recording high-resolution video. Thus, engineers have had to find new ways to dump greater amounts of heat without compromising the aesthetics and usability of their devices.

Enter vapor chamber cooling. Picture a sealed metal cavity built into a smartphone, inside which is a small amount of water-based coolant. The phone’s chipset is thermally coupled to the cavity, such that the heat is absorbed by the coolant inside. Thanks to the physical properties of water, notably its huge specific heat value, it’s able to absorb a great deal of heat energy, particularly as it passes through the phase-change regime as the fluid turns from a liquid into a gas. As it heats up and vaporizes, the coolant spreads to fill the entire cavity, spreading the heat into the whole thermal mass of the casing where it can be released into the surroundings. As heat is released, the vapor cools back into a liquid, and the cycle can begin again. The idea is exactly the same as is used in heat pipes—where a liquid is heated beyond its phase change point into a vapor, and used to spread heat to other areas of a sealed cavity.
A visual demonstration of a vapor chamber at work. The fluid is heated until it evaporates, and then spreads around the cavity. Credit: Apple
The vapor chamber has benefits over traditional metal heatsinks. The liquid coolant is very effective at evaporating and spreading heat around the entire chamber, wicking heat away from hot chips more quickly. Traditional heatsinks can end up with a hotspot over individual chips, whereas the vapor chamber is more effective at distributing the heat over a wider area.

The intention behind this is to allow phones to run at maximum performance for longer. Whether you’re shooting video or playing a game, it’s no good if your phone has to start throttling clock rates to stay cool in the middle of a task. The vapor chamber simply helps engineers suck more heat out of a phone’s chipset and get rid of it faster.
Google has recently seen fit to include vapor chambers in various models of the Pixel 9 series, aiming to keep phones running at maximum performance for longer. Credit: Google
One drawback is that vapor chambers are obviously far more complex to manufacture than traditional heatsinks. Rather than a flat metal heat spreader, you have a delicate chamber into which coolant must be injected, and then the chamber must be sealed. The coolant must be able to soak up a great deal of heat, as well as safely deal with many cycles of vaporization and condensation, without causing any corrosion or damage to the chamber in the process. The entire vapor chamber must be able to survive the rough-and-tumble life of a handheld device that’s stuffed into pockets and thrown into bags every day of its life.

Vapor chambers have been around for a while now, first showing up in the Galaxy S7 in 2016. They’ve gradually become more popular, though, and these days, you’ll find a vapor chamber in phones like the Google Pixel 9 Pro, the Samsung Galaxy S25+, and the Apple iPhone 17 Pro and Pro Max. They’re still largely the preserve of flagship devices, perhaps as much due to their high-tech appeal and higher cost than traditional cooling solutions. Still, as the smartphone arms race continues, and these parts become more common, expect the technology to trickle down to more humble models in the years to come.

hackaday.com/2025/09/25/how-wa…

FOR IMMEDIATE RELEASE:

The Washington Post reported today that officials plan to require Pentagon reporters to pledge not to gather or report any information that the government has not authorized for release, whether classified or unclassified. Violators risk having their press credentials revoked.

Freedom of the Press Foundation (FPF) Director of Advocacy Seth Stern issued the following statement:

“The Supreme Court has made clear for decades that journalists are entitled to lawfully obtain and publish government secrets. That is essentially the job description of an investigative journalist. The law is also clear that the government can’t require people to contract away a constitutional right, like the right to obtain and publish secrets, in exchange for a benefit, like access to government buildings or press credentials.

“This policy operates as a prior restraint on publication, which is considered the most serious of First Amendment violations. As we learned in the Pentagon Papers case, the government cannot prohibit journalists from public information merely by claiming it’s a secret or even a national security threat. This is worse in a way, because the government isn’t only seeking to restrain specific documents it contends pose a unique threat, it’s seeking to restrain everything it doesn’t want the public to know. That is fundamentally un-American.

“In the meantime, journalists will need to decide whether they’re so dependent on physical access to the Pentagon that they’re willing to trade away their independence to retain it.

“I hope they won’t, and will find other ways to gather news. Agreeing not to look where the government doesn’t want you to look and, by extension, not to print what it doesn’t want you to print, is propaganda, not journalism. Caving to these kinds of demands would in some ways be the most outrageous capitulation yet, and there are plenty to choose from.

“Virtually every time this administration (and past ones) has tried to justify secrecy by claiming it’s protecting national security, its real agenda turned out to be saving itself from embarrassment or from having its lies exposed. There is no reason to think this is any different. Perhaps there are so many embarrassing documents at this point that it’s too difficult to keep finding bogus reasons to keep each of them secret. Maybe that’s why the administration is taking more of a wholesale approach to concealing records that may show wrongdoing, corruption, and incompetence.”

Please contact us if you would like further comment on the dangers this policy poses to press freedom in the United States.

freedom.press/issues/pentagon-…

While it is sort of disturbing, it is one of the best uses for a round LCD we’ve seen lately. What is it? Just [vishalsoniindia]’s SoulCage — a pendant that appears to have a poor soul trapped inside of it. Just in time for the upcoming spooky holiday. You can see the device in operation in the short video below.

The heart (sorry, unintentional pun) of the device is an ESP32-S3 round display. That means the rest of it is software, a battery, and a 3D printed case. There’s a switch, too, to select a male or female image as well as shut the device off when not in use.

The display has its own metal case, but to make room for the battery, the printed back replaces the default one. Of course, you want low current consumption when the device is asleep. However, the board has some additional components, so a small hack on the board was required to allow it to stop drawing current.

In particular, a switch was added to put a regulator in shutdown mode, the USB to serial converter needed a change, and a battery level detection circuit was cut. When off, the device draws about one microamp, so battery life should be very long in storage. In operation, the 85 mA draw provides approximately 11 hours of use per full charge. Plenty of time for a holiday party.

hackaday.com/2025/09/25/trappe…

When you think of “secret” agencies, you probably think of the CIA, the NSA, the KGB, or MI-5. But the real secret agencies are the ones you hardly ever hear of. One of those is the National Reconnaissance Office (NRO). Formed in 1960, the agency was totally secret until the early 1970s.

If you have heard of the NRO, you probably know they manage spy satellites and other resources that get shared among intelligence agencies. But did you know they played a major, but secret, part in the Apollo 11 recovery? Don’t forget, it was 1969, and the general public didn’t know anything about the shadowy agency.

Secret Hawaii

Captain Hank Brandli was an Air Force meteorologist assigned to the NRO in Hawaii. His job was to support the Air Force’s “Star Catchers.” That was the Air Force group tasked with catching film buckets dropped from the super-secret Corona spy satellites. The satellites had to drop film only when there was good weather.
Spoiler alert: They made it back fine.
In the 1960s, civilian weather forecasting was not as good as it is now. But Brandli had access to data from the NRO’s Defense Meteorological Satellite Program (DMSP), then known simply as “417”. The high-tech data let him estimate the weather accurately over the drop zones for five days, much better than any contemporary civilian meteorologist could do.

When Apollo 11 headed home, Captain Brandli ran the numbers and found there would be a major tropical storm over the drop zone, located at 10.6° north by 172.5° west, about halfway between Howland Island and Johnston Atoll, on July 24th. The storm was likely to be a “screaming eagle” storm rising to 50,000 feet over the ocean.

In the movies, of course, spaceships are tough and can land in bad weather. In real life, the high winds could rip the parachutes from the capsule, and the impact would probably have killed the crew.

What to Do?

Brandli knew he had to let someone know, but he had a problem. The whole thing was highly classified. Corona and the DMSP were very dark programs. There were only two people cleared for both programs: Brandli and the Star Catchers’ commander. No one at NASA was cleared for either program.

With the clock ticking, Brandli started looking for an acceptable way to raise the alarm. The Navy was in charge of NASA weather forecasting, so the first stop was DoD chief weather officer Captain Sam Houston, Jr. He was unaware of Corona, but he knew about DMSP.

Brandli was able to show Houston the photos and convince him that there was a real danger. Houston reached out to Rear Admiral Donald Davis, commanding the Apollo 11 recovery mission. He just couldn’t tell the Admiral where he got the data. In fact, he couldn’t even show him the photos, because he wasn’t cleared for DMSP.

Career Gamble

There was little time, so Davis asked permission to move the USS Hornet task force, but he couldn’t wait. He ordered the ships to a new position 215 nautical miles away from the original drop zone, now at 13.3° north by 169.2° west. President Richard Nixon was en route to greet the explorers, so if Davis were wrong, he’d be looking for a new job in August. He had to hope NASA could alter the reentry to match.

The forecast was correct. There were severe thunderstorms at the original site, but Apollo 11 splashed down in a calm sea about 1.7 miles from the target, as you can see below. Houston received a Navy Commendation medal, although he wasn’t allowed to say what it was for until 1995.

In hindsight, NASA has said they were also already aware of the weather situation due to the Application Technology Satellite 1, launched in 1966. Although the weather was described as “suitable for splashdown”, mission planners say they had planned to move the landing anyway.

youtube.com/embed/iZKwuY6kyAY?…

Modern Times

Weather predictions really are better than they used to be. (CC-BY: [Hannah Ritchie])These days, the NRO isn’t quite as secretive as it once was, and, in fact, much of the information for this post derives from two stories from their website. The NRO was also involved in the Manned Orbital Laboratory project and considered using Apollo as part of that program.

Weather forecasting, too, has gotten better. Studies show that even in 1980, a seven-day forecast might be, at best, 45 or 50% accurate. Today, they are nearly 80%. Some of that is better imaging. Some of it is better models and methods, too, of course.

However, thanks to one — or maybe a few — meteorologists, the Apollo 11 crew returned safely to Earth to enjoy their ticker-tape parades. After, of course, their quarantine.

hackaday.com/2025/09/25/spy-te…

Il racconto di Cinzia Fornero e Roberta Pelletta, che l’hanno accompagnato in auto: “Una tortura”. Sono 50 le persone coinvolte nella disobbedienza civile attraverso l’associazione di Marco Cappato

Almeno 6 le richieste di accesso al “suicidio assistito” in Liguria

La conferenza stampa dell’Associazione Luca Coscioni, tenutasi oggi a Genova, ha fatto il punto sui casi di disobbedienza civile seguiti da Soccorso Civile, l’associazione fondata da Marco Cappato per offrire supporto a chi intende esercitare il diritto alla morte volontaria assistita. L’incontro segue la morte di Fabrizio, 79enne ligure, accompagnato in Svizzera da due volontarie di Soccorso Civile, costretto dall’inerzia della politica a rivolgersi all’estero per porre fine a sofferenze insopportabili dovute a una malattia neurodegenerativa irreversibile.

“Dieci ore e mezza di viaggio sono state una tortura imposta a Fabrizio. È stato un viaggio lunghissimo e faticoso. Era convinto di questa scelta, non vedo perché debba essere impedito. Serve una legge civile. Fabrizio ha potuto permettersi questo viaggio in Svizzera per liberare sé stesso dal suo corpo che chiaramente era diventato una prigione. Ci sono tante persone che questi soldi non li hanno e questo è uno dei motivi anche per cui io faccio questi accompagnamenti,” ha raccontato Cinzia Fornero, volontaria di Soccorso Civile che ha accompagnato Fabrizio in Svizzera.

↓ LA VIDEO TESTIMONIANZA DI CINZIA FORNERO↓

youtube.com/embed/c2Fpw2I9hJM?…

. Con lei c’era anche un’altra volontaria, Roberta Pelletta: “È inammissibile che una persona in quelle condizioni debba essere costretta a fare 500 km per ottenere un suo diritto. Per tutto il viaggio ho provato rabbia e vergogna. ‘Sto andando verso la mia liberazione’, ha detto “Fabrizio” all’inizio del viaggio”.

↓ LA VIDEO TESTIMONIANZA DI ROBERTA PELLETTA↓

youtube.com/embed/V-_7wP9-KmU?…

Dalla sentenza della Corte costituzionale del 2019, il numero di persone che chiedono supporto per accedere alla morte volontaria assistita è in aumento, così come quello dei volontari disponibili ad accompagnarle, assumendosi rischi penali fino a 12 anni di carcere. Ad oggi Soccorso Civile conta 50 tra iscritti e contribuenti, che offrono assistenza logistica e, in alcuni casi, economica.

“Fabrizio” avrebbe avuto diritto di morire a casa sua – ha dichiarato Marco Cappato, Tesoriere dell’Associazione Luca Coscioni, Presidente e Responsabile legale dell’associazione Soccorso Civile – Continueremo con le azioni di disobbedienza civile collettiva per chiedere il rispetto della legge. Finora sono già 50 le persone coinvolte, che si assumono la responsabilità di fornire l’aiuto che lo Stato italiano nega. Faccio un appello a tutte le persone di buona volontà: unitevi a noi.

↓ LA VIDEO TESTIMONIANZA DI MARCO CAPPATO↓

youtube.com/embed/938aF7yhch8?…

Quante persone hanno chiesto l’accesso al suicidio medicalmente assistito in Liguria? I dati del nostro accesso agli atti

In Liguria sei persone hanno presentato richiesta di accesso al suicidio medicalmente assistito. Tuttavia, i dati risalenti al 31 marzo 2025 emersi dall’accesso agli atti effettuato dall’Associazione Luca Coscioni risultano frammentari, poco trasparenti e fortemente influenzati dalle valutazioni delle singole ASL. La situazione è così articolata:

• ASL 1 Imperiese (Provincia di Imperia): 1 richiesta,
• ASL 2 Savonese (Provincia di Savona): 1 richiesta
• ASL 3 Genovese (Area metropolitana di Genova): 3 richieste
• ASL 4 Chiavarese (Tigullio): nessuna richiesta
• ASL 5 Spezzino (Provincia della Spezia): 1 richiesta
  

L'articolo “Fabrizio” costretto dallo Stato italiano a subire la tortura di 10 ore di viaggio in Svizzera, nonostante avesse diritto a essere aiutato a casa sua proviene da Associazione Luca Coscioni.