We aren’t sure what [theglassman] is working on, but based on his recent projects, we think it is probably something interesting. He’s been decapping ICs, growing oxide on silicon substrates, and has built a tube furnace capable of reaching 1200 °C.

What would you do with something that can melt cast iron? We aren’t sure, but maybe you’ll tell us in the comments. We do have a fair idea of what [theglassman] is doing, though.

The core of the oven is a quartz tube. Insulation is via refractory cement and alumina ceramic wool. The heating itself is classic Nichrome wire and a tiny thermocouple. The real key, though, is to the proper controller. [theglassman] suggests a ramp/soak controller. These allow you to program sequences that heat up and then stop, which, if done properly, can prevent your fragile quartz tube from cracking.

Naturally, you need the tube furnace to grow oxides on silicon. It is less clear why he’s decapping ICs. We were nervous about his process of boiling down sulfuric acid (fuming nitrate works better, anyway, if you just want to remove the epoxy). If you want to remove everything like he does, sodium hydroxide will also work well.

Obviously, we need to keep an eye on [theglassman]. We are curious what he’s working towards. Maybe making a custom transistor? Or, dare we hope, a homemade IC?

hackaday.com/2025/09/25/tube-f…

Cisco ha reso note due vulnerabilità critiche che interessano i propri firewall Secure Firewall Adaptive Security Appliance (ASA) e Secure Firewall Threat Defense (FTD), oltre ad altri prodotti di rete. Entrambe le falle consentono l’esecuzione di codice arbitrario e potrebbero portare al completo compromesso dei dispositivi coinvolti.

CVE-2025-20363 (Score 9,0)

La prima vulnerabilità, identificata come CVE-2025-20363 e con punteggio CVSS 9.0 (critico), riguarda i servizi web di:

• Cisco Secure Firewall ASA Software
• Cisco Secure Firewall FTD Software
• Cisco IOS Software
• Cisco IOS XE Software
• Cisco IOS XR Software

Nel caso dei firewall ASA e FTD, la falla può essere sfruttata da un attaccante remoto non autenticato. Per le piattaforme IOS, IOS XE e IOS XR è invece necessario disporre di credenziali a basso livello di privilegio.

L’origine del problema risiede nella gestione non corretta degli input nelle richieste HTTP. Un aggressore può inviare pacchetti manipolati verso i servizi web esposti da un dispositivo vulnerabile, ottenendo la possibilità di eseguire codice arbitrario con privilegi root. Una compromissione di questo tipo può determinare il controllo totale del sistema.

CVE-2025-20333 (Score 9,9)

La seconda falla, già entrata all’interno del catalogo del CISA KEV, catalogata come CVE-2025-20333, ha un punteggio ancora più elevato: CVSS 9.9 (critico). Colpisce esclusivamente i firewall ASA e FTD quando è attivo il server VPN web.

Il difetto, anche in questo caso dovuto alla mancata validazione degli input in richieste HTTP(S), può essere sfruttato da un attaccante remoto in possesso di credenziali VPN valide. L’esito di un attacco riuscito è identico al precedente: esecuzione di codice arbitrario come utente root e potenziale compromissione completa del dispositivo.

Advisory Cisco e raccomandazioni

Cisco ha pubblicato due security advisory ufficiale relativo alla vulnerabilità CVE-2025-20333 e per la CVE-2025-20363. Il Cisco Product Security Incident Response Team (PSIRT) ha segnalato di essere già a conoscenza di tentativi di sfruttamento attivo della vulnerabilità legata al server VPN. Per questo motivo, l’azienda ribadisce l’urgenza di applicare gli aggiornamenti.

La vulnerabilità è stata individuata durante la risoluzione di un caso di supporto tecnico Cisco TAC, con il contributo di diverse agenzie di sicurezza, tra cui:

• Australian Signals Directorate – Australian Cyber Security Centre
• Canadian Centre for Cyber Security
• UK National Cyber Security Centre (NCSC)
• U.S. Cybersecurity & Infrastructure Security Agency (CISA)

Per verificare se un determinato dispositivo è vulnerabile, Cisco mette a disposizione il Cisco Software Checker, che consente di:

• Identificare gli advisory che interessano una specifica release.
• Individuare la prima versione software che corregge il problema.
• Determinare la release che risolve tutte le vulnerabilità note.

Conclusioni

Le vulnerabilità CVE-2025-20363 e CVE-2025-20333 rappresentano rischi significativi per l’infrastruttura di rete aziendale. La possibilità di eseguire codice arbitrario come root rende i dispositivi interessati particolarmente esposti a compromissioni complete.

Cisco invita pertanto i clienti ad aggiornare senza ritardi i firewall ASA e FTD, seguendo le indicazioni riportate nell’advisory ufficiale disponibile al link:

L'articolo Due bug critici in Cisco ASA e FTD: score 9.9 e rischio esecuzione di codice remoto proviene da il blog della sicurezza informatica.

Perpetual motion devices are either a gag, a scam, or as in the case of this particular toy that [Big Clive] bought on AliExpress, a rather fascinating demonstration of a contact-free inductive sensor combined with a pulsed magnet boost for the metal ball. A cool part about the device is that it comes with a completely clear enclosure, so you can admire its internals while it’s operating. Less cool was that after unboxing the device wasn’t working as the detector wasn’t getting the 12 V it needs to operate, requiring a bit of repairing first.
The crucial part of the perpetual motion device schematic with the sensor, MCU and coil. (Credit: bigclivedotcom, YouTube)
Based on the label on the bottom of the device with the creative model identifier P-toy-002, its standby current is 10 µA which ramps up to 3 A when it’s operating. This makes sense when you look at the two core components: the industrial inductive detector, and a rather big electromagnet that’s driven by a bank of three 10 mF, 35V capacitors, turning it into something akin to a coilgun. Annoyingly, an attempt was made to erase most of the IC package markings.

The circuitry isn’t too complex, fortunately, with an adjustable electromagnet coil voltage circuit combined with a MOSFET to provide the pulse, and a 78L12 regulator to generate the 12 VDC from the coil’s voltage rail for the sensor that is monitored by a MCU.

youtube.com/embed/0mpxdDQHYDQ?…

hackaday.com/2025/09/25/surpri…

Once upon a time, home computers were low-powered enough that they barely needed any cooling at all. An Amiga 500 didn’t even have a heatsink on the CPU, while the early Macintosh got by with a single teeny little fan.

Modern smartphones are far more powerful than these ancient machines, packed with multi-core processors running at speeds of many gigahertz. Even still, they’ve generally been able to get by without any active cooling devices. However, as manufacturers continue to push the envelope of performance, they’ve had to scramble for ways to suck heat out of these handheld computers. Vapor chamber cooling has risen as a solution to this problem, using simple physics to keep your handset humming along at maximum speed for longer.

Cool Runnings

Keeping a smartphone cool is a unique challenge compared to other computing devices. In a desktop or laptop computer, designers can rely on fans, heatsinks, and even water cooling loops with radiators to get heat out of a device. However, for a phone, these methods aren’t so practical. Any air vents would be quickly blocked by pocket lint, and even the slimmest fan or heatsink would add a huge amount of bulk, which is unacceptable for a handheld device.
Samsung has been using vapor chambers in phones for almost a decade, relying on them to keep thermal throttling to a minimum. Credit: Samsung
Thus far, smartphones have largely avoided heating issues in two ways. Firstly, by using low-power chipsets that simply don’t generate a lot of heat in the first place. Secondly, by thermally coupling the main chips to metal heat spreaders and sometimes the smartphone’s external housing, to effectively create a simple heatsink. However, smartphones continue to grow more powerful, generating more heat during demanding tasks like recording high-resolution video. Thus, engineers have had to find new ways to dump greater amounts of heat without compromising the aesthetics and usability of their devices.

Enter vapor chamber cooling. Picture a sealed metal cavity built into a smartphone, inside which is a small amount of water-based coolant. The phone’s chipset is thermally coupled to the cavity, such that the heat is absorbed by the coolant inside. Thanks to the physical properties of water, notably its huge specific heat value, it’s able to absorb a great deal of heat energy, particularly as it passes through the phase-change regime as the fluid turns from a liquid into a gas. As it heats up and vaporizes, the coolant spreads to fill the entire cavity, spreading the heat into the whole thermal mass of the casing where it can be released into the surroundings. As heat is released, the vapor cools back into a liquid, and the cycle can begin again. The idea is exactly the same as is used in heat pipes—where a liquid is heated beyond its phase change point into a vapor, and used to spread heat to other areas of a sealed cavity.
A visual demonstration of a vapor chamber at work. The fluid is heated until it evaporates, and then spreads around the cavity. Credit: Apple
The vapor chamber has benefits over traditional metal heatsinks. The liquid coolant is very effective at evaporating and spreading heat around the entire chamber, wicking heat away from hot chips more quickly. Traditional heatsinks can end up with a hotspot over individual chips, whereas the vapor chamber is more effective at distributing the heat over a wider area.

The intention behind this is to allow phones to run at maximum performance for longer. Whether you’re shooting video or playing a game, it’s no good if your phone has to start throttling clock rates to stay cool in the middle of a task. The vapor chamber simply helps engineers suck more heat out of a phone’s chipset and get rid of it faster.
Google has recently seen fit to include vapor chambers in various models of the Pixel 9 series, aiming to keep phones running at maximum performance for longer. Credit: Google
One drawback is that vapor chambers are obviously far more complex to manufacture than traditional heatsinks. Rather than a flat metal heat spreader, you have a delicate chamber into which coolant must be injected, and then the chamber must be sealed. The coolant must be able to soak up a great deal of heat, as well as safely deal with many cycles of vaporization and condensation, without causing any corrosion or damage to the chamber in the process. The entire vapor chamber must be able to survive the rough-and-tumble life of a handheld device that’s stuffed into pockets and thrown into bags every day of its life.

Vapor chambers have been around for a while now, first showing up in the Galaxy S7 in 2016. They’ve gradually become more popular, though, and these days, you’ll find a vapor chamber in phones like the Google Pixel 9 Pro, the Samsung Galaxy S25+, and the Apple iPhone 17 Pro and Pro Max. They’re still largely the preserve of flagship devices, perhaps as much due to their high-tech appeal and higher cost than traditional cooling solutions. Still, as the smartphone arms race continues, and these parts become more common, expect the technology to trickle down to more humble models in the years to come.

hackaday.com/2025/09/25/how-wa…

FOR IMMEDIATE RELEASE:

The Washington Post reported today that officials plan to require Pentagon reporters to pledge not to gather or report any information that the government has not authorized for release, whether classified or unclassified. Violators risk having their press credentials revoked.

Freedom of the Press Foundation (FPF) Director of Advocacy Seth Stern issued the following statement:

“The Supreme Court has made clear for decades that journalists are entitled to lawfully obtain and publish government secrets. That is essentially the job description of an investigative journalist. The law is also clear that the government can’t require people to contract away a constitutional right, like the right to obtain and publish secrets, in exchange for a benefit, like access to government buildings or press credentials.

“This policy operates as a prior restraint on publication, which is considered the most serious of First Amendment violations. As we learned in the Pentagon Papers case, the government cannot prohibit journalists from public information merely by claiming it’s a secret or even a national security threat. This is worse in a way, because the government isn’t only seeking to restrain specific documents it contends pose a unique threat, it’s seeking to restrain everything it doesn’t want the public to know. That is fundamentally un-American.

“In the meantime, journalists will need to decide whether they’re so dependent on physical access to the Pentagon that they’re willing to trade away their independence to retain it.

“I hope they won’t, and will find other ways to gather news. Agreeing not to look where the government doesn’t want you to look and, by extension, not to print what it doesn’t want you to print, is propaganda, not journalism. Caving to these kinds of demands would in some ways be the most outrageous capitulation yet, and there are plenty to choose from.

“Virtually every time this administration (and past ones) has tried to justify secrecy by claiming it’s protecting national security, its real agenda turned out to be saving itself from embarrassment or from having its lies exposed. There is no reason to think this is any different. Perhaps there are so many embarrassing documents at this point that it’s too difficult to keep finding bogus reasons to keep each of them secret. Maybe that’s why the administration is taking more of a wholesale approach to concealing records that may show wrongdoing, corruption, and incompetence.”

Please contact us if you would like further comment on the dangers this policy poses to press freedom in the United States.

freedom.press/issues/pentagon-…

While it is sort of disturbing, it is one of the best uses for a round LCD we’ve seen lately. What is it? Just [vishalsoniindia]’s SoulCage — a pendant that appears to have a poor soul trapped inside of it. Just in time for the upcoming spooky holiday. You can see the device in operation in the short video below.

The heart (sorry, unintentional pun) of the device is an ESP32-S3 round display. That means the rest of it is software, a battery, and a 3D printed case. There’s a switch, too, to select a male or female image as well as shut the device off when not in use.

The display has its own metal case, but to make room for the battery, the printed back replaces the default one. Of course, you want low current consumption when the device is asleep. However, the board has some additional components, so a small hack on the board was required to allow it to stop drawing current.

In particular, a switch was added to put a regulator in shutdown mode, the USB to serial converter needed a change, and a battery level detection circuit was cut. When off, the device draws about one microamp, so battery life should be very long in storage. In operation, the 85 mA draw provides approximately 11 hours of use per full charge. Plenty of time for a holiday party.

hackaday.com/2025/09/25/trappe…

Il racconto di Cinzia Fornero e Roberta Pelletta, che l’hanno accompagnato in auto: “Una tortura”. Sono 50 le persone coinvolte nella disobbedienza civile attraverso l’associazione di Marco Cappato

Almeno 6 le richieste di accesso al “suicidio assistito” in Liguria

La conferenza stampa dell’Associazione Luca Coscioni, tenutasi oggi a Genova, ha fatto il punto sui casi di disobbedienza civile seguiti da Soccorso Civile, l’associazione fondata da Marco Cappato per offrire supporto a chi intende esercitare il diritto alla morte volontaria assistita. L’incontro segue la morte di Fabrizio, 79enne ligure, accompagnato in Svizzera da due volontarie di Soccorso Civile, costretto dall’inerzia della politica a rivolgersi all’estero per porre fine a sofferenze insopportabili dovute a una malattia neurodegenerativa irreversibile.

“Dieci ore e mezza di viaggio sono state una tortura imposta a Fabrizio. È stato un viaggio lunghissimo e faticoso. Era convinto di questa scelta, non vedo perché debba essere impedito. Serve una legge civile. Fabrizio ha potuto permettersi questo viaggio in Svizzera per liberare sé stesso dal suo corpo che chiaramente era diventato una prigione. Ci sono tante persone che questi soldi non li hanno e questo è uno dei motivi anche per cui io faccio questi accompagnamenti,” ha raccontato Cinzia Fornero, volontaria di Soccorso Civile che ha accompagnato Fabrizio in Svizzera.

↓ LA VIDEO TESTIMONIANZA DI CINZIA FORNERO↓

youtube.com/embed/c2Fpw2I9hJM?…

. Con lei c’era anche un’altra volontaria, Roberta Pelletta: “È inammissibile che una persona in quelle condizioni debba essere costretta a fare 500 km per ottenere un suo diritto. Per tutto il viaggio ho provato rabbia e vergogna. ‘Sto andando verso la mia liberazione’, ha detto “Fabrizio” all’inizio del viaggio”.

↓ LA VIDEO TESTIMONIANZA DI ROBERTA PELLETTA↓

youtube.com/embed/V-_7wP9-KmU?…

Dalla sentenza della Corte costituzionale del 2019, il numero di persone che chiedono supporto per accedere alla morte volontaria assistita è in aumento, così come quello dei volontari disponibili ad accompagnarle, assumendosi rischi penali fino a 12 anni di carcere. Ad oggi Soccorso Civile conta 50 tra iscritti e contribuenti, che offrono assistenza logistica e, in alcuni casi, economica.

“Fabrizio” avrebbe avuto diritto di morire a casa sua – ha dichiarato Marco Cappato, Tesoriere dell’Associazione Luca Coscioni, Presidente e Responsabile legale dell’associazione Soccorso Civile – Continueremo con le azioni di disobbedienza civile collettiva per chiedere il rispetto della legge. Finora sono già 50 le persone coinvolte, che si assumono la responsabilità di fornire l’aiuto che lo Stato italiano nega. Faccio un appello a tutte le persone di buona volontà: unitevi a noi.

↓ LA VIDEO TESTIMONIANZA DI MARCO CAPPATO↓

youtube.com/embed/938aF7yhch8?…

Quante persone hanno chiesto l’accesso al suicidio medicalmente assistito in Liguria? I dati del nostro accesso agli atti

In Liguria sei persone hanno presentato richiesta di accesso al suicidio medicalmente assistito. Tuttavia, i dati risalenti al 31 marzo 2025 emersi dall’accesso agli atti effettuato dall’Associazione Luca Coscioni risultano frammentari, poco trasparenti e fortemente influenzati dalle valutazioni delle singole ASL. La situazione è così articolata:

• ASL 1 Imperiese (Provincia di Imperia): 1 richiesta,
• ASL 2 Savonese (Provincia di Savona): 1 richiesta
• ASL 3 Genovese (Area metropolitana di Genova): 3 richieste
• ASL 4 Chiavarese (Tigullio): nessuna richiesta
• ASL 5 Spezzino (Provincia della Spezia): 1 richiesta
  

L'articolo “Fabrizio” costretto dallo Stato italiano a subire la tortura di 10 ore di viaggio in Svizzera, nonostante avesse diritto a essere aiutato a casa sua proviene da Associazione Luca Coscioni.