L’azienda di sicurezza cloud Wiz ha identificato una vulnerabilità critica in NVIDIA Container Toolkit, identificata come CVE-2025-23266 e con un punteggio CVSS di 9.0. La vulnerabilità, denominata NVIDIAScape, potrebbe rappresentare una seria minaccia per i servizi cloud che utilizzano l’intelligenza artificiale e la containerizzazione basata su GPU.

Il bug riguarda tutte le versioni di NVIDIA Container Toolkit fino alla 1.17.7 inclusa, nonché NVIDIA GPU Operator fino alla versione 25.3.0. La vulnerabilità è già stata risolta rispettivamente nelle nuove versioni 1.17.8 e 25.3.1.

Il problema è legato all’utilizzo dei cosiddetti hook OCI, progettati per inizializzare i container. Uno di questi hook, “createContainer“, viene utilizzato con una configurazione errata, che consente a un aggressore di caricare una libreria dannosa all’avvio del container.

Il problema è che gli hook vengono eseguiti con privilegi elevati e nel contesto del file system del contenitore, consentendo all’attaccante di iniettare codice con il minimo sforzo. I ricercatori di Wiz hanno sottolineato che l’attacco può essere eseguito con sole tre righe nel Dockerfile, che impostano la variabile LD_PRELOAD e caricano la libreria dannosa. Di conseguenza, l’attaccante può non solo uscire dal contenitore, ma anche prendere il controllo del sistema host.

Ciò che è particolarmente allarmante è che la vulnerabilità interessa circa il 37% degli ambienti cloud che utilizzano l’intelligenza artificiale. Ciò significa che un singolo contenitore compromesso può essere utilizzato per accedere a dati e modelli di altri client ospitati sugli stessi server fisici. L’attacco potrebbe quindi portare a furti di proprietà intellettuale, interruzioni del flusso di lavoro e diniego di servizio.

Wiz aveva già segnalato due problemi simili nel toolkit di NVIDIA, CVE-2024-0132 e CVE-2025-23359 , entrambi con possibilità di acquisizione completa del sistema. La nuova vulnerabilità ha dimostrato ancora una volta quanto sia debole il meccanismo di isolamento nei container. Secondo il team, l’utilizzo esclusivo dei container come misura di sicurezza è inaccettabile: sono necessarie barriere aggiuntive come la virtualizzazione, soprattutto nelle infrastrutture multi-tenant.

La situazione di NVIDIAScape solleva interrogativi urgenti sulla resilienza delle infrastrutture moderne agli attacchi, dove vettori di hacking noti e legacy potrebbero essere più efficaci di ipotetiche minacce basate sull’intelligenza artificiale. Le problematiche a livello di componenti di base, come i container hook, dimostrano che l’attenzione ai dettagli e gli aggiornamenti regolari rimangono elementi chiave della difesa.

L'articolo L’isolamento dei container è a rischio. Solo 3 righe di codice per violare gli ambienti AI di NVIDIA proviene da il blog della sicurezza informatica.

Most research on electroplating tries to find ways to make it plate parts more uniformly. [Ajc150] took the opposite direction, though, with his selective electroplating project, which uses an electrode mounted on a CNC motion system to electrochemically print images onto a metal sheet (GitHub repository).

Normally, selective electroplating would use a mask, but masks don’t allow gradients to be deposited. However, electroplating tends to occur most heavily at the point closest to the anode, and the effect gets stronger the closer the anode is. To take advantage of this effect, [ajc150] replaced the router of an inexpensive 3018 CNC machine with a nickel anode, mounted an electrolyte bath in the workspace, and laid a flat steel cathode in it. When the anode moves close to a certain point on the steel cathode, most of the plating takes place there.

To actually print an image with this setup, [ajc150] wrote a Python program to convert an image into set of G-code instructions for the CNC. The darker a pixel of the image was, the longer the electrode would spend over the corresponding part of the metal sheet. Since darkness wasn’t linearly proportional to plating time, the program used a gamma correction function to adjust times, though this did require [ajc150] to recalibrate the setup after each change. The system works well enough to print recognizable images, but still has room for improvement. In particular, [ajc150] would like to extend this to a faster multi-nozzle system, and have the algorithm take into account spillover between the pixel being plated and its neighbors.

This general technique is reminiscent of a metal 3D printing method we’ve seen before. We more frequently see this process run in reverse to cut metal.

hackaday.com/2025/07/24/painti…

One of the categories we chose for the One Hertz Challenge is “Could Have Used a 555.” What about when you couldn’t have, but did anyway? The 555 is famously easy to use, but not exactly the most accurate timer out there — one “ticking” at 1 Hz will pulse just about once per second (probably to within a millisecond, depending on the rest of the circuit), but when you need more precise timing, the 555 just won’t cut it. Not on its own, anyway.
Allan Deviation can be a bit confusing, but generally — lower is more accurate
This entry by [burble] shows us how the humble 555 can hold its own in more demanding systems with some help from a GPS receiver. He used the One Pulse per Second (1PPS) output from a GPS module to discipline the 1 Hz output from a 555 by modulating the control voltage with a microcontroller.

Okay, this sounds a bit like baking a cake by buying a cake, scraping all the icing off, then icing it yourself, but what better way to learn how to ice a cake? The GPS-disciplined 555 is way more accurate than a free running one — just check out that Allan Deviation plot. While the accuracy of the standard 555 begins to decrease as oscillator drift dominates, the GPS-disciplined version just keeps getting better (up to a point — it would also eventually begin to increase, if the data were recorded for long enough). Compared to other high-end oscillators though, [burble] describes the project’s accuracy in one word: “Badly.”

That’s okay though — it really is a fantastic investigation into how GPS-disciplined oscillators work, and does a fantastic job illustrating the accuracy of different types of clocks, and some possible sources of error. This project is a great addition to some of the other precision timekeeping projects we’ve seen here at Hackaday, and a very fitting entry to the competition. Think you can do better? Or much, much worse? You’ve got a few weeks left to enter!

hackaday.com/2025/07/24/2025-o…

😍😍😍

youtu.be/18QQWa5MEcs?si=tFj9-s…

#marvel #Fantastic4

Neha Madhira grew up in North Texas with the TV constantly buzzing with world news. Madhira, now 24, recognized that journalism was key to keeping her family informed on the happenings back home in India. But with state-sanctioned violence limiting journalists on the ground from reporting, and few legacy media outlets with reporters that looked like her left to report on it, Madhira also knew there were gaps to be filled.

Nearly a decade later, Madhira is bridging the gaps in Western media’s health and education coverage of the Middle East-North Africa region, South Asia, and their diasporas. The contacts she’s built have allowed her to expand her reporting focus — she recently collaborated with Freedom of the Press Foundation (FPF) on an article for The Intercept featuring testimonials from journalists targeted by the Israeli military.

“In a time where press freedom is definitely in question in the U.S. right now, and censorship on social media and in newsroom settings is even becoming more and more common, it’s really important for me that I stay true to my values of why I started reporting,” Madhira said. “I use freelancing to try my best to cover that gap in reporting when it comes to Western media, and try to cover the communities that I know deserve a platform.”

Madhira first spent years covering breaking news, the COVID-19 pandemic, and the social movements of 2020 for local newsrooms in Austin, Texas, while studying journalism and women’s and gender issues. But with activism movements roaring overseas, coupled with the lack of coverage on the impacts of the pandemic in India, she saw freelancing as an opportunity to cover issues happening in countries that face extreme press censorship for audiences overseas and in the U.S.

“A big part of my job during the pandemic, and even now, is reaching out to health care officials, regardless of what’s happening, to actually see who it’s affecting, why it’s affecting them, and what resources people need,” Madhira said. “If there’s a possibility that that information is being withheld from the public, that becomes a problem. How are we supposed to continue to inform and educate the public on how to stay safe during a pandemic or epidemic if we don’t even have that information to begin with?”

She has built close relationships with journalists on the ground in Iran, Afghanistan, India, Gaza, and the West Bank, relying on their reporting to reach audiences in the U.S. and abroad. Recognizing the privilege she holds, Madhira does her best to ensure their perspectives are reflected in her writing.

“I covered the Woman, Life, Freedom movement in Iran very extensively,” she said. “Two journalists who I really looked up to were arrested around this time last year. I wrote a story on that, and I noticed that a lot of Iranian and Iranian American activists were reaching out to me, appreciating the fact that the story was written, because even writing about their release and the details of how they are doing and how journalism and activism is continuing within the country is a privilege.”

Over the past year and a half, Madhira has covered the medical and humanitarian infrastructure collapses in Gaza and the West Bank, as well as the campus encampments in protest of Israel’s actions, and the shadowy organizations collaborating with the government to identify and persecute students and others who are critical of Israel.

“As we see less and less news coming out of Gaza, I urge people to not look away.”

Neha Madhira

With more than 180 journalists killed by Israel to date, media blackouts, and censorship on social media, Madhira writes to amplify the voices of her colleagues remaining on the ground, including those whose stories she wrote about in The Intercept.

“I have advocated for Palestine since I was a child, and at the beginning of October 2023, I was horrified at the language being used to dehumanize Palestinians,” she said. “As a journalist, I was seeing the gaps in Western media coverage and its support of Israel, and I wanted to help change this narrative in any way I could. As we see less and less news coming out of Gaza, I urge people to not look away and to pay closer attention to passive voice being used to describe the atrocities Palestinians continue to face every day.”

While the stories that Madhira tells are urgent and deserving of immediate attention, communicating with people on the ground in Gaza is a slow, challenging process. “Most of the people I’ve interviewed, whether that be journalists, or medical workers, or humanitarian workers, there is a small gap every single day that they have access to the internet, and we have used that to communicate with each other every single day,” she said. “I continue to do that because their voices are the most important and the most pertinent.”

Reporting from the U.S. on Palestine has not come without its own battles against censorship. Having experienced “shadow banning” that has limited visibility of her social media posts, she said the public must pay attention to the ways social media platforms moderate content to censor certain news, and she calls for users to consume content carefully. By amplifying journalists’ content on social media, independent reporting can reach wider audiences and fight against algorithmic suppression, Madhira added.

“There are a lot more people who are in the dark about what is happening than you would think,” she said. “There are so many nonprofit, independent newsrooms, not only in the U.S., but around the world who do incredible reporting for very little money, and it’s important to pay attention, because these journalists are some of the most skilled and experienced within their field.”

freedom.press/issues/freelanci…