Stop the game: più di 20MILA firme per dire no a Italia-Israele raccolte dalla petizione che abbiamo lanciato ad agosto su bit.ly/noitaliaisraele, mentre il genocidio non si ferma e il governo italiano fa quadrato intorno alla partita.

La difesa dei ministri Abodi e Salvini che negli ultimi giorni hanno blindato la partita Italia-Israele in programma a Udine il 14 ottobre non è che un tassello, e nemmeno il più grave, del sostegno del governo italiano a Israele, che resta incrollabile.

Non il più grave, perché l’Italia non ha intenzione di smettere di inviare armi a Israele, nonostante le vuote e tardive dichiarazioni di Meloni su Israele che avrebbe “superato ogni limite”. Forse Meloni e i suoi ministri non si rendono conto che questo limite, se mai è esistito, è stato superato con la complicità dell’Italia, della sua politica estera e dei suoi voti e astensioni in Europa.

Eppure, mentre le vittime palestinesi continuano a crescere di giorno in giorno, mentre Gaza è ridotta in macerie e le code per il cibo sono solo delle trappole per sparare sulla popolazione ridotta alla fame, che il calcio vada avanti come se nulla fosse è particolarmente inaccettabile. Che lo sport sia ridotto a strumento di propaganda e di normalizzazione del genocidio è insopportabile, e che succeda a casa nostra, nei nostri stadi, è intollerabile.

Delle oltre 60.000 vittime palestinesi identificate, più di 600 sono atlete e atleti.

Il 27 agosto l’esercito israeliano ha ucciso a colpi d’arma da fuoco il mezzofondista palestinese Allam Abdullah Al-Amour mentre, promessa dell’atletica palestinese e internazionale, nei pressi di un centro di distribuzione di aiuti a sud di Khan Younis, a sud della Striscia di Gaza.

All’inizio di agosto è stato ucciso mentre era in coda per il cibo il più famoso calciatore palestinese, Suleiman Al Obeid, soprannominato il Pelè palestinese. La sua famiglia e tutta la popolazione palestinese sopravvivono giorno per giorno in condizioni insostenibili: giocare questa partita è un’offesa alla memoria delle vittime, alla giustizia e allo sport stesso.

Se nonostante le richieste della politica, della cittadinanza, dell’AIAC (Associazione Italiana Allenatori Calcio) la partita si giocherà lo stesso, il 14 ottobre saremo in piazza a Udine alla manifestazione di protesta, organizzata dal Comitato per la Palestina di Udine, della Comunità Palestinese del Friuli e del Veneto, da Salaam Ragazzi dell’Olivo e da Calcio e Rivoluzione, a cui hanno già aderito più di 200 associazioni per dire ancora una volta no sport-washing e stop al genocidio.

Francesca Druetti (Segretaria di Possibile)

Andrea di Lenardo (Capogruppo Alleanza Verdi e Sinistra — Possibile in Consiglio comunale a Udine)

Serena Pellegrino (Consigliera regionale Alleanza Verdi e Sinistra in FVG)

L'articolo Stop the game: 20.000 firme per dire no a Italia-Israele proviene da Possibile.

As we all look across a sea of lifeless, nearly identically-styled consumer goods, a few of us have become nostalgic for a time when products like stereo equipment, phones, appliances, homes, cars, and furniture didn’t all look indistinguishable. Computers suffered a similar fate, with nearly everything designed to be flat and minimalist with very little character. To be sure there are plenty of retro computing projects to recapture nostalgia, but to get useful, modern hardware in a fun, retro-themed case check out this desktop build from [Mar] that hides a few unique extras.

The PC itself is a modern build with an up-to-date operating system, but hidden in a 386-era case with early-90s styling. The real gem of this build though is the floppy disk drive, which looks unaltered on the surface. But its core functionality has been removed and in its place an Arduino sits, looking for NFC devices. The floppy disks similarly had NFC tags installed so that when they interact with the Arduino,it can send a command to the computer to launch a corresponding game. To the user it looks as though the game loads from a floppy disk, much like it would have in the 90s albeit with much more speed and much less noise.

Modern industrial design is something that we’ve generally bemoaned as of late, and it’s great to see some of us rebelling by building unique machines like this, not to mention repurposing hardware like floppy drives for fun new uses (which [Mar] has also open-sourced on a GitHub page). It’s not the first build to toss modern hardware in a cool PC case from days of yore, either. This Hot Wheels desktop is one of our favorites.

hackaday.com/2025/08/29/nfc-hi…

Birds are pretty amazing creatures, and one of the most amazing things about them and their non-avian predecessors are feathers. Engineers and scientists are finding inspiration from them in surprising ways.

The light weight and high strength of feathers has inspired those who look to soar the skies, dating back at least as far as Ancient Greece, but the multifunctional nature of these marvels has led to advancements in photonics, thermal regulation, and acoustics. The water repellency of feathers has also led to interesting new applications in both food safety and water desalination beyond the obvious water repellent clothing.

Sebastian Hendrickx-Rodriguez, the lead researcher on a new paper about the structure of bird feathers states, “Our first instinct as engineers is often to change the material chemistry,” but feathers are made in thousands of varieties to achieve different advantageous outcomes from a single material, keratin. Being biological in nature also means feathers have a degree of self repair that human-made materials can only dream of. For now, some researchers are building biohybrid devices with real bird feathers, but as we continue our march toward manufacturing at smaller and smaller scales, perhaps our robots will sprout wings of their own. Evolution has a several billion year head start, so we may need to be a little patient with researchers.

Some birds really don’t appreciate Big Brother any more than we do. If you’re looking for some feathery inspiration for your next flying machine, how about covert feathers. And we’d be remiss not to look back at the Take Flight With Feather Contest that focused on the Adafruit board with the same name.

hackaday.com/2025/08/29/feathe…

Wood is an amazing material to use around the house, both for its green credentials and the way it looks and feels. That said, as a natural product there are a lot of microorganisms and insects around that would love to take a few good nibbles out of said wood, no matter whether it’s used for fencing, garden furniture or something else. For fencing in particular wood treatments are therefore applied that seek to deter or actively inhibit these organisms, but as the UK bloke over at the [Rag ‘n’ Bone Brown] YouTube channel found out last year, merely slapping on a coating of wood preserver may actually make things worse.

For the experiment three tests were set up, each with an untreated, self-treated and two pressure treated (tanalized) sections. Of the pressure treated wood one had a fresh cut on the exposed side, with each of the three tests focusing on a different scenario.

After three years of these wood cuts having been exposed to being either partially buried in soil, laid on the long side or tossed in a bucket, all while soaking up the splendid wonders of British weather, the results were rather surprising and somewhat confusing. The self-treated wood actually fared worse than the untreated wood, while the pressure treated wood did much better, but as a comment by [davidwx9285] on the video notes, there are many questions regarding how well the pressure treatment is performed.

While the self-treatment gets you generally only a surface coating of the – usually copper-based – compound, the vacuum pressure treatment’s effectiveness depends on how deep the preservative has penetrated, which renders some treated wood unsuitable for being buried in the ground. Along with these factors the video correctly identifies the issue of grain density, which is why hardwoods resist decay much better than e.g. pine. Ultimately it’s quite clear that ‘simply put on a wood preserver’ isn’t quite the magical bullet that it may have seemed to some.

youtube.com/embed/_76EFrsKa_U?…

hackaday.com/2025/08/29/the-co…

Sometimes the old tricks are the best. [Kevin] learned an old trick about using a ‘scope to sniff RF noise and pays it forward by sharing it in a recent video. He uses an oscilloscope. But does he need some special probe setup? Nope. He quickly makes a little RF pickup probe, and if you have a ‘scope, we’re pretty sure you can make one in a few seconds, too.

Of course, you can get probes made for that, and there are advantages to using them. But the quick trick of quickly and non-destructively modifying the existing probe to pick up RF means you always have a way to make these measurements.

The first thing he probes is a small power supply that is broadcasting inadvertently at 60 kHz. The power supply was charging a bug zapper and, as you might expect, the bug zapper throws out a lot of noise on the radio bands.

If you have an FFT feature on your scope, that is often useful, too, as you can see the results of several interfering signals mixing together. Hunting down interference is a basic skill if you work with radio, and it’s useful even if you don’t.

youtube.com/embed/SF6RM-eI6sY?…

hackaday.com/2025/08/29/the-rf…

Looking back on the trajectory leading to Project Apollo and the resulting Moon missions, one can be forgiven for thinking that this was a strict and well-defined plan that was being executed, especially considering the absolute time crunch. The reality is that much of this trajectory was in flux, with the earlier Project Gemini seeing developments towards supplying manned space stations and even its own Moon missions. [Spaceflight Histories] recently examined some of these Advanced Gemini concepts that never came to pass.

In retrospect, some of these seem like an obvious evolution of the program. Given both NASA and the US Air Force’s interest in space stations at the time, the fact that a up-sized “Big Gemini” was proposed as a resupply craft makes sense. Not to be confused with the Gemini B, which was a version of the spacecraft that featured an attached laboratory module. Other concepts, like the paraglider landing feature, were found to be too complex and failure prone.

The circumlunar, lunar landing and Apollo rescue concepts were decidedly more ambitious and included a range of alternatives to the Project Apollo missions, which were anything but certain especially after the Apollo 1 disaster. Although little of Advanced Gemini made it even into a prototype stage, it’s still a fascinating glimpse at an alternate reality.

youtube.com/embed/nth7pS7_mLk?…

hackaday.com/2025/08/29/the-ad…

Una recente analisi di Cyber Threat Intelligence (CTI) condotta da DREAM ha svelato i dettagli di una complessa campagna di spear-phishingavvenuta nell’agosto 2025. L’attacco, attribuito a un gruppo allineato all’Iran, noto come Homeland Justice, ha sfruttato un’infrastruttura già compromessa per raggiungere obiettivi sensibili a livello globale. La peculiarità di questa operazione risiede nell’utilizzo di un account di posta elettronica violato appartenente al Ministero degli Affari Esteri dell’Oman, che ha fornito una copertura di legittimità per le comunicazioni malevole.

ezstandalone.cmd.push(function () { ezstandalone.showAds(604); });
Le e-mail di phishing contenevano un allegato dannoso, un documento di Microsoft Word, che rappresentava il primo anello della catena di infezione. All’interno di questo file si nascondeva una macro VBA (Visual Basic for Applications) appositamente codificata per eludere i controlli di sicurezza standard. Una volta attivata, la macro procedeva con la decodifica e l’installazione di un payload, un file eseguibile battezzato come sysProcUpdate.exe, che rappresentava il cuore dell’attacco informatico.
Il percorso di attacco della campagna di spear phishing Iran-Nexus.
Il malware sysProcUpdate.exe era progettato per svolgere un’attività di ricognizione dettagliata del sistema compromesso. Il suo compito principale era quello di raccogliere metadati specifici del sistema, tra cui informazioni sulla configurazione e sui software installati. Questi dati venivano successivamente crittografati per garantirne la riservatezza e poi trasmessi in modo sicuro a un server di comando e controllo (C2), da cui gli aggressori potevano gestire la campagna e ricevere le informazioni esfiltrate.

ezstandalone.cmd.push(function () { ezstandalone.showAds(612); });
Per sfuggire ai sistemi di difesa e all’analisi, gli attaccanti hanno implementato diverse tecniche di evasione sofisticate. Hanno occultato la propria origine instradando il traffico attraverso un nodo di uscita VPN in Giordania, rendendo difficile la loro localizzazione. Inoltre, il payload dannoso veniva scritto in un file con estensione .log, un formato di file generalmente non associato al malware, con l’obiettivo di eludere i controlli automatici. L’uso di ritardi nel codice contribuiva ulteriormente a confondere i sistemi di analisi comportamentale.
Esca utilizzata
I principali obiettivi di questa campagna erano istituzioni diplomatiche e governative. L’attacco ha preso di mira entità in un’ampia varietà di aree geografiche, inclusi il Medio Oriente, l’Africa, l’Europa, l’Asia e le Americhe. Per l’Europa i paesi colpiti sono Italia, Francia Romania, Spagna, Paesi Bassi, Ungheria, Germania, Austria, e Svezia. La campagna dimostra una chiara preferenza per obiettivi di alto valore, mirati a ottenere informazioni strategiche attraverso l’accesso a reti di governi e organizzazioni internazionali, sottolineando la natura politica o geopolitica della minaccia.

Per mitigare l’attacco, gli esperti di sicurezza consigliano diverse contromisure tecniche. La prima e più immediata è il blocco degli Indicatori di Compromissione (IOC), come gli indirizzi IP dei server C2 e gli hash dei file dannosi. Un’altra raccomandazione cruciale è il monitoraggio proattivo delle richieste POST sospette dirette ai server C2 e la verifica delle modifiche al registro di Windows, che possono segnalare l’attività del malware.
La catena di esecuzione delle macro VBA della campagna.
Tra le altre misure di mitigazione, viene sottolineata l’importanza di imporre la sicurezza delle macro nei programmi di Office per prevenire l’esecuzione di codice arbitrario. Si suggerisce inoltre di condurre un’analisi approfondita del traffico VPN in uscita, al fine di identificare eventuali flussi di dati anomali. Infine, l’implementazione della segmentazione della rete è vista come una difesa efficace per limitare la propagazione del malware e ridurre l’impatto di attacchi simili in futuro.

L'articolo Iran Cyber Army: spear-phishing contro i governi di mezzo mondo (Italia inclusa!) proviene da il blog della sicurezza informatica.

Volete una lettura interessante, allegra e leggera?
Allora questo è il titolo perfetto per voi!
Personaggi ben delineati e storie quotidiane fresche vi accompagneranno pagina dopo pagina.

🌔: È piacevole senza grandi pretese, ma riesce a intrattenere senza affaticare.

La Cina ha presentato KylinOS 11 , il più grande aggiornamento del suo sistema operativo nazionale, che il governo ha definito un importante passo avanti nella creazione di un ecosistema tecnologico indipendente. La nuova versione gira sul kernel Linux 6.6 ed è compatibile con processori AMD e Intel, nonché con otto CPU cinesi, molte delle quali utilizzano architetture di comando proprietarie. Il sistema supporta anche sette schede video nazionali e può funzionare con acceleratori AMD e Nvidia.

ezstandalone.cmd.push(function () { ezstandalone.showAds(604); });
Il lancio ha riguardato immediatamente le versioni desktop e server,aggiungendo un assistente AI integrato, il supporto del protocollo di contesto del modello, l’integrazione cloud e funzionalità di sicurezza avanzate.

Secondo il presidente di KylinSoft, Chen Zhihua, KylinOS è già il sistema operativo nazionale più utilizzato in Cina, con 16 milioni di installazioni. Si tratta di una quota modesta a livello nazionale, ma i media statali hanno descritto il lancio come un passaggio da una “piattaforma di supporto funzionale” a una “base di connessione intelligente”.

ezstandalone.cmd.push(function () { ezstandalone.showAds(612); });
È interessante notare che la scelta del kernel potrebbe sollevare interrogativi. La versione 6.6 ha ricevuto lo stato LTS nel 2023, ma il suo supporto terminerà a dicembre 2026, appena 16 mesi dopo il rilascio di KylinOS 11.

Tuttavia, questo non rappresenta un precedente per gli sviluppatori: la precedente versione di KylinOS 10, rilasciata nel 2020, era basata sul kernel 4.19, il cui supporto è terminato nel 2024, ovvero molto prima che il sistema stesso venisse interrotto.

La presentazione di KylinOS 11 è stata un evento importante per l’industria IT cinese.

Durante l’evento, i rappresentanti delle principali aziende tecnologiche del Paese hanno promesso pubblicamente di supportare la distribuzione e l’implementazione della nuova versione del sistema operativo.

Allo stesso tempo, The Register ha osservato che non ci sono ancora informazioni sul supporto di KylinOS 11 per le alternative nazionali a Bluetooth e HDMI, proposte dalla Cina lo scorso anno. Forse la loro integrazione sarà un compito da affrontare nelle versioni future.

L'articolo La Cina presenta KylinOS11 con AI Integrata: il sistema operativo nazionale che sostituirà Windows proviene da il blog della sicurezza informatica.

What happens when you listen in on Elliot Williams and Al Williams? You get a round up of the best of last week’s Hackaday posts, of course. The topics this week range from beer brewing to lightning protection, with a little bit of everything in between.

This week, many problems find solutions. Power drill battery dead? Your car doesn’t have a tire pressure monitor? Does your butter tear up your toast? You can find the answer to these problems, and more, on the Hackaday podcast.

For the can’t miss section, the guys are annoyed that Google wants to lock down their phones, and also talk about measuring liquid levels in outer space.

Check out the links below if you want to follow along, and as always, tell us what you think about this episode in the comments!

html5-player.libsyn.com/embed/…

Or download in DRM-free MP3 without requiring developer registration.

Where to Follow Hackaday Podcast

Places to follow Hackaday podcasts:

• iTunes
• Spotify
• Stitcher
• RSS
• YouTube
• Check out our Libsyn landing page

Episode 335 Show Notes:

News:

• Confirmation Of Record 220 PeV Cosmic Neutrino Hit On Earth
• Tons of entries for the One Hertz challenge!

What’s that Sound?

• Al made short work of the sound this week. See if you can guess and if you can, you might win a coveted Hackaday Podcast T-shirt.

Interesting Hacks of the Week:

• Automated Brewing
  
  • DIY PWM-Controlled IKEA TILLREDA Induction Cooktop | Hackaday.io

  
  

• How To Stop Zeus From Toasting Your Pi
• Battery Repair By Reverse Engineering
• Wire Photo Fax Teardown
  
  • Picture By Paper Tape

  
  

• JuiceBox Rescue: Freeing Tethered EV Chargers From Corporate Overlords
  
  • EMW kick-starts JuiceBox, a $99 Level 2 DIY charging station
  • Home – Citizens and Technology Lab

  
  

• RP2040 Assembly Language Mix And Match

Quick Hacks:

• Elliot’s Picks:
  
  • Homebrew Tire Pressure Monitoring System
  • Troubled USB Device? This Tool Can Help
  • Butta Melta Stops Rock-solid Butter From Tearing Your Toast

  
  

• Al’s Picks:
  
  • Picking An Old Operating System
  • The Shady School
  • Dead Bug Timer Relay Needs No PCB

  
  

Can’t-Miss Articles:

• The Browser Wasn’t Enough, Google Wants To Control All Your Software
• Where There Is No Down: Measuring Liquid Levels In Space

hackaday.com/2025/08/29/hackad…

Connecting an LED to a battery seems trivial. If you have any knowledge of using breadboards, knowing that red goes with red, and that black goes with black, it’s as easy as tying your shoes. Except there’s one problem: what if you can’t see the difference between red and black? [Tara] had a student who struggled with a problem just like this, so of course, they made a whole suite of breakout boards to the rescue!

Breadboards rely almost completely on the visual cues of rows, columns, and if the part is even in the hole correctly. [Tara] fixed these issues while attempting to keep the usefulness of a breadboard. Using tactile cues rather than the traditional visual, a visually impaired individual can figure out what is positive or negative.

Braille is the obvious choice for general communication of inputs and outputs. Where [Tara]’s ingenuity came in was the method of incorporating Braille into the boards — solder joints. After reading a Hackaday article on solder Braille, [Tara] managed a fitting and efficient method of allowing ease of use.

Currently, the boards are in a prototyping stage; however, if you want to try them out yourself early, let [Tara] know. Others with visual impairments are needed to properly stress test the device. If you are someone who does not struggle with any major visual impairments, it can be hard to put yourself in their shoes. For those empathic (and with VR capabilities) among us, be sure to try it yourself!

hackaday.com/2025/08/29/breako…

Il progetto “Un modello di base per la progettazione di vaccini contro il cancro” è stato selezionato per un premio dalla prestigiosa iniziativa AI Research Resource (AIRR) del governo britannico, guidata dal Dipartimento per la Scienza, l’Innovazione e la Tecnologia (DSIT) e da UK Research and Innovation (UKRI).

ezstandalone.cmd.push(function () { ezstandalone.showAds(604); });
Il progetto riceverà 10.000 ore GPU sul Dawn Supercomputer , uno dei supercomputer di intelligenza artificiale più veloci del Regno Unito.

Il Dott. Lennard Lee, Professore Associato presso il Centro di Immuno-Oncologia e co-responsabile del progetto, ha dichiarato:

ezstandalone.cmd.push(function () { ezstandalone.showAds(612); });
“Crediamo che Oxford possa guidare una nuova era di scoperte nella cura del cancro, rendendo i trattamenti più sicuri, più precisi e più efficaci attraverso l’uso di tecnologie all’avanguardia. La progettazione di vaccini contro il cancro si trova ad affrontare uno dei maggiori colli di bottiglia nello sviluppo: l’accesso a infrastrutture di calcolo ad alte prestazioni. Con uno dei supercomputer di intelligenza artificiale più veloci del Regno Unito ora a nostra disposizione, scoperte che un tempo richiedevano anni ora potrebbero richiedere solo poche settimane “.

Michael Bryan, studente e dottorato presso il Centre for Immuno-Oncology, ha dichiarato:

“È un vero privilegio lavorare a Oxford con il supporto di Cancer Research UK. Il nostro team sta sviluppando modelli di base di intelligenza artificiale specializzati per accelerare la scoperta di bersagli per vaccini salvavita contro il cancro ” .

Il progetto, realizzato dal Dipartimento di Medicina di Nuffield, sfrutterà set di dati sui tumori disponibili al pubblico per fare scoperte su molteplici sottotipi di cancro e contribuire all’Oxford Neoantigen Atlas, una piattaforma ad accesso aperto a supporto della ricerca sui vaccini contro il cancro in tutto il Regno Unito.

Questo lavoro fa parte di un più ampio sforzo nazionale per accelerare le capacità scientifiche del Regno Unito, trasformate dall’accesso alla potenza di supercalcolo dell’intelligenza artificiale, per inaugurare una nuova era di immunologia e scoperta di vaccini.

youtube.com/embed/BZQ5i8UrSgk?…

Il programma AIRR, guidato da DSIT e UKRI, sta investendo oltre 1 miliardo di sterline per aumentare di 20 volte la capacità di calcolo nazionale entro il 2030, consentendo una ricerca audace e basata sui dati nei settori pubblico e privato. Questo premio allinea gli scienziati di Oxford all’ambizione del governo di fare della Gran Bretagna un leader globale nell’intelligenza artificiale, nella scienza e nell’innovazione sanitaria.

L'articolo Il supercomputer Dawn scende in campo contro il cancro: una nuova era della ricerca assieme alle AI proviene da il blog della sicurezza informatica.

DEF CON happened just a few weeks ago, and it’s time to cover some of the interesting talks. This year there were two talks in particular that are notable for being controversial. Coincidentally both of these were from Track 3. The first was the Passkeys Pwned, a talk by SquareX about how the passkey process can be hijacked by malware.

[Dan Goodin] lays out both the details on Passkeys, and why the work from SquareX isn’t the major vulnerability that they claim it is. First, what is a Passkey? Technically it’s a public/private keypair that is stored by the user’s browser. A unique keypair is generated for each new website, and the site stores the public key. To authenticate with the Passkey, the site generates a random string, the browser signs it with the private key, and the site checks it against the public key. I stand by my early opinion, that Passkeys are effectively just passwords, but with all the best-practices mandated.

So what is the claim presented at DEF CON? Malicious code running in the context of the browser tab can hijack the passkey process. In the demonstrated attack flow, a browser extension caused the Passkey login to fail, and prompted the user to generate a new Passkey. This is an interesting observation, and a clever attack against Passkeys, but is not a vulnerability in the Passkey spec. Or more accurately, it’s an accepted limitation of Passkeys, that they cannot guarantee security in the presence of a compromised browser.

That Wasn’t the Sketchiest DEF CON Talk

There was another suspect presentation: A talk on DragonSlayer, a framework to de-obfuscate virtualized malware. This topic is super interesting, diving into the world of highly obfuscated malware. Imagine a binary that internally implements an interpreter runs the actual program code from a bytecode format. As a researcher, this sort of obfuscation is very time consuming to wade through.

The approach from DragonSlayer is to observe the malware, look for known patterns, and feed the observations into a machine learning tool.

If that sounds a bit like a meme, with the steps going: 1) AI, 2) ???, 3) Profit. And this is where we get to the reaction from at least part of the security community. The term “AI slop” is thrown around. The repository doesn’t compile, portions of the code are no-ops with comments about what the real code would look like, and some recent commits look like attempts to remove the tell-tale sings of AI authorship.

Ransomware in the cloud

There’s a new trend in ransomware attacks, to move away from on-premise and encryption, and to instead attack cloud data. This is based on a report from Microsoft, detailing the activities of Storm-0501. That threat actor has begun chaining on-premises attacks into Azure takeover.

Azure has plenty of bandwidth, and an attacker isn’t on the hook to pay for it, so the approach here is to firehose all of that data off-site, and then delete every scrap possible. In cases where the permissions don’t allow deletion, new keys are created, proving that the encryption approach isn’t dead yet.

AI Malware

Let’s talk AI Malware. Up first is PromptLock, a find by ESET. Rather than being found in an active exploit, ESET researchers found this as an upload to VirusTotal, and suspect that it’s a proof of concept.

That concept is to skip shellcode, and instead just include malicious prompts in the malware. Upon execution, the malware sends the embedded prompts off to an Ollama API, and asks for malicious Lua code back.

PromptLock seemed like a proof of concept, but there was a different, live malware campaign this week, that made use of a compromised nx library delivered via npm. This one creates a repository named s1ngularity-repository if it’s running in a GitHub context. It also looks for Claude or Gemini on the system, and if found, runs a malicious prompt instructing the agentic LLM to look for local secrets.

0-days

Pssst, hey kid, I hear you like 0-days. We’ve got 0-days this week. First up, FreePBX. The administrative control panel has a flaw that allows an attacker to run any command as the underlying Asterisk user. The earliest that this attack has been seen in logs was August 21, and any FreePBX system with the admin panel exposed to the Internet could be compromised.

Researchers at at watchTowr caught wind of a vulnerability in CrushFTP that allowed attackers admin access to the server over HTTPS. This one was being exploited in the wild even before the patch was released. Rather than do their normal patch reverse engineering, the watchTowr team put their Attacker Eye honeypot to work. They added a CrushFTP module to the mix, and sat back to wait for the incoming attack. The Internet didn’t disappoint, and it turns out this is a very odd race condition between login attempts.

The Passwordstate credentials manager also has a pair of vulnerabilities fixed in a recent update, though it doesn’t appear that they are actually 0-days, nor yet exploited in the wild. This one seems to allow unauthorized access to the administrative interface via the Emergency Access page.

Bits and Bytes

Trail of Bits performed a security assessment of the WhatsApp apps and backend infrastructure. They found about 28 separate issues, with the most serious getting fixed. Kudos to Meta and Trail of Bits for publishing the whole report.

And finally, there’s a clever technique showing up on Linux malware. Encoding a malicious command as part of the filename. The attack starts with a .rar. It drops a file with the malicious name, with the hope that it will be processed by a backup or similar script. The end-game is a rootkit with remote access. Be careful what you download!

hackaday.com/2025/08/29/this-w…