Un aggiornamento urgente è stato pubblicato da Google per la versione stabile del browser Desktop, al fine di risolvere una vulnerabilità estremamente grave che è attualmente oggetto di sfruttamento.

Questo aggiornamento, che porta il browser alla versione 143.0.7499.109/.110, risolve tre vulnerabilità di sicurezza, compresa una falla zero-day contrassegnata come 466192044. Google, diversamente dal solito, ha tenuto nascosti i dettagli del suo identificatore CVE, limitandosi a indicarlo come “In fase di coordinamento”.

Google ha inoltre risolto, altre due vulnerabilità di media gravità segnalate da esperti di sicurezza esterni. Per questo, sono stati assegnati complessivamente 4.000 dollari nell’ambito del programma di bounty per i bug e sono:

• CVE-2025-14372: una vulnerabilità di tipo “use-after-free” nel Password Manager. Questo bug di danneggiamento della memoria è stato segnalato da Weipeng Jiang (@Krace) di VRI il 14 novembre 2025, che ha fruttato una ricompensa di 2.000 dollari.
• CVE-2025-14373: Un’implementazione inappropriata nella barra degli strumenti. Scoperta dal ricercatore Khalil Zhani il 18 novembre 2025, anche questa falla comportava una ricompensa di 2.000 dollari.

Ritornando alla precedente vulnerabilità senza CVE, l’azienda ha riportato un monito severo: “È noto a Google che esista un exploit specifico del numero 466192044″. Ciò conferma che gli autori della minaccia hanno già sfruttato la falla per colpire gli utenti.

La condizione di “coordinamento in corso” implica che la vulnerabilità potrebbe implicare un’ulteriore cooperazione con altri fornitori, prima di poter rendere pubblici i dettagli tecnici completi in piena sicurezza.

L’aggiornamento è ora disponibile per gli utenti Windows, Mac e Linux. Dato lo sfruttamento attivo della vulnerabilità ad alta gravità, si consiglia vivamente ad amministratori e utenti di non attendere il rilascio automatico.

L'articolo Chrome sotto attacco! Google rilascia d’urgenza una patch per un bug senza CVE proviene da Red Hot Cyber.

Appena due giorni dopo la scoperta della vulnerabilità critica di React2Shell, i ricercatori di Sysdig hanno scoperto un nuovo malware, EtherRAT, in un’applicazione Next.js compromessa. Il malware utilizza gli smart contract di Ethereum per la comunicazione e ottiene persistenza sui sistemi Linux in cinque modi.

Gli esperti ritengono che il malware sia correlato agli strumenti utilizzati dal gruppo nordcoreano Lazarus. Tuttavia, EtherRAT differisce dai campioni noti per diversi aspetti chiave.

React2Shell (CVE-2025-55182) è una vulnerabilità critica nella popolare libreria JavaScript React di Meta.Il problema, che ha ricevuto un punteggio CVSS di 10 su 10, è correlato alla deserializzazione non sicura dei dati nei componenti di React Server e consente l’esecuzione di codice remoto sul server utilizzando una normale richiesta HTTP (senza autenticazione o privilegi).

Il bug riguarda le ultime versioni 19.0, 19.1.0, 19.1.1 e 19.2.0 nelle configurazioni predefinite, nonché il famoso framework Next.js. Le correzioni sono state rilasciate nelle versioni 19.0.1, 19.1.2 e 19.2.1 di React, nonché per le versioni di Next.js interessate.

Gli esperti avvertono che potrebbero verificarsi problemi simili in altre librerie con implementazioni di React Server, tra cui: plugin Vite RSC, plugin Parcel RSC, anteprima di React Router RSC, RedwoodSDK e Waku.

La vulnerabilità è già stata sfruttata dai gruppi di hacker cinesi Earth Lamia e Jackpot Panda e almeno 30 organizzazioni sono state colpite dagli attacchi.

Gli attacchi iniziano sfruttando la vulnerabilità React2Shell. Una volta sfruttata, un comando shell codificato in base64 viene eseguito sul sistema di destinazione. Questo comando viene utilizzato per scaricare uno script s.sh dannoso tramite curl, wget o python3. Il comando viene ripetuto ogni 300 secondi fino al completamento del download. Lo script risultante viene verificato, gli vengono concessi i permessi di esecuzione e viene avviato.

Lo script crea quindi una directory nascosta in $HOME/.local/share/, dove scarica la versione 20.10.0 del runtime Node.js legittimo direttamente dal sito web ufficiale nodejs.org. Quindi scrive un payload crittografato e un dropper JavaScript offuscato, che viene eseguito tramite il binario Node scaricato. Lo script si elimina quindi da solo.

Il dropper legge il blob crittografato, lo decrittografa utilizzando una chiave AES-256-CBC codificata e scrive il risultato come un altro file JavaScript nascosto. Il payload decrittografato è EtherRAT, distribuito utilizzando Node.js precedentemente installato.

Secondo gli esperti, EtherRAT utilizza gli smart contract di Ethereum per il controllo, rendendo gli aggressori resistenti al blocco. Il malware interroga simultaneamente nove provider RPC pubblici di Ethereum e seleziona il risultato in base al voto a maggioranza, proteggendo dall’avvelenamento di un singolo nodo o di un sinkhole.

Ogni 500 millisecondi, il malware invia URL casuali, simili agli indirizzi CDN, al suo server di comando e controllo ed esegue il codice JavaScript restituito tramite AsyncFunction. Questo fornisce agli aggressori una shell Node.js interattiva a tutti gli effetti.

Secondo gli analisti, gli hacker nordcoreani hanno già utilizzato contratti intelligenti per distribuire malware. Questa tecnica, chiamata EtherHiding, è stata descritta in report di Google e GuardioLabs . Sysdig osserva inoltre che il pattern di download crittografato in EtherRAT corrisponde a quello del malware BeaverTail, utilizzato nella campagna Contagious Interview collegata alla Corea del Nord.

Il rapporto sottolinea inoltre l’estrema aggressività di EtherRAT nei sistemi Linux. Il malware utilizza cinque meccanismi per insediarsi nel sistema infetto:

• cron;
• iniezione in bashrc;
• Avvio automatico XDG;
• servizio utente systemd;
• iniezione nel profilo.

Un’altra caratteristica unica di EtherRAT è la sua capacità di auto-aggiornamento. Il malware carica il suo codice sorgente su un endpoint API e riceve codice sostituito con le stesse funzionalità ma con un offuscamento diverso. Il malware si sovrascrive quindi e avvia un nuovo processo con il payload aggiornato. Secondo i ricercatori, questo aiuta a eludere i meccanismi di rilevamento statici, può ostacolare l’analisi o aggiungere funzionalità specifiche.

Nel suo rapporto, Sysdig fornisce un breve elenco di indicatori di compromissione relativi all’infrastruttura di distribuzione EtherRAT e ai contratti Ethereum. I ricercatori raccomandano di verificare la presenza dei meccanismi di persistenza elencati, di monitorare il traffico RPC di Ethereum, di monitorare i log delle applicazioni e di ruotare regolarmente le credenziali.

L'articolo React2Shell sfruttata da Lazarus? Nasce EtherRAT, il malware che vive sulla blockchain proviene da Red Hot Cyber.

For as long as there have been supercomputers, people like us have seen the announcements and said, “Boy! I’d love to get some time on that computer.” But now that most of us have computers and phones that greatly outpace a Cray 2, what are we doing with them? Of course, a supercomputer today is still bigger than your PC by a long shot, and if you actually have a use case for one, [Stephen Wolfram] shows you how you can easily scale up your processing by borrowing resources from the Wolfram Compute Services. It isn’t free, but you pay with Wolfram service credits, which are not terribly expensive, especially compared to buying a supercomputer.

[Stephen] says he has about 200 cores of local processing at his house, and he still sometimes has programs that run overnight. If your program already uses a Wolfram language and uses parallelism — something easy to do with that toolbox — you can simply submit a remote batch job.

What constitutes a supercomputer? You get to pick. You can just offload your local machine using a single-core 8GB virtual machine — still a supercomputer by 1980s standards. Or you get machines with up to 1.5TB of RAM and 192 cores. Not enough for your mad science? No worries, you can map a computation across more than one machine, too.

As an example, [Stephen] shows a simple program that tiles pentagons:

When the number of pentagons gets large, a single line of code sends it off to the cloud:

RemoteBatchSubmit[PentagonTiling[500]]

The basic machine class did the work in six minutes and 30 seconds for a cost of 5.39 credits. He also shows a meatier problem running on a 192-core 384GB machine. That job took less than two hours and cost a little under 11,000 credits (credit cost from just over $4/1000 to $6/1000, depending on how many you buy, so this job cost about $55 to run). If two hours is too much, you can map the same job across many small machines, get the answer in a few minutes, and spend fewer credits in the process.

Supercomputers today are both very different from old supercomputers and yet still somewhat the same. If you really want that time on the Cray you always wanted, you might think about simulation.

hackaday.com/2025/12/10/your-s…

There’s a type of dust-collector that’s been popular since the 1990s, where a cube of acrylic or glass is laser-etched in a three-dimensional pattern. Some people call them bubblegrams. While it could be argued that bubblegrams are a sort of 3D display, they’re more like a photograph than a TV. [Ancient] had the brainwave that since these objects work by scattering light, he could use them as a proper 3D video display by controlling the light scattered from an appropriately-designed bubblegram.

Appropriately designed, in this case, means a point cloud, which is not exactly exciting to look at on its own. It’s when [Ancient] adds the colour laser scanning projector that things get exciting. Well, after some very careful alignment. We imagine if this was to go on to become more than a demonstrator some sort of machine-vision auto-aligning would be desirable, but [Ancient] is able to conquer three-dimensional keystoning manually for this demonstration. Considering he is, in effect, projection-mapping onto the tiny bubbles in the crystal, that’s impressive work. Check out the video embedded below.

With only around 38,000 points, the resolution isn’t exactly high-def, but it is enough for a very impressive proof-of-concept. It’s also not nearly as creepy as the Selectric-inspired mouth-ball that was the last [Ancient] project we featured. It’s also a lot less likely to take your fingers off than the POV-based volumetric display [Ancient] was playing DOOM on a while back.

For the record, this one runs the same DOOM port, too– it’s using the same basic code as [Ancient]’s other displays, which you can find on GitHub under an MIT license.

Thanks to [Hari Wiguna] for the tip.

youtube.com/embed/wrfBjRp61iY?…

hackaday.com/2025/12/10/volume…

Ever think about all the moving parts involving a big KiCad project going into production? You need to provide manufacturer documentation, assembly instructions and renders for them to reference, every output file they could want, and all of it has to always stay up to date. [Vincent Nguyen] has a software pipeline to create all the files and documentation you could ever want upon release – with an extensive installation and usage guide, helping you turn your KiCad projects truly production-grade.

This KiBot-based project template has no shortage of features. It generates assembly documents with custom processing for a number of production scenarios like DNPs, stackup and drill tables, fab notes, it adds features like table of contents and 3D renders into KiCad-produced documents as compared to KiCad’s spartan defaults, and it autogenerates all the outputs you could want – from Gerbers, .step and BOM files, to ERC/DRC reports and visual diffs.

This pipeline is Github-tailored, but it can also be run locally, and it works wonderfully for those moments when you need to release a PCB into the wild, while making sure that the least amount of things possible can go wrong during production. With all the features, it might take a bit to get used to. Don’t need fully-featured, just some GitHub page images? Use this simple plugin to auto-add render images in your KiCad repositories, then.

youtube.com/embed/63R6Wnx44uY?…

We thank [Jaac] for sharing this with us!

hackaday.com/2025/12/10/produc…

This week Jonathan chats with K. S. Bhaskar about YottaDB. This very high performance database has some unique tricks! How does YottaDB run across multiple processes without a daemon? Why is it licensed AGPL, and how does that work with commercial deployments? Watch to find out!

• yottadb.com/feed/
• github.com/YottaDB/YDB

youtube.com/embed/aUhdny-zHdw?…

Did you know you can watch the live recording of the show right on our YouTube Channel? Have someone you’d like us to interview? Let us know, or have the guest contact us! Take a look at the schedule here.

play.libsyn.com/embed/episode/…

Direct Download in DRM-free MP3.

If you’d rather read along, here’s the transcript for this week’s episode.

Places to follow the FLOSS Weekly Podcast:

• Spotify
• RSS

Theme music: “Newer Wave” Kevin MacLeod (incompetech.com)

Licensed under Creative Commons: By Attribution 4.0 License

hackaday.com/2025/12/10/floss-…

The basic concept of human intelligence entails self-awareness alongside the ability to reason and apply logic to one’s actions and daily life. Despite the very fuzzy definition of ‘human intelligence‘, and despite many aspects of said human intelligence (HI) also being observed among other animals, like crows and orcas, humans over the ages have always known that their brains are more special than those of other animals.

Currently the Cattell-Horn-Carroll (CHC) theory of intelligence is the most widely accepted model, defining distinct types of abilities that range from memory and processing speed to reasoning ability. While admittedly not perfect, it gives us a baseline to work with when we think of the term ‘intelligence’, whether biological or artificial.

This raises the question of how in the context of artificial intelligence (AI) the CHC model translate to the technologies which we see in use today. When can we expect to subject an artificial intelligence entity to an IQ test and have it handily outperform a human on all metrics?

Types Of Intelligence

While the basic CHC model contains ten items, the full model is even more expansive, as can be seen in the graphic below. Most important are the overarching categories and the reasoning for the individual items in them, as detailed in the 2014 paper by Flanagan and McGrew. Of these, reasoning (Gf, for fluid intelligence), acquired knowledge and memory (long and short term) are arguably the most relevant when it comes to ‘general intelligence’.
Current and expanded CHC theory of cognitive abilities. Source: Flanagan & McGrew (1997).
Fluid intelligence (Gf), or reasoning, entails the ability to discover the nature of the problem or construction, to use a provided context to fill in the subsequent steps, and to handle abstract concepts like mathematics. Crystallized intelligence (Gc) can be condensed to ‘basic skills’ and general knowledge, including the ability to communicate with others using a natural language.

The basic memory abilities pertain to short-term (Gsm) and long-term recall (Glr) abilities, in particular attention span, working memory and the ability to recall long-term memories and associations within these memories.

Beyond these basic types of intelligence and abilities we can see that many more are defined, but these mostly expand on these basic four, such as visual memory (Gv), various visual tasks, speed of memory operations, reaction time, reading and writing skills and various domain specific knowledge abilities. Thus it makes sense to initially limit evaluating both HI and AI within this constrained framework.

Are Humans Intelligent?

North American Common Raven (Corvus corax principalis) in flight at Muir Beach in Northern California (Credit: Copetersen)
It’s generally considered a foregone conclusion that because humans as a species possesses intelligence, ergo facto every human being possesses HI. However, within the CHC model there is a lot of wriggle room to tone down this simplification. A big part of IQ tests is to test these these specific forms of intelligence and skills, after all, creating a mosaic that’s then boringly reduced to a much less meaningful number.

The main discovery over the past decades is that the human brain is far less exceptional than we had assumed. For example crows and their fellow corvids easily keep up with humans in a range of skills and abilities. As far as fluid intelligence is concerned, they clearly display inductive and sequential reasoning, as they can solve puzzles and create tools on the spot. Similarly, corvids regularly display the ability to count and estimate volumes, demonstrating quantitative reasoning. They have regularly demonstrated understanding water volume, density of objects and the relation between these.

In Japanese parks, crows have been spotted manipulating the public faucets for drinking and bathing, adjusting the flow to either a trickle or a strong flow depending on what they want. Corvids score high on the Gf part of the CHC model, though it should be said that the Japanese crow in the article did not turn the faucet back off again, which might just be because they do not care if it keeps running.

When it comes to crystallized intelligence (Gc) and the memory-related Gsm and Glr abilities, corvids score pretty high as well. They have been reported to remember human faces, to learn from other crows by observing them, and are excellent at mimicking the sounds that other birds make. There is evidence that corvids and other avian dinosaur species (‘birds’) are capable of learning to understand human language, and even communicating with humans using these learned words.

The key here is whether the animal understands the meaning of the vocalization and what vocalizing it is meant to achieve when interacting with a human. Both parrots and crows show signs of being able to learn significant vocabularies of hundreds of words and conceivably a basic understanding of their meaning, or at least what they achieve when uttered, especially when it comes to food.

Whether non-human animals are capable of complex human speech remains a highly controversial topic, of course, though we are breathlessly awaiting the day that the first crow looks up at a human and tells the hairless monkey what they really think of them and their species as a whole.

The Bears

The bear-proof garbage bins at Yosemite National Park. (Credit: detourtravelblog)
Meanwhile there’s a veritable war of intellects going on in US National Parks between humans and bears, involving keeping the latter out of food lockers and trash bins while the humans begin to struggle the moment the bear-proof mechanism requires more than two hand motions. This sometimes escalates to the point where bears are culled when they defeat mechanisms using brute force.

Over the decades bears have learned that human food is easier to obtain and fills much better than all-natural food sources, yet humans are no longer willing to share. The result is an arms race where bears are more than happy to use any means necessary to obtain tasty food. Ergo we can put the Gf, Gc and memory-related scores for bears also at a level that suggests highly capable intellects, with a clear ability to learn, remember, and defeat obstacles through intellect. Sadly, the bear body doesn’t lend itself well to creating and using tools like a corvid can.

Despite the flaws of the CHC model and the weaknesses inherent in the associated IQ test scores, it does provide some rough idea of how these assessed capabilities are distributed across a population, leading to a distinct Bell curve for IQ scores among humans and conceivably for other species if we could test them. Effectively this means that there is likely significant overlap between the less intelligent humans and smarter non-human animals.

Although H. sapiens is undeniably an intelligent species, the reality is that it wasn’t some gods-gifted power, but rather an evolutionary quirk that it shares with many other lifeforms. This does however make it infinitely more likely that we can replicate it with a machine and/or computer system.

Making Machines Intelligent

Artificial Intelligence Projects for the Commodore 64, by Timothy J. O’Malley
The conclusion we have thus reached after assessing HI is that if we want to make machines intelligent, they need to acquire at least the Gf, Gc, Gsm and Glr capabilities, and at a level that puts them above that of a human toddler, or a raven if you wish.

Exactly how to do this has been the subject of much research and study the past millennia, with automatons (‘robots’) being one way to pour human intellect into a form that alleviates manual labor. Of course, this is effectively merely on par with creating tools, not an independent form of intelligence. For that we need to make machines capable of learning.

So far this has proved very difficult. What we are capable of so far is to condense existing knowledge that has been annotated by humans into a statistical model, with large language models (LLMs) as the pinnacle of the current AI hype bubble. These are effectively massively scaled up language models following the same basic architecture as those that hobbyists were playing with back in the 1980s on their home computers.

With that knowledge in mind, it’s not so surprising that LLMs do not even really register on the CHC model. In terms of Gf there’s not even a blip of reasoning, especially not inductively, but then you would not expect this from a statistical model.

As far as Gc is concerned, here the fundamental flaw of a statistical model is what it does not know. It cannot know what it doesn’t know, nor does it understand anything about what is stored in the weights of the statistical model. This is because it’s a statistical model that’s just as fixed in its functioning as an industrial robot. Chalk up another hard fail here.

Finally, although the context window of LLMs can be considered to be some kind of short-term memory, it is very limited in its functionality. Immediate recall of a series of elements may work depending on the front-end, but cognitive operations invariably fail, even very basic ones such as adding two numbers. This makes Gsm iffy at best, and more realistically a complete fail.

Finally, Glr should be a lot easier, as LLMs are statistical models that can compress immense amounts of data for easy recall. But this associative memory is an artefact of human annotation of training data, and is fixed at the time of training the model. After that, it does not remember outside of its context window, and its ability to associate text is limited to the previous statistical analysis of which words are most likely to occur in a sequence. This fact alone makes the entire Glr ability set a complete fail as well.

Piecemeal Abilities

Although an LLM is not intelligent by any measure and has no capacity to ever achieve intelligence, as a tool it’s still exceedingly useful. Technologies such as artificial neurons and large language models have enabled feats such as machine vision that can identify objects in a scene with an accuracy depending on the training data, and by training an LLM on very specific data sets the resulting model can be a helpful statistical tool, as it’s a statistical model.

These are all small fragments of what an intelligent creature is capable of, condensed into tool form. Much like hand tools, computers and robots, these are all tools that we humans have crafted to make certain tasks easier or possible. Like a corvid bending some wire into shape to open a lock or timing the dropping of nuts with a traffic light to safely scoop up fresh car-crushed nuts, the only intelligence so far is still found in our biological brains.

All of which may change as soon as we figure out a way to replicate abstract aspects such as reasoning and understanding, but that’s still a whole kettle of theoretical fish at this point in time, and the subject of future articles.

hackaday.com/2025/12/10/why-ll…

For less than $30 USD, you can get a 10×10 centimeter hotplate with 350 Watts of power. Sounds mighty fine to us, so surely there must be a catch? Maybe not, as [Stefan Nikolaj]’s review of this AliExpress hotplate details, it seems to be just fine enough.

At this price, you’d expect some shoddy electronics inside, or maybe outright fiery design decisions, in the vein of other reviews for similar cheap heat-producing tech that we’ve seen over the years. Nope – the control circuitry seems to be more than well-built for our standards, with isolation and separation where it matters, the input being fused away, and the chassis firmly earthed. [Stefan] highlights just two possible problem areas: a wire nut that could potentially be dodgy, and lack of a thermal fuse. Both can be remedied easily enough after you get one of these, and for the price, it’s a no-brainer. Apart from the review, there’s also general usage recommendations from [Stefan] in the end of the blog post.

While we’re happy to see folks designing their own PCB hotplates or modifying old waffle irons, the availability of cheap turn-key options like this means there’s less of a reason to go the DIY route. Now, if you’re in the market for even more build volume, you can get one of the classic reflow ovens, and maybe do a controller upgrade while you’re at it.

hackaday.com/2025/12/10/cheap-…

The “Long Dark” is upon us, at least for those who live north of the equator, and while it’s all pre-holiday bustle, pretty lights, and the magical first snow of the season now, soon the harsh reality of slushy feet, filthy cars, and not seeing the sun for weeks on end will set in. And when it does, it pays to have something to occupy idle mind and hands alike, a project that’s complicated enough to make completing even part of it feel like an accomplishment.

But this time of year, when daylight lasts barely as long as a good night’s sleep, you’ve got to pick your projects carefully, lest your winter project remain incomplete when the weather finally warms and thoughts turn to other matters. For me, at least, that means being realistic about inevitabilities such as competition from the day job, family stuff, and the dreaded “scope creep.”

It’s that last one that I’m particularly concerned with this year, because it has the greatest potential to delay this project into spring or even — forbid it! — summer. And that means I need to be on the ball about what the project actually is, and to avoid the temptation to fall into any rabbit holes that, while potentially interesting and perhaps even profitable, will only make it harder to get things done.

Pushing My Buttons

For my winter project this year, I chose something I’ve been itching to try for a while: an auto-starter for my generator. Currently, my solar PV system automatically charges its battery bank when the state of charge (SOC) drops below 50%, which it does with alarming frequency during these short, dark days. But rather than relying on shore power, I want my generator to kick on to top off the batteries, then turn itself off when the charge is complete.
Primer assembly for the generator auto-start. The silver part is the regulator; the solenoid pushes the primer button when it fires. All the parts needed to be custom-made.
In concept, it’s a simple project, since the inverter panel I chose has dry contacts that can trigger based on SOC. It seems like a pretty easy job, just a microcontroller to sense when the inverter is calling for a charge and some relays to kick the generator on. It’s a little — OK, a lot — more complicated than that when you think about it, since you have to make sure the generator actually cranks over, you’ve got to include fail-safes so the generator doesn’t just keep cranking endlessly if it doesn’t catch, and you have to make everything work robustly in an electrically and mechanically noisy environment.

However, in my case, the most challenging aspect is dealing with the mechatronics of the project. My generator is fueled by propane, which means there’s a low-pressure regulator that needs to be primed before cranking the starter. When cranking the generator manually, you just push the primer button a few times to get enough propane into the fuel intake and turn the key. Automating this process, though, is another matter, one that will surely require custom parts, and the easiest path to that would be 3D printing.

But, up until a couple of weeks ago, I didn’t own a 3D printer. I know, it’s hard to believe someone who writes for Hackaday for a living wouldn’t own one of the essential bits of hacker kit, but there it is. To be fair to myself, I did dip my toe into additive manufacturing about six or seven years ago, but that printer was pretty awful and never really turned out great prints. It seemed like this project, with its potential need for many custom parts, was the perfect excuse to finally get a “big boy” printer.

Pick Your Project

And that’s where I came upon the first potential rabbit hole: should I buy an out-of-the-box solution, or should I take on a side-quest project? I was sorely tempted to take the latter course by getting one of those used Enders returned to Amazon, having heard that they’re about half the price of new and often need very little work to get them going. But then again, sometimes these printers have gone through a lot in the short time they were in a customer’s hands, to the point where they need quite a bit of work to get them back in good order.

While I like the idea of a cheap printer, and I wouldn’t mind tinkering with one to get it going again, I decided against the return route. I really didn’t like my odds, given that our Editor in Chief, Elliot Williams, says that of the two returned printers he’s purchased, one worked basically out of the box, while the other needed more work to get in shape. I wanted to unbox the printer and start making parts right away, to get this project going. So, I took the plunge and bought a Bambu P1S on a pre-Black Friday sale that was much less than list price, but much more than what I would have paid for a returned Ender.

Now, I’m not going to turn this into a printer review — that’s not really the point of this article. What I want to get across is that I decided to buy a solution rather than take on a new hobby. I got the Bambu up and running in about an hour and was cranking out prototype parts for my project later that afternoon. Yes, I might have had the same experience with a returned printer at about half the price of the Bambu, but I felt like the perceived value of a new printer was worth the premium price, at least in this case.

I think this is a pretty common choice that hackers face up and down the equipment spectrum. Take machine tools, for instance. Those of us who dream of one day owning a shop full of metalworking tools often trawl through Facebook Marketplace in search of a nice old South Bend lathe or a beautiful Bridgeport milling machine, available for a song compared to what such a machine would cost new. But with the difficulty and expense of getting it home and the potential for serious mechanical problems like worn ways or broken gears that need to be sorted before putting the machine to use, the value proposition could start to shift back toward buying a brand new machine. Expensive, yes, but at least you stand a chance of making parts sooner.

Your Turn

Don’t get me wrong; I’d love to find a nice old lathe to lovingly restore, and I just may do that someday. It’s like buying a rusty old classic car; you’re not doing it to end up with a daily driver, but rather for the joy of restoring a fine piece of engineering to its former glory. In projects like that, the journey is the point, not the destination. But if I need to make parts right away, a new lathe — or mill, or CNC router, or 3D printer — seems like the smarter choice.

I’ll turn things over to you at this point. Have you come up against this kind of decision before? If so, which path did you choose? Has anyone had a satisfying out-of-the-box experience with returned printers? Was I unnecessarily pessimistic about my chances in that market? What about your experience with large machine tools, like lathes and mills? Is it possible to buy used and not have the machine itself become the project? Sound off in the comments below.

hackaday.com/2025/12/10/ask-ha…

Back in March, a small aircraft in the UK lost engine power while coming in for a landing and crashed. The aircraft was a total loss, but thankfully, the pilot suffered only minor injuries. According to the recently released report by the Air Accidents Investigation Branch, we now know a failed 3D printed part is to blame.

The part in question is a plastic air induction elbow — a curved duct that forms part of the engine’s air intake system. The collapsed part you see in the image above had an air filter attached to its front (towards the left in the image), which had detached and fallen off. Heat from the engine caused the part to soften and collapse, which in turn greatly reduced intake airflow, and therefore available power.
Serious injury was avoided, but the aircraft was destroyed.
While the cause of the incident is evident enough, there are still some unknowns regarding the part itself. The fact that it was 3D printed isn’t an issue. Additive manufacturing is used effectively in the aviation industry all the time, and it seems the owner of the aircraft purchased the part at an airshow in the USA with no reason to believe anything was awry. So what happened?

The part in question is normally made from laminated fiberglass and epoxy, with a glass transition of 84° C. Glass transition is the temperature at which a material begins to soften, and is usually far below the material’s actual melting point.

When a part is heated at or beyond its glass transition, it doesn’t melt but is no longer “solid” in the normal sense, and may not even be able to support its own weight. It’s the reason some folks pack parts in powdered salt to support them before annealing.

The printed part the owner purchased and installed was understood to be made from CF-ABS, or ABS with carbon fiber. ABS has a glass transition of around 100° C, which should have been plenty for this application. However, the investigation tested two samples taken from the failed part and measured the glass temperature at 52.8°C and 54.0°C, respectively. That’s a far cry from what was expected, and led to part failure from the heat of the engine.

The actual composition of the part in question has not been confirmed, but it sure seems likely that whatever it was made from, it wasn’t ABS. The Light Aircraft Association (LAA) plans to circulate an alert to inspectors regarding 3D printed parts, and the possibility they aren’t made from what they claim to be.

hackaday.com/2025/12/10/failed…

Il mondo della tecnologia quantistica ha compiuto un balzo in avanti impressionante:

QuantWare ha presentato il primo processore al mondo da 10.000 qubit, 100 volte più di qualsiasi dispositivo esistente. Inoltre, il nuovo chip occupa ancora meno spazio rispetto ai sistemi attuali, rendendo questa svolta particolarmente degna di nota in un contesto di anni di stagnazione nella scalabilità dei processori quantistici.

Per quasi un decennio, il settore non è riuscito a superare la soglia dei 100 qubit. Google è riuscita a passare da 53 a 105 qubit solo in sei anni, mentre IBM ha introdotto un processore da 1.121 qubit nel 2023 e non prevede una crescita significativa almeno fino al 2028. Di fronte alle limitazioni hardware, le aziende sono state costrette a combinare più chip di piccole dimensioni anziché aumentare la potenza di uno solo. Ciò ha complicato l’architettura, aumentato i costi e ostacolato il progresso reale.

QuantWare sostiene che la sua nuova architettura rimuove questa barriera.

Si basa sulla scalabilità 3D e su un design modulare a livello di chiplet, supportando 40.000 linee di I/O e interconnessioni interchip ad alta precisione. Questo approccio consente la costruzione di unità di elaborazione quantistica (QPU) monolitiche di grandi dimensioni senza sacrificare affidabilità o prestazioni.

L’azienda sostiene che il nuovo sistema offre una potenza di calcolo significativamente maggiore per dollaro e per watt rispetto alle soluzioni multi-chip, e l’architettura stessa potrebbe diventare uno standard di scalabilità a livello di settore. Qualsiasi organizzazione che lavori con qubit superconduttori potrà utilizzarlo per creare dispositivi quantistici più potenti.

QuantWare sta sviluppando contemporaneamente l’ecosistema Quantum Open Architecture, che ora includeNVIDIA NVQLink. Combinata con l’architettura proprietaria di QuantWare, questa tecnologia combina il calcolo quantistico iperscalabile con il calcolo classico ad alte prestazioni, accessibile tramite NVIDIA CUDA-Q. L’azienda è convinta che la combinazione di VIO e NVQLink offra la scalabilità di cui il settore ha disperatamente bisogno oggi.

Insieme all’annuncio, l’azienda ha anche annunciato l’intenzione di costruire un impianto Kilofab su larga scala. L’impianto, la cui apertura è prevista per il 2026 a Delft, nei Paesi Bassi, diventerà la prima fabbrica al mondo dedicata ai dispositivi Quantum Open Architecture e uno dei più grandi impianti di produzione quantistica mai progettati. QuantWare spedisce già più processori quantistici di qualsiasi altro produttore commerciale in termini di volume, e Kilofab aumenterà questa capacità di 20 volte.

Matt Rijlaarsdam, CEO di QuantWare, ha definito questo un punto di svolta atteso da tempo.

Ha osservato che per anni gli specialisti si erano limitati a teorizzare le capacità dei sistemi quantistici, poiché il settore era limitato a 100 qubit e non poteva raggiungere una potenza di calcolo economicamente significativa. Il nuovo processore, ha affermato, rimuove finalmente questa barriera e apre la strada a computer quantistici realmente utili . “Con il VIO-40K, stiamo offrendo all’intero ecosistema l’accesso all’architettura di processore quantistico più potente e scalabile mai realizzata”, ha sottolineato.

I preordini sono già aperti e le prime unità saranno consegnate ai clienti nel 2028.

Ricordiamo che nel 2019 Craig Gidney e Martin Ekerå stimarono, nel loro lavoro intitolato “How to factor 2048-bit RSA integers in 8 hours using 20 million noisy qubits”, che un dispositivo quantistico con circa 20 milioni di qubit fisici “rumorosi” — connessi in una griglia piana e corretti con codice superficie (surface code) — sarebbe teoricamente in grado di fattorizzare una chiave RSA a 2048 bit in circa 8 ore.

Tuttavia, in un aggiornamento del 2025 lo stesso Gidney propone ottimizzazioni sostanziali: grazie a tecniche come l’approximate residue arithmetic e una gestione più efficiente dei qubit logici dormienti, secondo l’articolo “How to factor 2048 bit RSA integers with less than a million noisy qubits” oggi sarebbe sufficiente un quantum computer con meno di un milione di qubit fisici rumorosi per scomporre una chiave RSA-2048, in un tempo “meno di una settimana.

L'articolo Il QDay è vicino? QuantWare presenta il processore quantistico da 10.000 qubit proviene da Red Hot Cyber.

Un aggiornamento urgente è stato pubblicato da Ivanti per la sua piattaforma Endpoint Manager (EPM), al fine di risolvere un insieme di vulnerabilità significative che potrebbero permettere agli aggressori di eseguire codice a loro scelta o di prendere il controllo delle sessioni amministrative.

Tra le vulnerabilità corrette, vi sono quattro falle specifiche, compresa una particolarmente critica, contraddistinta da un punteggio di elevata gravità, che sono state sanate grazie a questo aggiornamento.

Per le organizzazioni che non sono in grado di applicare immediatamente la patch, e suggerisce di segregare al meglio le proprie reti riportando che : “Se i clienti non hanno esposto la propria soluzione su Internet, il rischio di questa vulnerabilità è significativamente ridotto”.

Una falla di sicurezza di Stored Cross-Site Scripting (XSS) monitorata con il CVE-2025-10573, ha ottenuto un punteggio CVSS di 9,6. Le versioni del software EPM antecedenti alla 2024 SU4 SR1 sono interessate da questa vulnerabilità.

L’avviso segnala che la vulnerabilità permette ad un aggressore remoto non autenticato di eseguire codice JavaScript a sua scelta all’interno di una sessione di amministrazione.

La falla richiede l’interazione dell’utente, in quanto è probabile che un amministratore venga indotto a visualizzare una pagina dannosa, tuttavia il rischio di un dirottamento dell’intera sessione impone una priorità assoluta per i responsabili della difesa.

Oltre al bug critico XSS, Ivanti ha corretto altre tre vulnerabilità di elevata gravità che espongono il sistema all’esecuzione di codice remoto (RCE) e alla manipolazione non autorizzata dei file:

• Scrittura di file arbitraria (CVE-2025-13659): classificata CVSS 8.8, questa falla riguarda il “controllo improprio delle risorse di codice gestite dinamicamente”, consentendo a un aggressore remoto e non autenticato di scrivere file arbitrari sul server.
• Errore di verifica della firma (CVE-2025-13662): con un punteggio CVSS di 7,8, questa vulnerabilità deriva da una “verifica impropria delle firme crittografiche nel componente di gestione delle patch”. Consente ad aggressori remoti non autenticati di eseguire codice arbitrario, sebbene richieda l’interazione dell’utente.
• Path Traversal (CVE-2025-13661): questo problema (CVSS 7.1) consente a un aggressore autenticato di “scrivere file arbitrari al di fuori della directory prevista”, compromettendo potenzialmente l’integrità del sistema.

Sebbene Ivanti affermi di “non essere a conoscenza di alcun cliente sfruttato da queste vulnerabilità al momento della divulgazione”, consiglia vivamente ai clienti di effettuare immediatamente l’aggiornamento.

L'articolo Ivanti risolve 4 vulnerabilità critiche in Endpoint Manager (EPM) proviene da Red Hot Cyber.

Nella Giornata Mondiale dei diritti umani, l’Associazione Luca Coscioni presenta un appello al Ministro Urso: “La ricerca è un diritto umano, e salva vite”

Bloccata anche una terapia cellulare che rigenera la cornea, consentendo il recupero della vista

In Italia esistono sperimentazioni e terapie avanzate sviluppate grazie a oltre trent’anni di ricerca pubblica che hanno già dimostrato di poter arrivare a salvare la vita e ridare la vista a persone senza alternative terapeutiche. Si tratta delle sperimentazioni per la terapia genica per l’Epidermolisi Bollosa – malattia rara nota come “sindrome dei bambini farfalla” – che ha già salvato la vita a un bambino altrimenti destinato a morte certa, e della terapia cellulare di Holoclar, che rigenera l’epitelio corneale e ha già permesso a centinaia di pazienti europei di recuperare la vista.

Queste tecnologie sono state sviluppate dai professori Michele De Luca, anche co presidente dell’Associazione Luca Coscioni e Graziella Pellegrini, entrambi dell’Università di Modena e Reggio Emilia e portate ai pazienti attraverso Holostem, azienda fondata nel 2008 come eccellenza italiana nel campo delle terapie cellulari e geniche. Nel 2023, a seguito della decisione del socio privato di liquidare la società, il Governo autorizzò l’acquisizione da parte della Fondazione Enea Tech & Biomedical con l’obiettivo di garantire continuità alle attività.

A due anni dall’acquisizione, però, le sperimentazioni cliniche sull’Epidermolisi bollosa non sono ancora partite e la produzione di Holoclar è quasi ferma. Inoltre, inspiegabilmente i ricercatori che hanno sviluppato le terapie non risultano più coinvolti nei processi scientifici, nonostante la natura altamente specialistica delle tecnologie basate su cellule staminali epiteliali.

Questa situazione sta lasciando senza risposta sia i pazienti affetti da una malattia terribile, in alcune forme anche letale, sia coloro che potrebbero recuperare la vista grazie a un trattamento già approvato e utilizzato con successo per anni.

“Noi, persone con malattie rare, siamo chiamate ‘pazienti’ – racconta Alessandro Barneschi, 40 enne affetto da Epidermolisi bollosa sin dalla nascita e volto della campagna. “Ma l’Epidermolisi Bollosa non ha pazienza: non aspetta. Per noi, il tempo è fondamentale, perché il tempo della malattia non è quello della burocrazia. La malattia non è paziente: agisce, avanza, e non si ferma”.

Di fronte alla paralisi delle attività, l’Associazione Luca Coscioni, nella Giornata Mondiale dei Diritti Umani lancia un appello rivolto al Ministro delle Imprese e del Made in Italy, Adolfo Urso, per chiedere un intervento immediato che ristabilisca le condizioni necessarie alla ripresa delle terapie e delle sperimentazioni, garantendo l’utilizzo delle competenze scientifiche che hanno reso possibile lo sviluppo di queste terapie.

L’appello richiama anche una dichiarazione resa dal Ministro in Parlamento il 29 novembre 2023, quando sottolineò l’importanza di assicurare continuità a queste attività e di non lasciare senza risposte i pazienti coinvolti.

Il documento – che sarà da oggi sottoposto a ricercatori, pazienti, sostenitori della ricerca pubblica e a tutti i cittadini – chiede un’intervento urgente del Ministro Urso e del Governo, affinché terapie italiane già dimostrate efficaci possano tornare a essere disponibili.

L'articolo Le sperimentazioni sulle terapie avanzate sono ferme da due anni: pazienti in attesa e ricercatori esclusi proviene da Associazione Luca Coscioni.

A seguito della scoperta di exploit attivi, la Cybersecurity and Infrastructure Security Agency (CISA) ha inserito due vulnerabilità critiche al catalogo Known Exploited Vulnerabilities (KEV) dell’agenzia, il quale include vulnerabilità rilevate in software molto diffusi sfruttate attivamente.

La prima vulnerabilità, il CVE-2025-6218, riguarda il popolare strumento di compressione file WinRAR. Questa falla di path traversal ed è particolarmente pericolosa perché consente agli aggressori di aggirare i controlli di sicurezza e di installare malware nel sistema di un utente semplicemente chiedendogli di estrarre un file.

“Quando si estrae un file, le versioni precedenti di WinRAR, le versioni Windows di RAR, UnRAR, il codice sorgente portatile di UnRAR e UnRAR.dll possono essere ingannate e utilizzare un percorso definito in un archivio appositamente creato, invece del percorso specificato dall’utente”, si legge nel changelog.

La falla riguarda le versioni 7.11 e precedenti di WinRAR su Windows. Secondo il rapporto, la vulnerabilità consente ad archivi dannosi di indurre il software a estrarre “silenziosamente” i file in posizioni sensibili, come la cartella di avvio di Windows.

Nel luglio 2025, un autore di minacce noto come “zeroplayer” è stato visto vendere un exploit zero-day WinRAR sul forum del dark web Exploit.in per 80.000 dollari. Secondo gli esperti di sicurezza, il gruppo di hacker noto come Paper Werewolf (anche conosciuto come GOFFEE) avrebbe ottenuto questo exploit, che sarebbe stato utilizzato in recenti campagne di attacco sfruttando tale vulnerabilità.

La seconda vulnerabilità, il CVE-2025-62221 del quale abbiamo parlato questa mattina, colpisce il cuore del sistema operativo Windows. Si tratta di una falla di escalation dei privilegi localizzata nel driver Windows Cloud Files Mini Filter.

Sfruttando con successo questa falla, l’aggressore ottiene privilegi di SYSTEM, il livello di accesso più elevato su un computer Windows. Sebbene Microsoft non abbia rivelato i meccanismi specifici dell’exploit, la falla è stata attribuita al Microsoft Threat Intelligence Center (MSTIC).

Microsoft descrive il problema come una vulnerabilità “Use after free”. “La vulnerabilità Use after free nel driver Windows Cloud Files Mini Filter consente a un aggressore autorizzato di elevare i privilegi localmente”, spiega l’avviso.

Dato lo sfruttamento attivo di queste falle, il CISA ha fissato una scadenza rigorosa.

Le agenzie del Federal Civilian Executive Branch (FCEB) sono tenute a porre rimedio a queste vulnerabilità entro il 30 dicembre 2025, per proteggere le proprie reti da queste minacce in continua evoluzione.

L'articolo CISA avverte: bug critici in WinRAR e Windows aggiunti al KEV. Patch immediate necessarie proviene da Red Hot Cyber.

Sono state scoperte due estensioni dannose che infettano i computer degli sviluppatori con programmi stealer sul marketplace di Visual Studio Code di Microsoft. Il malware può acquisire screenshot, rubare password e wallet di criptovalute e persino dirottare le sessioni del browser.

I ricercatori di Koi Security hanno scoperto le estensioni dannose Bitcoin Black e Codo AI, che si mascherano da tema e assistente AI.

Entrambi i malware sono stati pubblicati con il nome dello sviluppatore BigBlack. Al momento della pubblicazione del rapporto dei ricercatori, Codo AI era ancora disponibile nello store, sebbene avesse meno di 30 download. Bitcoin Black aveva una sola installazione.

Secondo gli esperti, Bitcoin Black utilizza l’evento di attivazione “*”, che viene attivato da ogni azione in VSCode. Il plugin può anche eseguire codice PowerShell.

Nelle versioni precedenti, l’estensione utilizzava uno script di PowerShell per scaricare un archivio protetto da password contenente il payload. Tuttavia, ciò causava la visualizzazione di una finestra di PowerShell, che poteva allertare l’utente. Nelle versioni più recenti del malware, il processo è stato spostato in uno script batch (bat.sh), che richiama curl per scaricare un file DLL e un file eseguibile .exe, il tutto in modalità stealth.

Per quanto riguarda Codo AI, l’estensione può effettivamente aiutare l’utente con il codice utilizzando ChatGPT o DeepSeek, ma contiene anche un componente dannoso simile.

Entrambe le estensioni contengono un file eseguibile Lightshot legittimo e una DLL dannosa, che viene caricata tramite dirottamento della DLL e distribuisce un infostealer denominato runtime.exe sul sistema della vittima. Solo 29 dei 72 programmi antivirus su VirusTotal rilevano la DLL dannosa.

Sul computer infetto, il malware crea una directory in %APPDATA%Local e una cartella Evelyn per archiviare i dati rubati, tra cui informazioni sui processi in esecuzione, contenuti degli appunti, credenziali Wi-Fi, dati di sistema, screenshot, un elenco dei programmi installati e processi attivi.

Per rubare i cookie e dirottare le sessioni degli utenti, il malware avvia Chrome ed Edge in modalità headless, da dove recupera i cookie memorizzati e dirotta le sessioni.

Inoltre, lo stealer, nascondendosi nelle estensioni, ruba dati da portafogli di criptovalute come Phantom, Metamask ed Exodus e cerca anche password e altre credenziali.

I rappresentanti di Microsoft segnalano che entrambe le estensioni dannose sono state rimosse dal marketplace VSCode.

L'articolo Malware in Visual Studio Code: due estensioni dannose rubano dati sensibili proviene da Red Hot Cyber.

When the U.S. Navy quietly reactivated Roosevelt Roads Naval Station in Puerto Rico earlier this year, the move stirred both anxiety and hope. While some residents saw the promise of new jobs, others saw it as a painful reminder of past harms from the American military presence on the island.

Whatever their views, Puerto Ricans — and Americans everywhere — deserve basic answers about what the military is up to as tensions escalate with Venezuela. They should know whether Puerto Rico’s government is coordinating with the Pentagon and whether their concerns are being taken into account. And of course, there are countless local issues having nothing to do with international conflicts that Puerto Ricans are entitled to be informed about.

But at the very moment when transparency is most essential, Puerto Rican lawmakers are trying to slam the door shut. Senate Bill 63, a major rewrite of the island’s transparency law, was recently rushed through the legislature with little public input. It weakens the public’s right to know at every turn.

SB 63 would undermine transparency

Puerto Rico’s existing transparency law, passed in 2019, already faces serious problems. Recently, for instance, the American Civil Liberties Union of Puerto Rico sued to uncover records about how the territory’s transportation agency shared confidential driver’s license information with federal immigration officials, which may have violated local laws.

SB 63 would make it even harder for the public to know what government officials are doing. The bill significantly extends the deadline for responding to records requests, more than doubling it in some cases. For time-sensitive investigations, especially by journalists, these delays could bury relevant information or make it irrelevant or obsolete, crippling efforts to expose the truth.

This bill will also make it harder for the public to understand the information they do receive. Today, requesters can ask for information in easy-to-analyze formats, like statistics or spreadsheets. SB 63 would eliminate that right, making it harder to find specific information that’s of the most use to the public.

In addition, SB 63 would require agency heads to be alerted to every single records request. This change injects politics into what should be a straightforward process. At the federal level, both Democrats and Republicans have used similar review systems to conceal politically inconvenient information.

What’s more, SB 63 would also require agencies to withhold records that any judge has previously deemed confidential, even if that ruling came from a single lower court and was never reviewed or affirmed. But judges get things wrong all the time — that’s why their rulings are not precedential and are subject to appellate review. Under SB 63, a single questionable decision from a single judge could lock in secrecy indefinitely.

SB 63 would leave Puerto Ricans and all Americans less informed

Puerto Rican lawmakers seem to know SB 63 would be unpopular. The Senate approved it without a public hearing, and the House allowed just one day of testimony, during which many entities were shut out. It’s not an accident that an anti-transparency bill was pushed through with as little transparency as possible.

The timing couldn’t be worse — and not only because Puerto Rico seems to be one of the main platforms for U.S.-projected interventions in Venezuela. As Puerto Rico faces deep challenges in housing, education, and climate, reducing access to information will only exacerbate existing problems.

The need for local transparency is heightened exponentially by Puerto Rico’s colonialism. Public records are essential for understanding issues such as failures in hurricane relief by federal and local authorities, collaboration between local agencies and federal immigration officials, and the impact of federal policies on the territory’s schools and colleges.

In addition, cuts to federal Freedom of Information Act offices are already making it harder for Puerto Ricans to obtain information from Washington. If local transparency is also weakened, oversight and accountability will become virtually nonexistent.

Fortunately, Puerto Ricans refuse to be silent. More than 50 civil society organizations, along with community and academic leaders, have urged Gov. Jenniffer González Colón to veto SB 63 because the legislation is bad for Puerto Rico’s citizens, businesses, and democracy itself.

Freedom of the Press Foundation (FPF) also joined other press freedom organizations in a letter led by the Committee to Protect Journalists, calling on her to reject the bill.

Puerto Rico can’t afford to be left in the dark. SB 63 dims the light of transparency precisely when we need it the most. Gov. González should reject SB 63 and stand unequivocally with the people’s right to know.

freedom.press/issues/puerto-ri…