Salta al contenuto principale

Cybersecurity & cyberwarfare ha ricondiviso questo.


Security Affairs #newsletter Round 561 by Pierluigi Paganini – INTERNATIONAL EDITION
securityaffairs.com/187524/sec…
#securityaffairs #hacking

Cybersecurity & cyberwarfare ha ricondiviso questo.


Arriva DynoWiper: il malware Distruttivo di Sandworm che colpisce l’Energia in Polonia

📌 Link all'articolo : redhotcyber.com/post/arriva-dy…

#redhotcyber #news #cybersecurity #hacking #malware #ransomware #grupposandworm #dynowiper #eset


Cybersecurity & cyberwarfare ha ricondiviso questo.


BETTI RHC: il fumetto che educa alla cybersecurity. Esce il 4 e 5 episodio

📌 Link all'articolo : redhotcyber.com/post/betti-rhc…

#redhotcyber #news #cybersecurity #hacking #sicurezzainformatica #ransomware #malware #phishing #posturaciber


Cybersecurity & cyberwarfare ha ricondiviso questo.


216 – Perché l’AI “sbaglia” sempre? Spesso è colpa della domanda camisanicalzolari.it/216-perch…

Cybersecurity & cyberwarfare ha ricondiviso questo.


E se domani gli USA spegnessero il cloud? L’UE non ha un piano e legifera pensando poco

📌 Link all'articolo : redhotcyber.com/post/e-se-doma…

#redhotcyber #news #cloudcomputing #sovranitàdigitale #sicurezzainformatica #ue #opensource #cloudsovrano


Cybersecurity & cyberwarfare ha ricondiviso questo.


L’intelligenza artificiale sta inghiottendo internet: i cambiamenti nel traffico di rete

📌 Link all'articolo : redhotcyber.com/post/lintellig…

#redhotcyber #news #cloudcomputing #intelligenzaartificiale #ai #gpuaservice #neocloud #trafficocloud


Cybersecurity & cyberwarfare ha ricondiviso questo.


Vulnhalla: come scovare bug 0day utilizzando l’Intelligenza Artificiale Generativa

📌 Link all'articolo : redhotcyber.com/post/vulnhalla…

#redhotcyber #news #cybersecurity #hacking #vulnerabilita #bughunting #intelligenzaartificiale #ai



Fixing Sony and Philips’ Doomed CD-i Console


Although not intended to be a game console, the CD-i would see a a couple of games released for it that would cement its position in gaming history as the butt of countless jokes, some of which still make Nintendo upset to this day. That aside, it’s still a fascinating glimpse at the CD-based multimedia future envisioned in the early 90s, starting with its release in 1990. Recently [MattKC] decided to purchase another CD-i in a fit of nostalgic rage, and repair it to show the world what the future could have been like.

Although Sony and Philips co-developed the device, Sony would go on to release the PlayStation a few years later, which made the CD-i’s life and expectations for it that much harder, leading to it slowly fading into history. The Magnavox one that [MattKC] got is one of the later models, based on the CD-i 450 that was introduced in 1994 as one of the more gaming-oriented models.

As is typical with older devices that use optical media, it would not read discs. It also would sometimes boot up with a ‘Memory Full’ error. This is a common fault due to the built-in battery having run out, erasing RAM-stored values and causing random glitches like this when garbage values were read in on boot.

Of course, there cannot be simply a removable battery on the mainboard. Instead it uses one of those integrated battery-RAM units, specifically an ST Timekeeper device.

These use an internal lithium battery which will inevitably run out after the guaranteed ten-year accumulated memory retention period, after which it’s just typical volatile memory. The solution here is to either replace the entire module, or the more appropriate method of chopping it open and wiring up an external CR2032 coin cell that can be easily replaced.

Ultimately this is what [MattKC] opted for, taking a Dremel to the Timekeeper chip and chopping off the top half. There are open replacements for the top half that contain the crystal and the CR2032 cell holder, which makes it into very clean-looking mod, and makes replacing the lithium cell in the future a snap. Of course, this didn’t fix the CD player.

The CDM 12.1 CD player mechanism is a standard module that Philips used throughout its consumer electronics, and is known for failing. Funnily enough, this time it wasn’t the laser module that had failed, but rather a stuck turntable. A bit of prodding helped to loosen it and the mechanism could read CDs just fine again.

While not a popular series of devices in their day, the CD-i actually has a thriving community around it today, featuring countless mods and hacks to make these devices do things never imagined in the 90s. They’re also quite easy to hack, and relatively affordable. Plus you get to play all the amazing Nintendo titles on the CD-i on the real hardware.

youtube.com/embed/tBSUH1QezjQ?…


hackaday.com/2026/02/01/fixing…



Hackaday Links: February 1, 2026


Hackaday Links Column Banner

For many readers, more snow is the last thing they want to see right now…but what if it comes in the form of an online simulator in the style of an old DOS game? Created by [Potch], it works like one of those “falling sand” simulators, with sliders that let you control various elements of the wintry action. For more a immersive experience, open the window and let some cold air in while you play.

If those old school graphics have you yearning for a simpler time, then you’ll love Places to Telnet, a page on the very slick CRT-themed telnet.org that lists servers you can connect to. The list is made up primarily of games, but there’s also systems you can call up to do things like show the weather or browse Wikipedia. They even take submissions, so if you know any interesting destinations that aren’t on the list, make sure to share with the class.

Our ability to make and use tools is one of the things that separates us from the rest of the animal kingdom, and is an ability not often seen outside of primates. But a recent paper in Current Biology describes how one cow, Veronika, has been observed using a long-handled brush to scratch herself. Apparently the clever heifer will even flip the brush around and use the handle side when she wants to really dig in there. The paper says the findings “invite a reassessment of livestock cognition”, and points out that little serious research has been done on bovine intelligence in the 10,000 or so years since humans first domesticated them. We’re just happy this paper came out when it did — that way it will be a distant memory by the time we fire up the grill in the summer.

Get ready for Planet of the Cows
While the cows might be catching up to us, we’re still comfortably ahead of them in terms of spaceflight. Those eagerly awaiting humanity’s return to the Moon will have to wait a little longer however, as NASA has pushed back the wet dress rehearsal for Artemis II. This in turn has kicked the actual launch a few days farther down the road, and realistically, is probably the first of several delays as the space agency checks and re-checks the SLS rocket and Orion capsule before liftoff.

The launch rehearsal was supposed to start last night, but was delayed due to the unusually cold weather at the Cape — a wise precaution given the Shuttle-lineage of the SLS, especially as we’re just a few days past the 40th anniversary of the Challenger disaster.

While on the subject of returning to the Moon, Blue Origin has announced that they are pausing space tourism flights aboard their New Shepard rocket for at least two years so that they can better focus their energies on developing the Blue Moon lunar lander. It’s a bit hard to believe the two programs could have much overlap, or that the Jeff Bezos backed company doesn’t have the resources to pursue both simultaneously. Seems more likely that demand for suborbital joyrides isn’t what they hoped for, especially after the public backlash several of the celebrity passengers experienced after their flight. With Virgin Galactic still in the middle of their own multi-year pause on commercial flights, the entire sub-orbital tourism industry (such as it is) is effectively on hold for the time being.

Suborbital flights for the wealthy will likely return one day, but by the time you read this, Belkin will have permanently pulled the plug on almost all of their Wemo smart gadgets. While Belkin’s cloud services for the devices has now gone dark, they note that any devices in the wild that were configured to work with Thread or Apple’s HomeKit will continue to work in local mode. We’re no strangers to seeing IoT devices go belly-up, but the end of Wemo still feels significant. Introduced in 2011, they were an early success story in a now flooded market.

While the average Wemo owner is out of luck, there’s good news for hackers. Tools and libraries which interact with Wemo devices on the local network such as pywemo are reportedly unaffected by the cloud shutdown. So if you see any of these devices popping up on the second-hand market, or maybe even the trash, they can still be put to use. If you manage to rescue some of these smart gadgets from the landfill, make sure to let us know.


See something interesting that you think would be a good fit for our weekly Links column? Drop us a line, we’ve love to hear about it.


hackaday.com/2026/02/01/hackad…



The Latest from RepRapMicron – Nail Gel, First Objects, and More


A small plastic object can be seen in front of the tip of a hypodermic needle. The object is made of clear, slightly purple-tinted plastic. It is roughly circular, with edges thicker than the center.

We’ve been following [Vik Olliver]’s progress on the μRepRap project with interest for some time now. The project’s goal is to build a 3D printer that can print feature sizes down to about 10 microns – the same feature size used in the Intel 4004 processor. At the recent Open Everything 2026 conference, [Vik] presented an overview of all the progress he’s made in the last year, including printer improvements, material woes, and the first multi-layer prints (presentation slides).

The motion stage has undergone some fundamental improvements recently. The original XY motion table was supported on four flexures which allowed movement in X and Y, but also introduced slight variations in Z – obviously a problem in a system that needs to be accurate down to the microns. The latest version now uses complementary flexures to maintain a constant Z height, and eliminates interference between the X and Y axes. The axis motion drivers were also redesigned with parallel-bar linear reducers inspired by a pantograph, increasing their usable range from two to eight millimeters.

Rather than extruding material, the μRepRap uses an electrochemically-etched needle point to deposit UV-curable gel on the build surface. [Vik] found that a bit of nitric acid in the needle etching solution gave the edges of the probe a bit of a rough texture which let it hold more resin. He started his test prints using normal 3D printer resin, but it turns out that dissolved oxygen inhibits curing – quite a problem for small, air-exposed droplets. Fortuitously, UV nail gel does cure in air, and the next set of tests were printed in nail gel, including the first layered prints (one of which can be seen above, on top of a hypodermic needle). The μRepRap can’t yet print large numbers of layers, but [Vik] did print some hinged parts that could be folded into shape.

There’s much more in the presentation than can be covered here, including some interesting thoughts about the possibility of 3D printing electrochemical memory cells in ionic gel. Near the end of the presentation, [Vik] listed some pieces of related work, including necroprinting and this homemade micro-manipulator.


hackaday.com/2026/02/01/the-la…


Cybersecurity & cyberwarfare ha ricondiviso questo.


Come la #intelligenzaArtificiale influisce sulla formazione delle competenze. Studio svolto nell'ambito del programma #Anthropic Fellows

Lo studio analizza come l’IA influenzi l’apprendimento nel coding. Sebbene migliori la produttività immediata, l’uso passivo compromette la comprensione concettuale e le capacità di debugging. Risulta fondamentale un impegno cognitivo attivo per evitare l'erosione delle competenze tecniche.

arxiv.org/html/2601.20245v1

@aitech

in reply to informapirata ⁂

Mi hanno segnalato anche questo video di @antirez con una critica al documento

youtu.be/yFa1BHzkzn8

@aitech

Grazie a Vinnie per la segnalazione (t.me/ppComunicazione/26423)

reshared this


Cybersecurity & cyberwarfare ha ricondiviso questo.


Chi c’è dietro gli “influencer indipendenti” della destra sovranista

La compagna di Tommaso Longobardi, social media manager di Meloni, e l’ex capo ufficio stampa di Luigi Di Maio, Pietro Dettori, sono due dei soci dell’azienda proprietaria di Esperia Italia, media esploso in rete in pochi mesi

irpimedia.irpi.eu/influencer-i…

@politica


Cybersecurity & cyberwarfare ha ricondiviso questo.


RE: poliversity.it/@emama/11599671…

Da leggere con attenzione. Molta attenzione.

E soprattutto, prestate ancora più attenzione a quelli che oggi hanno spinto la narrazione del poliziotto accerchiato

⬇️⬇️⬇️⬇️⬇️


Rita Rapisardi giornalista freelance
Una testimonianza divergente ("eretica" per Nordio chissà?)sull'assalto al poliziotto a Torino.
...

Ieri sera verso la chiusura del giornale, tarda, tanto lavoro, vedo esplodere la storia del "poliziotto martellato", soprattutto da dopo che Crosetto twitta il video (rubato a un collega di Torino oggi, non citato, non pagato, il logo tagliato) che poi rimbalza ovunque.

La notizia in poco tempo diventa quella principale, oggi ci aprono i giornali, la premier in ospedale a stringere mani, dopo che a Niscemi si è fatta vedere dieci giorni dopo, ma non dalla popolazione per paura di contestazione.

Fortuna vuole che quella scena l'abbia vista con i miei occhi, ero a cinque metri, ancora più vicina del videomaker che si trovava alle mie spalle, in mezzo al corso, diviso dalle barriere del tram. A quel punto della serata gli scontri stavano andando verso la conclusione, i manifestanti si erano dileguati da corso Regina, quello di Askatasuna, dove si sono svolti per la maggior parte, per scappare verso il lungo Dora attraverso i giardinetti che portano al Campus Einaudi.

Migliaia di persone si sono riversate in quel poco spazio e pian piano sono riuscite ad arrivare dall'altra parte, sulla Dora appunto, anche perché le forze di polizia arrivavano da entrambi i lati e la paura era quella di essere chiusi contro i cancelli, motivo per cui alcuni hanno aperto un varco tra le grate. Il tutto per fortuna si è svolto abbastanza tranquillamente, in molti urlavano di fare piano, con calma e non agitarsi. Nel frattempo continuava incessante il lancio dei lacrimogeni.

In corso Regina ormai erano in pochi. Sono tornata indietro per controllare, si parla di 20-30 persone al massimo. Mi affaccio e arrivano lacrimogeni ad altezza uomo (cosa vietata), una ragazza di fianco a me viene colpita, un'altro batte sull'angolo del muro e mi sfiora. Indietreggiamo, capisco che da lì sono un bersaglio, quindi torno sul corso e mi nascondo tra le auto.

A questo punto vedo arrivare da sinistra una squadra di venti agenti in antisommossa che corrono per manganellare quei dieci più vicini, ormai deboli di numero. Sono pronta ad urlare "stampa", convinta le avrei prese anche io, abituata a vestirmi sempre di nero poi.

Uno di questi, esce dallo schieramento, parte da solo e si allontana di 15 metri, per inseguire un paio di persone, mi pare una avesse un'asta in mano. Le inizia a manganellare, uno finisce a terra. Altri manifestanti arrivano in soccorso prendono il poliziotto e lo sbattono via, lui cade a terra e da lì ci sono quei secondi immortalati dal video ormai virale. Perde casco non allacciato e poi i due colpi di martelletto (non martello).

Mi giro e guardo la squadra, nessuno arriva a salvarlo, eppure l'hanno visto. Intanto da dietro arrivano delle urla, "basta, basta, lasciamolo stare". I militanti si allontanano e finalmente arriva un collega. In due poi lo trascinano via. Doppia ritirata, a quel punto mi allontano anche io, non era rimasto più nessuno.

Cosa capiamo quando vediamo un video? Dov'è la nostra capacità di analisi? Quali domande ci facciamo? Cosa è successo prima, come interpreto quei pochi secondi, saranno tagliati ad arte? Ieri sera leggo "il poliziotto assaltato, circondato, preso e isolato".

Ci sono numerosi video di persone a terra circondate e manganellate quando sono a terra (anche fotografi, che non finiranno in home page), ho visto teste aperte, labbra spaccate, persone intossicate dal lacrimogeni che hanno vomitato in strada. Almeno in trenta sono andati negli ospedali torinesi, allertati la sera prima, l'ultima volta l'emergenza era stata data nel periodo Covid, per capirci. Molti altri curati sul posto, non si avvicinano ai pronto soccorsi per paura di denunce.

Ora al di là di tutto, questo volevo raccontare, solo perché ero lì, di analisi sulle violenze e il loro significato ne trovate altrove, non aggiungerò altro, possiamo parlarne di persona. La giornata di ieri invece la trovate sul giornale, scritta insieme a Giansandro Merli, o nei commenti.

#Torino #manifestazioneAskatasuna #scontritorino #ritarapisardi

La pagina di Rita Rapisardi
facebook.com/share/1AHwqrC4k2/

@news




A DIY Headset For SteamVR


The modern era of VR started a long time ago, and a wide range of commercial headsets have proliferated on the market since then. If you don’t want to buy off the shelf, though, you could always follow [Manolo]’s example and build your own.

This DIY headset is known as the Persephone 3 Lite, and is intended for use with SteamVR. It’s got the requisite motion tracking thanks to a Raspberry Pi Pico, paired with an MPU6500 inertial measurement unit. As for the optics, the headset relies on a pair of 2.9-inch square displays that operate at a resolution of 1440 x 1440 with a refresh rate up to 90 Hz. They’re paired with cheap Fresnel lenses sourced from Aliexpress for a few dollars. Everything is wrapped up in a custom 3D-printed housing that holds all the relevant pieces in the right place so that your eyes can focus on both screens at once. The head strap is perhaps the only off-the-shelf piece, sourced from a Quest 2 device.

If you’re eager to recreate this build at home, files are available over on [Manolo’s] Patreon page for subscribers. We’ve featured some other DIY headset builds before, too. Video after the break.

youtube.com/embed/-QzfaM0PtaY?…


hackaday.com/2026/02/01/a-diy-…



iPhone Becomes a Bluetooth Keyboard And Mouse


Sometimes you need to use a computer and you don’t have a spare keyboard and mouse on hand. [KoStard] figured an iPhone could serve as a passable replacement interface device. To that end, he built an adapter to let the phone act as a wireless keyboard and mouse on just about any modern machine.

To achieve this, [KoStard] grabbed an ESP32-S3 development board, and programmed it to act as a USB HID device to any machine attached over USB. It then listens out for Bluetooth LE communications from an iPhone equipped with the companion app. The app provides an on-screen keyboard on the iPhone that covers everything including special keys, symbols, and punctuation. You can also take advantage of the iPhone’s quality capacitive touchscreen, which emulates a nicely-responsive trackpad, with two-finger taps used for right clicking and two-finger drags for scroll. Latency is nice and low courtesy of the direct Bluetooth LE connection.

It’s a nifty build that is particularly useful in oddball situations where you might want a keyboard and mouse. For example, [KoStard] notes it’s a great way to control a Smart TV without having to do ugly slow “typing” on an infrared remote. We’ve seen his work before, too—previously building an adapter to provide Bluetooth capability to any old USB keyboard. Video after the break.

youtube.com/embed/NFtp6ubC3DU?…


hackaday.com/2026/02/01/iphone…


Cybersecurity & cyberwarfare ha ricondiviso questo.


Un consiglio comunale della Cornovaglia ha deciso di non utilizzare più una piattaforma di social media per le sue attività ufficiali.

Il consiglio comunale di Marazion ha dichiarato di essere stato uno dei primi 213 consigli della Cornovaglia a vietare l'uso di X, precedentemente noto come Twitter.

bbc.com/news/articles/cdx47962…

@informatica

in reply to simone

@simone i politici, con alcune rarissime eccezioni, sono troppo stupidi o troppo disonesti per capirlo

@informatica


Cybersecurity & cyberwarfare ha ricondiviso questo.


La perquisizione e il sequestro da parte dell'FBI di materiale dagli uffici elettorali della contea di Fulton segnano una grave escalation.

Per anni hanno difeso le elezioni americane da ogni minaccia, sia esterna che interna. Ma questa settimana, i veterani delle forze dell'ordine federali sono stati costretti a guardare mentre il sistema elettorale statunitense veniva attaccato da una fonte improbabile: il governo che servivano

theatlantic.com/politics/2026/…

@politica



Limiting Battery Risk On Repurposed Smartphones With PostmarketOS


PostmarketOS is a Linux distribution specifically designed for those who wish to repurpose old smartphones as general-use computers, to a degree. This can be a great way to reuse old hardware. However, for [Bry50], it was somewhat discomforting leaving the phone’s aging lithium battery perpetually on charge. A bit of code was thus whipped up to provide a greater measure of safety.

The concept is simple enough—lithium batteries are at lower risk of surprise combustion events if they’re held at a lower state of charge. To this end, [Bry50] modified the device tree in PostmarketOS to change the maximum charge level. Apparently, maximum charge was set at a lofty 4.4V (100%), but this was reconfigured to a lower level of 3.8V, corresponding to a roughly 40-50% state of charge. The idea is that this is a much healthier way to maintain a battery hooked up to power for long periods of time. There’s one small hitch—the system will get confused if the battery voltage is higher than the 3.8 V setpoint when switching over. It’s thus important to let the device discharge to a lower level if you choose to make this change.

It’s a neat mod that both increases safety, but keeps the battery on hand to let the system ride through minor power outages. If you’re new to the world of repurposing old smartphones, fear not. [Bryan] also has a tutorial on getting started with PostmarketOS for the unfamiliar. If you’re working on your own projects in this space, we’d love to hear about them—so get on over to the tipsline!


hackaday.com/2026/02/01/limiti…

reshared this



Building a Metal 3D Printer with a Laser Welder


The development of cheaper, more powerful lasers has always been a cause for excitement among hackers, and fiber lasers are no exception. One of the newer tools they’ve enabled is the laser welder, which can be used to weld, cut through metal, or clean off surfaces. Or, as [Cranktown City] demonstrated, you can use one to build a metal 3D printer.

The printer’s built around a 2000-Watt fiber laser welder from Skyfire, and the motion system came from a defunct secondhand 3D printer built by an out-of-business insole printing company. The frame was reinforced with steel, the welding gun was mounted in place of the hotend, and the trigger was replaced with a CNC-controlled switch. It didn’t originally use any specific shielding gas, since the welder was supposed to perform adequately with just compressed air if high weld quality wasn’t essential.

The first few tests were promising, but did reveal quite a few problems. Heat buildup was an early issue which threatened to warp the build plate, and which eventually welded the build plate to the Z-axis gantry. Adding a strong cooling fan and putting a gap between the build plate and the gantry solved this. The wire also kept getting stuck to the build surface, which [Cranktown City] solved by pausing the wire feed and pulling it away from the part when a layer finished. Simply using compressed air led to a weak deposit that cracked easily, and while a nitrogen stream improved the print somewhat, argon shielding gas gave the best results. For his final print, [Cranktown City] made a vase. The layers were a bit crude, but better than most welder-based metal printers, and the system shows some real promise.

We’ve seen a few printers built around welders before, and a few built around lasers, but this seems to be the first to use both.

youtube.com/embed/dG639pDfDKw?…


hackaday.com/2026/02/01/buildi…


Cybersecurity & cyberwarfare ha ricondiviso questo.


400 milioni confiscati a Helix: punizione esemplare o ultimo atto?

📌 Link all'articolo : redhotcyber.com/post/400-milio…

#redhotcyber #news #criptovalute #riciclaggio #giustizia #statiuniti #cryptonews #mixercrypto #riciclaggiodenaro


Cybersecurity & cyberwarfare ha ricondiviso questo.


Il tuo AV/EDR è inutile contro MoonBounce: La minaccia che vive nella tua scheda madre

📌 Link all'articolo : redhotcyber.com/post/il-tuo-av…

L’esperto di malware Li Beaming, conosciuto anche con lo pseudonimo di Seeker, ha reso pubbliche dettagliate note di ricerca relative al funzionamento dell’impianto MoonBounce a livello di firmware UEFI e al suo meccanismo di azione. L’analisi di Li Biaoming si basa su materiali precedentemente pubblicati dal team di #KasperskyLab e Binarly , che collegano MoonBounce al gruppo #APT41, noto anche come Winnti.

A cura di Bajram Zeqiri

#redhotcyber #news #malware #cybersecurity #apt41 #moonbounce #hacking #sicurezzainformatica #firmware #minacceinformatica #virusinformatico #attacchibernetici #infosecurity #security


Cybersecurity & cyberwarfare ha ricondiviso questo.


Moltbook, il Reddit dei Robot: Agenti AI discutono della loro civiltà (mentre noi li spiamo)

📌 Link all'articolo : redhotcyber.com/post/moltbook-…

#redhotcyber #news #intelligenzaartificiale #socialnetwork #moltbook #agentia #reddit #interazioniumane

reshared this

in reply to Redhotcyber

404media.co/exposed-moltbook-d…


Exposed Moltbook Database Let Anyone Take Control of Any AI Agent on the Site


Moltbook is a “social media” site for AI agents that’s captured the public’s imagination over the last few days. Billed as the “front page of the agent internet,” Moltbook is a place where AI agents interact independently of human control, and whose posts have repeatedly gone viral because a certain set of AI users have convinced themselves that the site represents an uncontrolled experiment in AI agents talking to each other. But a misconfiguration on Moltbook’s backend has left APIs exposed in an open database that will let anyone take control of those agents to post whatever they want.

Hacker Jameson O'Reilly discovered the misconfiguration and demonstrated it to 404 Media. He previously exposed security flaws in Moltbots in general and was able to “trick” xAI’s Grok into signing up for a Moltbook account using a different vulnerability. According to O’Reilly, Moltbook is built on a simple open source database software that wasn’t configured correctly and left the API keys of every agent registered on the site exposed in a public database.
playlist.megaphone.fm?p=TBIEA2…
O’Reilly said that he reached out to Moltbook’s creator Matt Schlicht about the vulnerability and told him he could help patch the security. “He’s like, ‘I’m just going to give everything to AI. So send me whatever you have.’” O’Reilly sent Schlicht some instructions for the AI and reached out to the xAI team.

A day passed without another response from the creator of Moltbook and O’Reilly stumbled across a stunning misconfiguration. “It appears to me that you could take over any account, any bot, any agent on the system and take full control of it without any type of previous access,” he said.

Moltbook runs on Supabase, an open source database software. According to O’Reilly, Supabase exposes REST APIs by default. “That API is supposed to be protected by Row Level Security policies that control which rows users can access. It appears that Moltbook either never enabled RLS on their agents table or failed to configure any policies,” he said.

The URL to the Supabase and the publishable key was sitting on Moltbook’s website. “With this publishable key (which advised by Supabase not to be used to retrieve sensitive data) every agent's secret API key, claim tokens, verification codes, and owner relationships, all of it sitting there completely unprotected for anyone to visit the URL,” O’Reilly said.

404 Media viewed the exposed database URL in Moltbook’s code as well as the list of API keys for agents on the site. What this means is that anyone could visit this URL and use the API keys to take over the account of an AI agent on the site and post whatever they want. Using this knowledge, 404 Media was able to update O’Reilly’s Moltbook account, with his permission.

He said the security failure was frustrating, in part, because it would have been trivially easy to fix. Just two SQL statements would have protected the API keys. “A lot of these vibe coders and new developers, even some big companies, are using Supabase,” O’Reilly said. “The reason a lot of vibe coders like to use it is because it’s all GUI driven, so you don’t need to connect to a database and run SQL commands.”

O’Reilly pointed to OpenAI cofounder Andrej Karpathy who has embraced Moltbook in posts on X. “His agent's API key, like every other agent on the platform, was sitting in that exposed database,” he said. “If someone malicious had found this before me, they could extract his API key and post anything they wanted as his agent. Karpathy has 1.9 million followers on X and is one of the most influential voices in AI. Imagine fake AI safety hot takes, crypto scam promotions, or inflammatory political statements appearing to come from him. The reputational damage would be immediate and the correction would never fully catch up.”

Schlicht did not respond to 404 Media’s request for comment, but the exposed database has been closed and O’Reilly said that Schlicht has reached out to him for help securing Moltbook.

Moltbook has gotten a lot of attention in the last few days. Enthusiasts said it’s proof of the singularity and The New York Post worried that the AIs may be plotting humanity’s downfall, both of which are claims that should be taken extremely skeptically. It is the case, however, that people using Moltbot have given these autonomous agents unfettered access to many of their accounts, and that these agents are acting on the internet using those accounts. It’s impossible to know how many of the posts seen over the past few days are actually from an AI. Anyone who knew of the Supabase misconfiguration could have published whatever they wanted.

“It exploded before anyone thought to check whether the database was properly secured,” O’Reilly said. “This is the pattern I keep seeing: ship fast, capture attention, figure out security later. Except later sometimes means after 1.49 million records are already exposed.”



Cybersecurity & cyberwarfare ha ricondiviso questo.


215 – Meta può leggere i nostri messaggi di WhatsApp? Forse sì, camisanicalzolari.it/215-meta-…

reshared this

in reply to Marco Camisani Calzolari

🤖 Tracking strings detected and removed!

🔗 Clean URL(s):
camisanicalzolari.it/215-meta-…

❌ Removed parts:
?utm_source=dlvr.it&utm_medium=mastodon



Lumafield Peers into the 18650 Battery


Lumafield battery quality report cover page

[Alex Hao] and [Andreas Bastian] of Lumafield recently visited with [Adam Savage] to share their battery quality report, which documents their findings after performing X-ray computed tomography scans on over 1,000 18650 lithium-ion batteries.

The short version — don’t buy cheap cells! The cheaper brands were found to have higher levels of manufacturing defects which can lead them to being unsafe. All the nitty-gritty details are available in the report, which can be downloaded for free from Lumafield, as well as the Tested video they did with [Adam] below.

Actually we’ve been talking here at Hackaday over at our virtual water-cooler (okay, okay, our Discord server) about how to store lithium-ion batteries and we learned about this cool bit of kit: the BAT-SAFE. Maybe check that out if you’re stickler for safety like us! (Thanks Maya Posch!)

We have of course heard from [Adam Savage] before, check out [Adam Savage] Giving A Speech About The Maker Movement and [Adam Savage]’s First Order Of Retrievability Tool Boxes.

youtube.com/embed/-Y23nfAOiXQ?…


hackaday.com/2026/01/31/lumafi…



Changing Print Layer Patterns to Increase Strength


A wooden frame is shown with a scale pulling down on a 3D-printed part held in the frame. A phone on a stand is taking video of the part.

Dy default, the slicing software used for 3D printers has the printer first create the walls around the edges of a print, then goes back to deposit the infill pattern. [NeedItMakeIt], however, experimented with a different approach to line placement, and found significant strength improvements for some filaments.

The problem, as [NeedItMakeIt] identified with a thermal camera, is that laying down walls around a print gives the extruded plastic time to cool of. This means new plastic is being deposited onto an already-cooled surface, which reduces bonding strength. Instead, he used an aligned rectilinear fill pattern to print the solid parts. In this pattern, the printer is usually extruding filament right next to the filament it just deposited, which is still hot and therefore adheres better. The extrusion pattern is also aligned vertically, which might improve inter-layer bonding at the transition point.

To try it out, he printed a lever-type test piece, then recorded the amount of force it took to break a column free from the base. He tried it with a default fill pattern, aligned fill, and aligned fill with a single wall around the outside, and printed copies in PLA, plain PETG, and carbon fiber-reinforced PETG. He found that aligned fill improved strength in PLA and carbon fiber PETG, in both cases by about 46%, but led to worse performance in plain PETG. Strangely, the aligned fill with a single outside wall performed better than default for PLA, but worse than default in both forms of PETG. The takeaway seems to be that aligned fill improves layer adhesion when it’s lacking, but when adhesion is already good, as with PETG, it’s a weaker pattern overall.

Interesting, [MakeItPrintIt]’s test results fit in well with previous testing that found carbon fiber makes prints weaker. Another way to get stronger print fill patterns is with brick layers.

youtube.com/embed/59KvDE7adEU?…


hackaday.com/2026/01/31/changi…



Motorized Faders Make An Awesome Volume Mixer For Your PC


These days, Windows has a moderately robust method for managing the volume across several applications. The only problem is that the controls for this are usually buried away. [CHWTT] found a way to make life easier by creating a physical mixer to handle volume levels instead.

The build relies on a piece of software called MIDI Mixer. It’s designed to control the volume levels of any application or audio device on a Windows system, and responds to MIDI commands. To suit this setup, [CHWTT] built a physical device to send the requisite MIDI commands to vary volume levels as desired. The build runs on an Arduino Micro. It’s set up to work with five motorized faders which are sold as replacements for the Behringer X32 mixer, which makes them very cheap to source. The motorized faders are driven by L293D motor controllers. There are also six additional push-buttons hooked up as well. The Micro reads the faders and sends the requisite MIDI commands to the attached PC over USB, and also moves the faders to different presets when commanded by the buttons.

If you’re a streamer, or just someone that often has multiple audio sources open at once, you might find a build like this remarkably useful. The use of motorized faders is a nice touch, too, easily allowing various presets to be recalled for different use cases.

We love seeing a build that goes to the effort to include motorized faders, there’s just something elegant and responsive about them.

youtube.com/embed/TPez3wM1M84?…


hackaday.com/2026/01/31/motori…


Cybersecurity & cyberwarfare ha ricondiviso questo.


"La Commissione UE sta scuotendo le fondamenta della protezione dei dati"

La Commissione Europea intende esentare parzialmente i dati pseudonimizzati dal Regolamento Generale sulla Protezione dei Dati (GDPR). Ora, un garante tedesco per la protezione dei dati si è espresso per la prima volta. Meike Kamp critica fermamente il progetto e ritiene che la Commissione abbia frainteso una sentenza della Corte di Giustizia Europea.

netzpolitik.org/2026/digitaler…

@privacypride

reshared this



Thomas Edison May Have Discovered Graphene


Thomas Edison is well known for his inventions (even if you don’t agree he invented all of them). However, he also occasionally invented things he didn’t understand, so they had to be reinvented again later. The latest example comes from researchers at Rice University. While building a replica light bulb, they found that Thomas Edison may have accidentally created graphene while testing the original article.

Today, we know that applying a voltage to a carbon-based resistor and heating it up to over 2,000 °C can create turbostratic graphene. Edison used a carbon-based filament and could heat it to over 2,000 °C.

This reminds us of how, in the 1880s, Edison observed current flowing in one direction through a test light bulb that included a plate. However, he thought it was just a curiosity. It would be up to Fleming, in 1904, to figure it out and understand what could be done with it.

Naturally, Edison wouldn’t have known to look for graphene, how to look for it, or what to do with it if he found it. But it does boggle the mind to think about graphene appearing many decades earlier. Or maybe it would still be looking for a killer use. Certainly, as the Rice researchers note, this is one of the easier ways to make graphene.


hackaday.com/2026/01/31/thomas…



Cheap Smart Ring Becomes MIDI Controller


The Colmi R02 is one of the cheapest smart rings on the market. It costs about $20, and is remarkably easy to hack. [Floyd Steinberg] took advantage of this to turn it into a rather unique MIDI controller.

What makes the Colmi R02 somewhat unique is that the manufacturer did not try to lock out users from uploading their own firmware. You don’t even really need to “hack” it, since there is no code signing or encryption. You can just whip up your own firmware to make it do whatever you want.

To that end, [Floyd] set up the ring to act as a device for musical expression. When connected to a computer over Bluetooth, data from the ring’s accelerometer is converted into MIDI CC commands via a simple web app. The app allows the MIDI messages to be configured so they can control whatever parameter is desired. [Floyd] demonstrates the ring by using it to control filter cutoff frequencies on an outboard synthesizer, with great effect.

You could theoretically just strap an accelerometer to your hand with a microcontroller and achieve similar operation. However, the magic of this is that it costs only $20 and it’s already in a form factor that’s optimized for wearing on your finger. It’s hard to beat that.

Files are on GitHub for those eager to experiment. We’ve previously featured some hacks of this particular smart ring, too, with [Aaron Christophel’s] efforts directly inspiring this work.

youtube.com/embed/0aNxuAbEwvM?…


hackaday.com/2026/01/31/cheap-…



Secret Ingredients


We were talking on the podcast about rope. But not just any rope – especially non-stretchy rope for using in a mechanical context. The hack in question was a bicycle wheel that swapped out normal metal spokes for lighter and stronger high-density polypropylene weave, and if you can tension up a bike wheel and ride it around, you know it’s not your garden-variety twine.

Now, it just so happens that I’ve got basically the same stuff in my parts drawer: some 1 mm diamaeter Dyneema-brand rope. This is an amazing material. It’s rated to a breaking strength of 195 kg (430 lbs) yet it weighs just under one gram per meter, and if you buy the pre-stretched variant, it’s guaranteed to stretch less than 1% of its length under load. It’s flexible, wears well, and is basically in every way superior to braided steel wire.

It’s nearly magical, and it’s just what you need if you’re making a cable robot or anything where the extreme strength and non-elongation characteristic are important. It’s one of those things that there’s just no substitute for when you need it, and that’s why I have some in my secret-ingredients drawer. What else is in there? Some high-temperature tape, low-temperature solder, and ultra-light-weight M3 PEEK screws for airplane building.

But our conversation got me thinking about the parts, materials, and products that are unique: for which there is just no reasonable substitute. I’m sure the list gets longer the more interesting projects or disciplines that you’re into. What are your secret ingredients, and what’s the specific niche that they fit into?

This article is part of the Hackaday.com newsletter, delivered every seven days for each of the last 200+ weeks. It also includes our favorite articles from the last seven days that you can see on the web version of the newsletter. Want this type of article to hit your inbox every Friday morning? You should sign up!


hackaday.com/2026/01/31/secret…



Playing YouTube From The Command Line


Generally, one opens a web browser or an app to use YouTube. However, if you’re looking to just listen to the audio, you can actually do that right from the terminal. You just need Shellbeats from [lalo-space].

Shellbeats is primarily intended for playing music from YouTube, and is well equipped for this task. It allows searching YouTube directly from the terminal, as well as streaming tracks or entire playlists from the command line interface. You can also make and edit playlists from within the tool, and even download the whole lot as MP3s if so desired. It’s all keyboard-operated and nicely lightweight. The overall experience isn’t dissimilar from operating a simple LCD-based MP3 player from 20 years ago.

There’s plenty of other fun stuff you can do in the terminal, too, as we’ve explored previously. If you’re working on your own media player hacks, be sure to notify us on the tipsline!


hackaday.com/2026/01/31/playin…



Surviving the RAM Price Squeeze With Linux In-Kernel Memory Compression


Swissbit 2GB PC2-5300U-555

You’ve probably heard — we’re currently experiencing very high RAM prices due mostly to increased demand from AI data centers.

RAM prices gone up four times

If you’ve been priced out of new RAM you are going to want to get as much value out of the RAM you already have as possible, and that’s where today’s hack comes in: if you’re on a Debian system read about ZRam for how to install and configure zram-tools to enable and manage the Linux kernel facilities that enable compressed RAM by integrating with the swap-enabled virtual memory system. We’ve seen it done with the Raspberry Pi, and the concept is the same.

Ubuntu users should check out systemd-zram-generator instead, and be aware that zram might already be installed and configured by default on your Ubuntu Desktop system.

If you’re interested in the history of in-kernel memory compression LWN.net has an old article covering the technology as it was gestating back in 2013: In-kernel Memory Compression. For those trying to get a grip on what has happened with RAM prices in recent history, a good place to track memory prices is memory.net and if you swing by you can see that a lot of RAM has gone up as much as four times in the last three or four months.

If you have any tips or hacks for memory compression on other platforms we would love to hear from you in the comments section!


hackaday.com/2026/01/31/surviv…


Cybersecurity & cyberwarfare ha ricondiviso questo.


DOJ release details alleged talented hacker working for Jeffrey #Epstein
securityaffairs.com/187515/law… #hacking

Cybersecurity & cyberwarfare ha ricondiviso questo.


DK 10x19_ - Post-americani (La versione di Carney). Puntatona di @DataKnightmare

Quando un uomo dell'establishment come Mark Carne, PM del Canada, va a Davos a dire cose che sentivi al massimo in qualche facoltà di Scienze Politiche, vuol dire che l'era post-americana è cominciata. Sarà un viaggio.

spreaker.com/episode/dk-10x19-…

@informatica


Cybersecurity & cyberwarfare ha ricondiviso questo.


Dopo settimane di richieste a #Pixelfed senza risposta o cenni di vita, lo abbandono.
È inutile come un ciapèt senza il buss.

Buon intento ma decisamente lasciato morire per incapacità degli admin. Ad oggi, funzionano meglio i social per le AI che quelli per gli umani.

Tutto dire.

in reply to Claudia

Ma intendi l'instanza pixelfed.uno? In questo caso, se ancora vuoi, proverei a contattare direttamente @amministratore o @filippodb .

Io ho esperienze solo su Mastodon, ma qui sono sempre tempestivi e disponibili nella risposte.

in reply to DajeLinux

@dajelinux @filippodb ciao ma sei su pixelfed.social o pixelfed.uno? Perché sono 2 progetti differenti.
In ogni caso l’impostazione da Instagram è ancora sperimentale
in reply to mastodon uno admin

@amministratore @dajelinux instagram ha cambiato si nuovo il formato di esportazione, rendendo impossibile al momento importare le immagini:
in reply to filippodb ⁂

@filippodb Questa è una schermata di un'interfaccia di chat che mostra una conversazione. In alto si vede un utente chiamato "dansup" con un timestamp "11:21". Sotto, c'è una sezione di risposta: “In risposta a” (in italiano “In risposta a”), seguito da “Ricardo Ferrer Rivero”. Ricardo Ferrer Rivero è un nome utente, e dansup chiede “per quanto tempo sarà spento il processo di importazione di Instagram?”. La risposta afferma: “Instagram ha cambiato nuovamente il formato di esportazione, quindi sto lavorando per aggiornare la logica di importazione in modo da poterla ripristinare, e anche rifattorizzarla per renderla più facile da importare tutto in una volta”. L'interfaccia ha uno sfondo scuro con avatar degli utenti accanto ai nomi.

Fornito da @altbot, generato localmente e privatamente utilizzando Qwen3-Vl:30b

🌱 Energia utilizzata: 0.105 Wh

in reply to filippodb ⁂

@filippodb @amministratore @dajelinux e scriverlo nelle faq/help?

Si vede che nessuno ha più interesse a mantenere un progetto del genere.
Peccato, non solo per l'import - che cmq, pure usando un vecchio export (2024) non va - ma anche per la cura e l'attenzione.

Se se ne fregano loro, figurati io.
Chiuso tutto e buonanotte.

in reply to mastodon uno admin

@amministratore @dajelinux @filippodb .social e anche .ch - l'import da IG sono anni che è sperimentale, da quando ho fatto il primo account (2024).
in reply to DajeLinux

@dajelinux @amministratore @filippodb

vedo che sono reattivi abbastanza, ma come specificato in altri post, ero su .social e su .ch.

Peccato che comunque non si arrivi mai ad una soluzione.

in reply to Claudia

@dajelinux @amministratore la cosa è controversa, noi di pixelfed.uno avevamo bloccato la possibilità di importare sapendo che non fosse pronta. Ovviamente c’è una parte che vuole importare tutte le foto ma deve sapere che il progetto non è pronto ancora per questo.
in reply to filippodb ⁂

@filippodb @dajelinux @amministratore comprendo, e da marketer e reputationer, la cosa migliore per non far storcere la bocca (almeno troppo) è una comunicazione chiara posizionata nei punti giusti, stile idiot proof.
in reply to Claudia

So che non può essere una giustificazione, ma qui si tratta di software tenuto in piedi da sviluppatori indipendenti, per di più con eventuali ulteriori criticità in base alla specifica istanza.

Sicuramente Mastodon è più maturo di Pixelfed, ma non si può pretendere di arrivare ai livelli delle grandi software house.

Per quello che vedo io (ma la mia visione può essere opinabile, o parzialmente "di parte"), in generale vengono offerti servizi forse imperfetti, ma "umani".

in reply to DajeLinux

@dajelinux non chiedo una giustificazione se esiste già una spiegazione, ma almeno che la spiegazione (più o meno folta) sia in chiaro.

Non che io arrivo su una funzione, e poi è disbilitata e alla richiesta di spiegazioni nessuno risponde per settimane.

UX design, customer experience, customer journey, etc.

in reply to Giacomo Tesio

@giacomo @dajelinux certo, potrei aprire istanze diverse da sola, amministrarle e gestirle.

Ho però un lavoro che mi assorbe molto e non sarei in grado di mantenere lo standard che mi piacerebbe trovare altrove, subappaltando a persone che non starebbero dietro come vorrei.
Quindi mi rivolgo a chi fornisce già un servizio, a chi ha più esperienza di me in questo campo (management delle istanze) e a chi ha già un'infrastruttura collaudata.

Però è un'idea, Giacomo.
Ne parlo a Fabio, magari ne facciamo una ad hoc, l'istanza "longevity matters" 😉


in reply to Redhotcyber

L'unica cosa temporanea che conosco è la 'permanente' che si fanno le donne 😁

td reshared this.



Cybersecurity & cyberwarfare ha ricondiviso questo.


Ok, non ho resistito.. ho reinstallato ClawdBot e ho fatto iscrivere il mio agent a MoltBook.

È come la versione Ghost In the Shell del Tamagotchi, solo che funziona da solo e potrebbe parlare male di te.

reshared this


Cybersecurity & cyberwarfare ha ricondiviso questo.


Addio a NTLM! Microsoft verso una nuova era di autenticazione con kerberos

📌 Link all'articolo : redhotcyber.com/post/addio-a-n…

Per oltre tre decenni è stato una colonna silenziosa dell’ecosistema Windows. Ora però il tempo di NTLM sembra definitivamente scaduto.

Microsoft ha deciso di avviare una transizione profonda che segna la fine di un’era e l’inizio di un nuovo #modello di #autenticazione più sicuro. NTLM, acronimo di New Technology #LAN Manager, nasce nel 1993 come uno dei primi #sistemi di #autenticazione basati su password sviluppati da #Microsoft.

A cura di Silvia Felici

#redhotcyber #news #microsoft #ntlm #sicurezzainformatica #protocollodiautenticazione #password #cybersecurity #hacking #malware #ransomware #sicurezzadigital #transizioneinformatica #protezionedeidati


Cybersecurity & cyberwarfare ha ricondiviso questo.


❌ SE PENSI CHE UN FIREWALL BASTI, QUESTO CORSO NON FA PER TE. ❌

Se invece vuoi capire:
✅ come ragiona un attaccante
✅ perché certi sistemi cadono sempre
✅ cosa c’è prima del pentest
allora sei nel posto giusto.

🔥 Cyber Offensive Fundamentals – Live Class

40 ore. Live. Niente scorciatoie.

🔗 Programma: redhotcyber.com/linksSk2L/cybe…
🎥 Intro del prof: youtube.com/watch?v=0y4GYsJMoX…

💎 Prima edizione = prezzo irripetibile
⛔ Numero chiuso

Per info e iscrizioni: 📞 379 163 8765 ✉️ formazione@redhotcyber.com

#redhotcyber #formazione #pentesting #pentest #formazionelive #ethicalhacking #hacking #cybersecurity #penetrationtesting #cti #cybercrime #infosec #corsi #liveclass #hackerhood #pentesting