Cybersecurity & cyberwarfare ha ricondiviso questo.

Nvidia executive says AI is more expensive than human workers
L: fortune.com/2026/04/28/nvidia-…
C: news.ycombinator.com/item?id=4…
posted on 2026.04.28 at 11:54:13 (c=1, p=4)

reshared this

Cybersecurity & cyberwarfare ha ricondiviso questo.

The media in this post is not displayed to visitors. To view it, please go to the original post.

Ma quale Alan Parson! Apple Music e Deezer sono divenute discariche di musica AI

📌 Link all'articolo : redhotcyber.com/post/altro-che…

A cura di Massimiliano Brolli

#redhotcyber #news #tecnologiaanalogica #mixaggio #pinkfloyd #thedarksideofthemoon

reshared this

A Tube Amplifier That’s Oven Ready


The media in this post is not displayed to visitors. To view it, please log in.

The problem with tube based audio is that it has so often been hijacked by people for whom the bragging rights of having a tube amplifier outweigh the benefits, or the sheer fun of building the thing. [Bettina Neumryr] makes a speciality of building projects featured in old electronics magazines, and her latest, a tube amplifier from 1955, is a fantastic antidote to the gold-plated silliness of audiophile tube amplifiers.

Design wise it’s relatively straightforward, with a preamplifier before a two-tube transformerless splitter circuit driving a push-pull output. She dives into the circuit a little, noting its feedback circuit to the cathode of the first splitter tube. There’s an accompanying power supply, a classic tube rectifier design that incorporates a hefty low-pass filter with a giant choke.

We particularly like her choice of chassis — while it’s possible to pay silly money for a tube chassis in 2026 she’s taken a much more down to earth approach with a pair of baking trays. We’re being honest here, they look surprisingly good. Component choices are limited by what’s available so most parts come from the junk box including the output transformer which causes her issues later. There’s a lot of mumbo-jumbo about tube amplifier layout, and she wisely sidesteps some of it.

The result after a few mishaps and a bit of unintended oscillation, is an amp which shows promise, but has distortion due to that transformer. We think she’ll have no problems sourcing a better one, which should bring that distortion figure into the acceptable range. You can watch the whole video below the break, and if that’s got you hooked, you can see one of our own youthful follies.

youtube.com/embed/UmJow0B46cg?…


hackaday.com/2026/04/28/a-tube…

Cybersecurity & cyberwarfare ha ricondiviso questo.

The media in this post is not displayed to visitors. To view it, please go to the original post.

Looks like GitHub silently corrupted some index.

PR #237 definitely exists and is closed (github.com/C2SP/C2SP/pull/237) but is just... not in the list (github.com/C2SP/C2SP/pulls?q=i…) regardless of filters.

I briefly doubted my own sanity. This is bad.

#237

L’attacco hacker a parlamentari e ministri tedeschi che ridefinisce la guerra ibrida alle democrazie


@Informatica (Italy e non Italy)
La Russia è la principale sospettata delle violazioni via phishing degli account Signal di autorità politiche, funzionari della difesa e giornalisti in Germania. Ecco come hacker russi hanno attaccato i

The GPS III Rollout is Almost Complete, But What is it?


The media in this post is not displayed to visitors. To view it, please log in.

Considering how integral it is to our modern way of life, you could be excused for thinking that the Global Positioning System (GPS) is a product of the smartphone era. But the first satellites actually came online back in 1978, although the system didn’t reach full operational status until April of 1995. While none of the active GPS satellites currently in orbit are quite that old, several of them were launched in the early 2000s — and despite a few tweaks and upgrades, their core technology isn’t far removed from their 1990s era predecessors.

But in the coming years, that’s finally going to change. Just last week, the tenth GPS III satellite was placed in orbit by a SpaceX Falcon 9 rocket. Once it’s properly configured and operational, it will join its peers to form the first complete “block” of third-generation GPS satellites. Over the next decade, as many as 22 revised GPS III satellites are slated to take their position over the Earth, eventually replacing all of the aging satellites that billions of people currently rely on.

So what new capabilities do these third-generation GPS satellites offer, and why has it taken so long to implement needed upgrades in such a critical system?

GPS Is Good, But Could Be Better


To understand the future of GPS, it’s helpful to look at its past. Developed by the United States military during the Cold War, what we now call GPS was originally known as Navigation System with Timing and Ranging (NAVSTAR). While the intent was always to allow civilian use of NAVSTAR, the equipment necessary to receive the signal and get a position was cumbersome and expensive.

There was little public interest in the system until Korean Air Lines Flight 007 was shot down in 1983 after mistakenly entering the Soviet Union’s airspace. With the lifesaving potential of NAVSTAR clearly evident, pressure started building on the industry to develop smaller and more affordable receivers — GPS as we know it was born.
NAVSTAR Satellite
That the development of such devices was possible in the first place was thanks to the design of NAVSTAR. Each satellite in the constellation broadcasts a timed radio signal which receivers on the ground use to compute their distance from the source. By comparing the signals from multiple satellites, a receiver can plot its position without the need for any local infrastructure. Since the process is entirely one-way, the can could be freely used by any device can can receive and decode the signal.

But while this operational simplicity was key to the proliferation of cheap ubiquitous GPS receivers, there’s certainly room for improvement given more modern technology. When NAVSTAR was designed knowing where a receiver was located within a radius of a few meters was more than sufficient, but today there’s a demand for greater accuracy by both civilian and military users. Given the essentially incalculable value of GPS to the global economy, improving reliability is also paramount. Not only has GPS jamming and spoofing become trivial, but even without the involvement of bad actors, legacy GPS struggles in urban environments.

Plans to deliver improved performance in these areas have been in the works for decades, with the United States Congress first authorizing the work on what would become GPS III all the way back in 2000. But when working on a system so critical that even a few minutes of downtime could put the entire planet into turmoil, such changes don’t come easy.

Can You Hear Me Now?


While modern GPS receivers are more sensitive than those in the past, there’s simply no getting over the fact that signals coming from a satellite more than 20,000 kilometers away will be by their very nature weak. So not only is it relatively easy for adverse environmental conditions to block or hinder the signal, but it doesn’t take much to override the signal with a local transmitter if somebody is looking to cause trouble.

As such, one of the key goals of the GPS III program was to deliver higher transmission power. This will lead to better reception for all GPS users across the board, but the new satellites also offer some special modes that offer even greater performance.

In addition to the backwards compatible signals transmitted by GPS III satellites, there’s also a new “Safety of Life” signal. This signal is transmitted at a different frequency, 1176 MHz, and at a higher power, so compatible receivers should hear it come in at approximately 3 dB above the “classic” signal. It’s intended primarily for high-performance applications such as aviation, but as compatible receivers get cheaper, it will start to show up in more devices.

These improvements should be enough for civilian use, but the military has higher expectations and operates under more challenging conditions. In such cases, future GPS III satellites will come equipped with a high-gain directional antenna that can project a “spot beam” signal anywhere on Earth. For receivers located within the beam, which is estimated to be a few hundred kilometers in diameter, the received signal from the satellite will be boosted by up to 20 dB. In contested environments, this should make it far more resistant to jamming and spoofing.

Speaking New Languages


The new signals being transmitted by GPS III satellites won’t just be louder than their predecessors, they’ll gain some new features as well.

For one thing, GPS III satellites will transmit a standardized signal known as L1C which offers interoperability with other global navigation systems such as Europe’s Galileo, China’s BeiDou, the Indian Regional Navigation Satellite System (IRNSS), and Japan’s Quasi-Zenith Satellite System. In theory a compatible receiver will be able to process signals from any combination of these systems simultaneously, improving overall performance.

The new satellites will also support the L2C signal. While this signal was technically available on earlier generation satellites, it’s still not considered fully operational and its adoption is expected to accelerate as more GPS III satellites come online. Compared with the legacy GPS protocol, L2C offers improved faster acquisition of signal, better error correction, and a more capable packet format.

To make GPS III transmissions even more secure, the military is also getting their own signal known as M-code. As you might expect, little is publicly known about M-code currently, but it’s a safe bet that it utilizes encryption and other features to make it more difficult for adversaries to create spoofed transmissions. For what it’s worth, a recent press release from the US Space Force claims that the use of M-code makes the next-generation GPS satellites “three-times more accurate and eight times more resistant to jamming than the previous constellation.”

Testing Out New Toys


Although all ten GPS III satellites are now in orbit, that doesn’t mean the constellation is complete. Starting in 2027, a new fleet of revised satellites known as GPS IIIF will start launching. They will take the lessons learned from the initial GPS III deployment to create a smaller, lighter, and more efficient platform that should have a service life of at least 15 years.
Artist impression of a future GPS IIIF satellite.
They’ll also include new in-development equipment that wasn’t quite ready for deployment when the current GPS III satellites were being assembled. This includes optical reflectors that will allow ground stations to more accurately track the position of each satellite, laser data links that will allow high-speed communication between satellites, and an improved atomic clock known as the Digital Rubidium Atomic Frequency Standard (DRAFS).

Of course, the vast majority of the people who use GPS every day will never be aware of all the changes and improvements happening behind the scenes. When they get a new phone with a GPS III-compatible receiver, they may notice that their navigation app locks on a bit faster or that the position shown on the screen is a little closer to where they are actually standing, but only if they are particularly attentive. But that’s entirely by design — the most important aspect of implementing GPS III is making the whole process as invisible as possible.


hackaday.com/2026/04/28/the-gp…

Cybersecurity & cyberwarfare ha ricondiviso questo.

#Signal Phishing Campaign Targets German Officials in Suspected Russian Operation
securityaffairs.com/191425/int…
#securityaffairs #hacking #Russia
Cybersecurity & cyberwarfare ha ricondiviso questo.

#Microsoft fixes #Entra ID flaw enabling privilege escalation
securityaffairs.com/191414/sec…
#securityaffairs #hacking
Cybersecurity & cyberwarfare ha ricondiviso questo.

The media in this post is not displayed to visitors. To view it, please go to the original post.

Una azienda italiana presto verrà violata! L’accesso ad un e-commerce è merce nelle underground

📌 Link all'articolo : redhotcyber.com/post/una-azien…

A cura di Carolina Vivianti

#redhotcyber #news #cybersecurity #hacking #malware #ransomware #prestashop #italiano

Cybersecurity & cyberwarfare ha ricondiviso questo.

The media in this post is not displayed to visitors. To view it, please go to the original post.

Starlink e le nuove “guerre invisibili”. Così i satelliti stanno cambiano il potere globale

📌 Link all'articolo : redhotcyber.com/post/starlink-…

A cura di Carolina Vivianti

#redhotcyber #news #comunicazionisatellite #connessioniveloci #crisiglobale #pianificazionemilitare

New Slicer Enables Horizontal Overhangs Without Support


The media in this post is not displayed to visitors. To view it, please log in.

There’s a rule of thumb when it comes to FDM printing that overhangs are really only possible to an angle of around 45 degrees or so. If you try to squirt out plastic with nothing supporting it, it just goes everywhere. However, a new slicer hopes to enable printing up to 90-degree overhangs with some creative techniques.

The software that enables this is called WaveOverhangs, and currently exists as a fork of OrcaSlicer. The idea is straightforward enough — using unique toolpathing to create rings of deposited material that fasten to those laid down before them in the same layer. Thus as the printer lays down a layer into bare space, the deposited plastic is, ideally, able to fix on to the supported edge. As the next ring is laid down, it grabs on to the cooled ring laid down before it, and so on. The idea is inspired by wave propagation, hence the name. You can see a demonstration of the software in the video below by [Cocoanix 3D Printing].

It’s still a very new technique. The slicer has a whole bunch of knobs to turn and two different algorithms. Get the settings just right and you can print horizontal overhangs successfully. There aren’t exactly presets yet, this is something to explore with trial and error. If you test it out, don’t forget to upload your results to the Community Gallery so the developers can see what works and what doesn’t.

We’ve explored how smart slicers can do amazing things before, too, particularly when it comes to things like bridging.

youtube.com/embed/gJS-XkTEq-A?…


hackaday.com/2026/04/28/new-sl…

Cybersecurity & cyberwarfare ha ricondiviso questo.

The media in this post is not displayed to visitors. To view it, please go to the original post.

AI locale in un’estensione Chrome con Transformers.js e Manifest V3: architettura pratica
#tech
spcnet.it/ai-locale-in-unesten…
@informatica


AI locale in un’estensione Chrome con Transformers.js e Manifest V3: architettura pratica


Hugging Face ha pubblicato una guida dettagliata su come costruire un’estensione Chrome che esegue modelli AI direttamente nel browser, senza server esterni, usando Transformers.js e Manifest V3 (MV3). Il progetto di riferimento è una browser assistant basata su Gemma 4 E2B, open source e già disponibile sul Chrome Web Store. Vediamo in dettaglio l’architettura e le scelte tecniche che rendono fattibile questo approccio.

Perché AI locale in un’estensione?


L’inferenza locale porta vantaggi concreti: nessun dato dell’utente inviato a server esterni, latenza ridotta dopo il download iniziale del modello, funzionamento offline. Il limite storico era la complessità di integrare modelli ONNX direttamente in un’estensione browser. Transformers.js risolve questo problema esponendo un’API familiare (ispirata alla libreria Python di HuggingFace) che gira interamente nel browser tramite WebAssembly e WebGPU.

Architettura MV3: tre contesti, tre ruoli


Manifest V3 impone un’architettura a contesti separati, ognuno con accesso e ciclo di vita differenti. Il progetto usa tre entry point distinti:

  • Background service worker (background.ts): il piano di controllo. Gestisce il ciclo di vita dell’agente, l’inizializzazione dei modelli, l’esecuzione dei tool e i servizi condivisi come feature extraction. I modelli Transformers.js vengono caricati e mantenuti qui.
  • Side panel (sidebar/): il layer di interazione con l’utente. Chat input/output, streaming degli aggiornamenti, controlli di setup.
  • Content script (content.ts): il bridge con la pagina web. Estrae contenuto dal DOM e gestisce l’evidenziazione di elementi.

La regola di design è chiara: orchestrazione pesante nel background, UI e logica di pagina leggeri. Questo evita di caricare il modello più volte, mantiene l’interfaccia reattiva e rispetta i confini di sicurezza di Chrome.

Contratto di messaggistica tipato


Con contesti separati, la comunicazione avviene tramite messaggi. Il progetto li tipizza con enum in src/shared/types.ts:

// Side panel verso background
enum BackgroundTasks {
  CHECK_MODELS,
  INITIALIZE_MODELS,
  AGENT_GENERATE_TEXT,
  AGENT_GET_MESSAGES,
  AGENT_CLEAR,
  EXTRACT_FEATURES
}

// Background verso side panel
enum BackgroundMessages {
  DOWNLOAD_PROGRESS,
  MESSAGES_UPDATE
}

// Background verso content script
enum ContentTasks {
  EXTRACT_PAGE_DATA,
  HIGHLIGHT_ELEMENTS,
  CLEAR_HIGHLIGHTS
}

Il flusso tipico è: la side panel invia AGENT_GENERATE_TEXT, il background aggiunge il messaggio alla conversazione, esegue l’inferenza, poi emette MESSAGES_UPDATE alla side panel che ri-renderizza.

Integrazione di Transformers.js: dove gira l’inferenza


L’estensione usa due modelli con ruoli distinti, definiti in src/shared/constants.ts:

  • Text generation (LLM): onnx-community/gemma-4-E2B-it-ONNX, formato q4f16 – responsabile delle risposte chat e dell’esecuzione dell’agente.
  • Feature extraction (embedding): un modello separato per estrarre vettori da testi di pagina, usato per operazioni semantiche.

Entrambi i modelli vengono inizializzati e cachati nel background service worker. Il download avviene al primo avvio e i pesi rimangono nella cache del browser (via Cache API), così le sessioni successive partono istantaneamente. Il progresso del download viene trasmesso alla side panel tramite l’evento DOWNLOAD_PROGRESS.

Agent loop e tool calling


L’estensione implementa un loop agente completo. La classe Agent gestisce la cronologia dei messaggi e il ciclo di ragionamento:

// Flusso semplificato di Agent.runAgent
while (true) {
  const response = await model.generate(chatMessages);

  if (response.hasToolCall) {
    const toolResult = await executeTool(response.toolCall);
    chatMessages.push({ role: "tool", content: toolResult });
  } else {
    // Risposta finale
    break;
  }
}

I tool disponibili includono EXTRACT_PAGE_DATA (estrae il testo dalla pagina corrente via content script) e HIGHLIGHT_ELEMENTS (evidenzia elementi nel DOM). L’interfaccia dei tool è definita con schema JSON per permettere al modello di invocarli correttamente.

Build e packaging: Vite e MV3


Il progetto usa Vite per il build, con configurazione custom per generare entry point separati per background, side panel e content script. I modelli ONNX non sono inclusi nel bundle dell’estensione (sarebbero troppo grandi), ma vengono scaricati da Hugging Face Hub al primo avvio.

Un dettaglio pratico importante: i service worker MV3 possono essere terminati dal browser in qualsiasi momento quando inattivi. Bisogna gestire la persistenza dello stato (conversazione, modelli inizializzati) in modo da riprendere correttamente al risveglio del worker. Il progetto usa chrome.storage.session per lo stato effimero e chrome.storage.local per i dati persistenti tra sessioni.

Considerazioni pratiche prima di adottare questo approccio


Prima di replicare questa architettura in un progetto reale, vale la pena considerare alcune limitazioni:

  • Dimensione modello: Gemma 4 E2B in q4f16 pesa diversi gigabyte. Il download iniziale richiede una connessione affidabile e spazio disco significativo nel profilo Chrome.
  • Compatibilità hardware: le prestazioni variano molto tra macchine. Su hardware senza GPU decente, l’inferenza può essere lenta anche con quantizzazione aggressiva.
  • Ciclo di vita service worker: Chrome può terminare il background worker dopo 5 minuti di inattività. Gestire il riavvio e la reinizializzazione del modello è parte non banale dell’implementazione.
  • Review del Chrome Web Store: le estensioni con funzionalità AI vengono esaminate più attentamente; documentare chiaramente cosa fa il modello e dove girano i dati accelera il processo di approvazione.


Conclusione


L’architettura descritta da HuggingFace è solida e dimostra che eseguire AI locale in un’estensione Chrome è fattibile oggi con Transformers.js. Il codice sorgente dell’estensione Gemma 4 Browser Assistant è disponibile su GitHub come riferimento completo, con implementazione reale di tool calling, streaming e gestione del ciclo di vita MV3. Per chi vuole portare funzionalità AI nelle proprie estensioni senza dipendere da API esterne, questo progetto è un ottimo punto di partenza.


Fonte: How to Use Transformers.js in a Chrome Extension – Hugging Face Blog, 23 aprile 2026


Cybersecurity & cyberwarfare ha ricondiviso questo.

The media in this post is not displayed to visitors. To view it, please go to the original post.

Microsoft Defender “RedSun” Zero-Day (CVE-2026-33825): Unpatched Exploit Grants Full SYSTEM Access
#CyberSecurity
securebulletin.com/microsoft-d…
Cybersecurity & cyberwarfare ha ricondiviso questo.

The media in this post is not displayed to visitors. To view it, please go to the original post.

🔥 Aperte le Iscrizioni alla CTF "𝟮𝟭𝟰𝟵 𝗕𝗥𝗘𝗔𝗞 𝗧𝗛𝗘 𝗦𝗣𝗛𝗘𝗥𝗘!" della 𝗥𝗛𝗖 𝗖𝗼𝗻𝗳𝗲𝗿𝗲𝗻𝗰𝗲 𝟮𝟬𝟮𝟲

📍𝗤𝘂𝗮𝗻𝗱𝗼 : dalle 15:30 di Lunedì 18 alle 17:00 di Martedì 19 Maggio 2026
📍𝗥𝗲𝗴𝗼𝗹𝗮𝗺𝗲𝗻𝘁𝗼: redhotcyber.com/documents/rhc-…
📍𝗜𝘀𝗰𝗿𝗶𝘇𝗶𝗼𝗻𝗶: ctf.hackthebox.com/event/detai… (Password “rhc-ctf-2026”)
📍𝗜𝘀𝗰𝗿𝗶𝘇𝗶𝗼𝗻𝗶 𝗳𝗹𝗮𝗴 𝗳𝗶𝘀𝗶𝗰𝗵𝗲 da svolgere presso il Teatro Italia: rhc-conference-2026-ctf.eventb…
📍𝗦𝘁𝗼𝗿𝘆𝘁𝗲𝗹𝗹𝗶𝗻𝗴: redhotcyber.com/post/2149-brea…

#redhotcyber #capturetheflag #ctf #ethicalhacking #rhcconference #conferenza #informationsecurity #hacking #cybersecurity #cybercrime #cybersecurityawareness

The Gentlemen: l’operazione ransomware-as-a-service più attiva nel 2026


@Informatica (Italy e non Italy)
Ciò che rende The Gentlemen degno di attenzione non è la sofisticazione del vettore di attacco, ma la velocità di crescita e la capacità di attrarre operatori esperti provenienti da altri programmi criminali. Ecco perché l'operazione ransomware-as-a-service (RaaS) sta

SmokedHam, la backdoor scelta dagli amministratori IT


@Informatica (Italy e non Italy)
Una backdoor nascosta nei tool di rete più usati mette in evidenza le capacità di dissuasione dei cyber criminali e rilancia il tema della formazione aziendale continua. SmokedHam è metafora di ciò che attende le organizzazioni che non investono nella cyber security
L'articolo SmokedHam, la backdoor scelta dagli amministratori

Cybersecurity & cyberwarfare ha ricondiviso questo.

New #Android #spyware #Morpheus linked to Italian #surveillance firm
securityaffairs.com/191398/mal…
#securityaffairs #hacking
Cybersecurity & cyberwarfare ha ricondiviso questo.

The media in this post is not displayed to visitors. To view it, please go to the original post.

Pack2TheRoot: Critical Linux Privilege Escalation Flaw in PackageKit Affects 12+ Years of Releases (CVE-2026-41651)
#CyberSecurity
securebulletin.com/pack2theroo…
Cybersecurity & cyberwarfare ha ricondiviso questo.

The media in this post is not displayed to visitors. To view it, please go to the original post.

Bitwarden CLI npm Package Compromised in Sophisticated GitHub Actions Supply Chain Attack
#CyberSecurity
securebulletin.com/bitwarden-c…
Cybersecurity & cyberwarfare ha ricondiviso questo.

The media in this post is not displayed to visitors. To view it, please go to the original post.

ShinyHunters Claims Udemy Data Breach: 1.4 Million User Records at Risk as Ransom Deadline Expires
#CyberSecurity
securebulletin.com/shinyhunter…
Cybersecurity & cyberwarfare ha ricondiviso questo.

The media in this post is not displayed to visitors. To view it, please go to the original post.

Critical CVSS 9.8 Flaw in CrowdStrike LogScale Lets Unauthenticated Attackers Read Server Files
#CyberSecurity
securebulletin.com/critical-cv…

A Guide to CubeSat Mission and Bus Design


The media in this post is not displayed to visitors. To view it, please log in.

If you mention the word bus, you might think of public transportation or, more likely for us, a way to connect things together. But in the satellite world, the bus is the part of a vehicle that supports the payload but isn’t itself the payload. Typically, that means the electric power system, propulsion, radios, and thermal control, among other systems. If you are designing a CubeSat, you will want to read A Guide to CubeSat Mission and Bus Design by [Frances Zhu].

The Creative Commons-licensed book has twelve chapters, ranging from systems engineering — that is, defining what you want to do — to analyzing structures, handling power, setting up communications, and more. Of particular interest to us was the chapter on command and data handling. The final chapters cover software, system integration, and there’s even a chapter on Ethics.

If you want to build a CubeSat or just want to learn more about how satellites actually work, this is a great read. There are videos and other features, too. If you don’t like reading in your browser, you can download an EPUB, PDF, or MOBI near the top of the page.

There are many resources for the want-to-be CubeSat builder. You can even start with an open source design.


hackaday.com/2026/04/28/a-guid…

Cybersecurity & cyberwarfare ha ricondiviso questo.

The media in this post is not displayed to visitors. To view it, please go to the original post.

Truffa del CEO: la Cassazione cambia tutto. Ora un clic potrebbe costarti il lavoro

📌 Link all'articolo : redhotcyber.com/post/truffa-de…

A cura di Paolo Galdieri

#redhotcyber #news #dirittodelavoro #licenziamento #giustacausa #erroreumano #truffa #frode

Cybersecurity & cyberwarfare ha ricondiviso questo.

The media in this post is not displayed to visitors. To view it, please go to the original post.

GUIDA AL SUPERMERCATO

Molti disagi e malattie partono dal Supermercato. Quando scegli cosa mettere nel carrello, stai facendo molto più di un semplice acquisto: stai costruendo la tua salute.

Compra cibi mono-ingrediente (frutta, uova, carne, pesce, verdura) e per una piccola parte cibi minimamente processati (formaggio, riso, pane), scegli la qualità e il bio per ogni alimento.
Evita tutti i cibi industriali ultraprocessati.

Pubblicato nel gruppo salute seguibile da qui: @salute@diggita.com

Unknown parent

mastodon - Collegamento all'originale

Salute

@andreabont SI certo, In Europa, per fortuna, esistono controlli più rigorosi su alimenti e sostanze: questo ci offre una tutela maggiore rispetto ad altre parti del mondo poi è vero che molti di questi video sono pensati per attirare attenzione e generare guadagni, quindi vanno sempre presi con un po’ di spirito critico, diversi consigli sono piuttosto “di base”: ridurre il consumo di alimenti ultra-processati o di sostanze industriali è un’indicazione generale che ha senso.
in reply to Salute

@andreabont Bisogna fare attenzione a non semplificare troppo o a generalizzare ma faccio fatica a capire dove stia esattamente la disinformazione: forse dipende da come vengono presentati i contenuti e da quali esempi specifici si prendono. Vale sempre la pena entrare nel merito dei singoli casi più che fermarsi a bollare genericamente perchè ha un linguaggio da influencer, meno si usano i prodotti citati meglio è comunque per tutti, si sa che il supermercato è pieno di spazzatura.
Cybersecurity & cyberwarfare ha ricondiviso questo.

#NCSC launches SilentGlass, a plug-in device to secure HDMI and DisplayPort links
securityaffairs.com/191408/sec…
#securityaffairs #hacking
Cybersecurity & cyberwarfare ha ricondiviso questo.

The media in this post is not displayed to visitors. To view it, please go to the original post.

296 – Meta aiuta i genitori a parlare di AI con i figli camisanicalzolari.it/296-meta-…
Cybersecurity & cyberwarfare ha ricondiviso questo.

The media in this post is not displayed to visitors. To view it, please go to the original post.

Prima di Stuxnet nel 2000 c’era Fast16: la suite malware per inquinare i calcoli matematici

📌 Link all'articolo : redhotcyber.com/post/prima-di-…

A cura di Carolina Vivianti

#redhotcyber #news #cybersecurity #malware #hacking #sentinellabs #fast16 #kernel #svcmgmtexe

Sega Master System Controllers, Now With USB C


The media in this post is not displayed to visitors. To view it, please log in.

USB wasn’t even a gleam in an engineer’s eye when the Sega Master System hit the market in 1985. Today, we’re up to USB 4 or something, and the USB C connector is becoming a defacto standard for just about everything except desktop computers. [Retrostalgia] is embracing this by mating the control pad from Sega’s first international console with the connector of today.

Naturally, the Sega Master System did not use the Universal Serial Bus to talk to its controllers, so some conversion was in order. That’s achieved with the use of a RP2040 microcontroller, which reads the D-pad and action buttons via its GPIO pins. It then acts as a HID device when plugged into a computer or other USB host, showing up as a simple game controller. This is a particularly easy hack as the Master System controller is so simple, there’s no need to decipher any protocols or anything like that. It’s just about wiring up a few simple buttons. Beyond that, it’s just a matter of hot-gluing the RP2040 into the Master System controller housing, and making some room for the USB C port to sneak out the top. We’d have loved to seen a little extra hackery on this one, perhaps adding some rumble to a controller that was never, ever supposed to have it.

If you want to adapt authentic old controllers to work with modern computers and emulators, this project is a great place to start. It doesn’t get much simpler than the Master System, after all. You can always work your way up to more advanced feats later, like working with the beloved Wavebird. Video after the break.

youtube.com/embed/lEYEePY9bpk?…


hackaday.com/2026/04/27/sega-m…

Cybersecurity & cyberwarfare ha ricondiviso questo.

The media in this post is not displayed to visitors. To view it, please go to the original post.

🚀 Gli speaker della RHC Conference 2026

📍𝗤𝘂𝗮𝗻𝗱𝗼: Martedì 19 Maggio con ingresso dalle ore 8:45
📍𝗗𝗼𝘃𝗲: Teatro Italia, Via Bari 18, Roma (Metro Piazza Bologna)
📍𝗣𝗿𝗼𝗴𝗿𝗮𝗺𝗺𝗮: redhotcyber.com/linksSk2L/prog…
📍𝗜𝘀𝗰𝗿𝗶𝘇𝗶𝗼𝗻𝗲 conferenza di Martedì 19 Maggio: rhc-conference-2026.eventbrite…

#redhotcyber #rhcconference #conferenza #informationsecurity #ethicalhacking #dataprotection

Cybersecurity & cyberwarfare ha ricondiviso questo.

The media in this post is not displayed to visitors. To view it, please go to the original post.

La difesa non è il muro: come l’Agger romano può insegnarci la cybersecurity

📌 Link all'articolo : redhotcyber.com/post/la-difesa…

A cura di Simona Piacenti

#redhotcyber #news #cybersecurity #sicurezzainformatica #hacking #malware #ransomware

Cybersecurity & cyberwarfare ha ricondiviso questo.

The media in this post is not displayed to visitors. To view it, please go to the original post.

PhantomRPC: un bug di sicurezza critico in Windows RPC, ma Microsoft non rilascia fix

📌 Link all'articolo : redhotcyber.com/post/phantomrp…

A cura di Bajram Zeqiri

#redhotcyber #news #cybersecurity #hacking #windows #vulnerabilita #phantomrpc

Why Solid State Batteries Short


The media in this post is not displayed to visitors. To view it, please log in.

Solid state batteries, we are told, are the new hot battery technology that will replace lithium-ion batteries. Soon. Not that we haven’t heard that before. One reason it isn’t dominating the market today is that it’s prone to short circuits during charging. [Dr. Yuwei Zhang and others have published a paper detailing why the shorts happen, which could lead to strategies to improve the technology.

Solid state batteries employ a solid electrolyte and a lithium anode. It is known that, sometimes, lithium metal from the anode forms dendrites that penetrate the ceramic electrolyte and cause it to crack. This is somewhat of a mystery as the lithium is a soft metal (to quote [Zhang], “like a gummy bear.”).

There were two leading hypotheses for the observations. [Zhang’s] team showed that hydrostatic stress made the lithium dendrites act like a water jet, enabling them to penetrate the hard ceramic.

There is still work to figure out what to do about it, but understanding the root cause is certainly a step in the right direction. We’ve looked at these batteries before. We’ve also seen how changing the anode construction might help with the problem.


hackaday.com/2026/04/27/why-so…

Cybersecurity & cyberwarfare ha ricondiviso questo.

The media in this post is not displayed to visitors. To view it, please go to the original post.

A bit over two years after starting to work on it...

Go is officially FIPS 140-3 certified 💥

csrc.nist.gov/projects/cryptog…

I am pretty confident Go is now one of the most—if not the most—seamless and complete FIPS 140-3 compliance solutions... with a single env var, out of the box.

A Different Kind of Ultrasonic Levitation


The media in this post is not displayed to visitors. To view it, please log in.

An ultrasonic transducer with two wires attached to it by alligator clips floats very slightly suspended over a glass surface.

Ultrasonic levitation is by now a familiar trick: one or more ultrasonic transducers create a standing wave, and small objects can be held in the nodes of this standing wave. With a sufficiently large array of transducers, it’s even possible to control the movement of the object. This isn’t the only form of ultrasonic levitation, however, as [Steve Mould] demonstrated with his ultrasonic air hockey table.

This less familiar form of levitation was discovered by [Bob Collins] while working on torpedo guidance systems: when he tried to place a glass lens on an ultrasonic transducer it immediately slid off. He found during further experimentation that an ultrasonic transducer would levitate over any sufficiently flat and smooth surface. It works by trapping a very thin layer of air between the transducer and the smooth surface. When the transducer moves sharply toward the surface, it compresses a layer of air in between, and forces some air out, and the reverse happens while pulling back. However, during the downstroke, the gap through which air can escape is narrower than during the upstroke, and there is more surface-induced drag, meaning that the inflow and outflow of air through a narrow gap isn’t completely equal. At a certain distance, inflow and outflow balance, and the transducer floats on a thin layer of air.

In [Steve]’s air hockey arena, the floor oscillates and the pucks levitate over this. Driving it using just one transducer didn’t work, since the floor formed standing waves, and the pucks would get stuck on node lines. Instead, he used two transducers, one at each end of the arena, and drove them out of phase with each other. This created a standing wave and minimized dead spots.

The arena was a bit small (having to be played using toothpicks), but it seemed to work well. If you prefer your air hockey a bit more human-scaled, we’ve seen a table build before. We’ve also seen ultrasonic levitation before, ranging from simple electronics kits to the driving force behind a full volumetric display or photography station.

youtube.com/embed/BViIGAg-eVI?…


hackaday.com/2026/04/27/a-diff…

The Challenges of 3D Printing Reliable Springs


The media in this post is not displayed to visitors. To view it, please log in.

Springs are great, but making them out of plastic tends to come with some downsides, for fairly obvious reasons. Creating a compliant mechanism that can be 3D printed and yet which doesn’t permanently deform or wear out after a few uses is therefore a bit of a struggle. The complaint toggle mechanism that [neotoy] designed is said to have addressed those issues, with the model available on Printables for anyone to give a shake.

The model in question is a toggle, which is the commonly seen plastic or metal device that clamps down on e.g. rope or cord and requires you to push on it to have it release said clamping force. Normally these use a metal spring inside, but this version is fully 3D printable and thus forms a practical way to test this particular compliant mechanism with a variety of materials.

The internal spring is a printed spiral spring, with the example in the video printed in PETG. You can of course also print it in other materials for different durability and springiness properties. As noted in the video, PLA makes for a very poor spring material, so you probably want to skip that one.

We covered compliant mechanisms in the past for purposes like blasters, including some that you can only see under a microscope.

youtube.com/embed/hHZo82-PtT8?…


hackaday.com/2026/04/27/the-ch…

Cybersecurity & cyberwarfare ha ricondiviso questo.

The media in this post is not displayed to visitors. To view it, please go to the original post.

The media in this post is not displayed to visitors. To view it, please go to the original post.

LockBit 5.0 in Escalation: dalla Banca delle Banche Centrali Latinoamericane alle logistiche Europee
#CyberSecurity
insicurezzadigitale.com/lockbi…


LockBit 5.0 in Escalation: dalla Banca delle Banche Centrali Latinoamericane alle logistiche Europee


LockBit 5.0 — nome in codice ChuongDong — non è la resurrezione di un brand cybercriminale: è la prova che i ransomware-as-a-service più organizzati si evolvono più velocemente delle operazioni delle forze dell’ordine che li contrastano. Nell’ultima settimana di aprile 2026, la gang ha rivendicato colpi su un istituto finanziario fondato dalle banche centrali latinoamericane, su società di logistica tedesche e su numerose altre vittime in Europa, Asia e nelle Americhe. Un’analisi tecnica e operativa della minaccia più attiva del momento.

Storia e resurrezione: da Operation Cronos a LockBit 5.0


Nel febbraio 2024, la joint task force internazionale Operation Cronos — guidata dall’NCA britannica con la partecipazione di Europol, FBI e polizie di altri dieci paesi — aveva inflitto quello che sembrava un colpo definitivo all’ecosistema LockBit: server sequestrati, chiavi di decryption pubblicate, affiliati arrestati in Polonia e Ucraina, e il volto del presunto admin “LockBitSupp” esposto pubblicamente.

La risposta del gruppo è arrivata con una certa prevedibilità: già nel settembre 2025, LockBit ha annunciato sul forum dark web RAMP la versione 5.0, coincidendo con il sesto anniversario dell’operazione. A distanza di circa sette mesi dal lancio, il quadro è chiaro: il gruppo ha ripreso la sua cadenza operativa, con oltre 100 vittime rivendicate sulla nuova data leak site (DLS) e attività in costante escalation nel 2026.

Architettura tecnica: cosa c’è di nuovo in LockBit 5.0


LockBit 5.0 è costruito su un’architettura a due componenti principali, un Loader e un modulo Ransomware, con una separazione netta tra funzioni di delivery e payload di cifratura.

Il Loader decifra il payload ransomware usando XOR combinato con compressione LZ e lo esegue direttamente in memoria, senza mai scrivere il binario cifrato su disco — una tecnica che complica notevolmente l’analisi forense e il rilevamento da parte degli antivirus tradizionali.

Sul fronte cifratura, la versione 5.0 introduce significativi miglioramenti rispetto alla 4.0:

  • Cifratura differenziale basata sulla dimensione dei file: per i file più grandi viene cifrata solo una porzione, massimizzando la velocità dell’attacco e comprimendo la finestra di risposta per i difensori.
  • Modulo di cancellazione delle Shadow Copy aggiornato: basato su codice derivato da Conti, ora utilizza le VSS API native di Windows invece degli strumenti da riga di comando, riducendo le tracce nel log degli eventi.
  • Patching di EtwEventWrite: disabilita in memoria il Windows Event Tracing for Windows (ETW), cieco di fatto i sistemi di SIEM e EDR che si affidano ai provider nativi.
  • Controlli di geolocalizzazione e locale: i campioni escludono automaticamente i sistemi nei paesi della CIS (Comunità degli Stati Indipendenti), un pattern tipico degli operatori ransomware di madrelingua russa.
  • Estensioni randomizzate a 16 caratteri: i file cifrati ricevono un’estensione generata casualmente per ogni campagna, impedendo il rilevamento basato su signature statiche.


Multi-piattaforma: Windows, Linux e VMware ESXi nel mirino


Una delle novità più significative di LockBit 5.0 è l’espansione cross-platform. Il gruppo ha sviluppato tre varianti distinte — per Windows, Linux e VMware ESXi — che possono essere deployate in modo coordinato su tutta l’infrastruttura di una vittima.

La variante ESXi è progettata specificamente per cifrare i datastore delle macchine virtuali, paralizzando interi ambienti virtualizzati in un singolo passaggio. Per un’organizzazione enterprise che fa affidamento su VMware, questo significa che server, applicazioni critiche e database possono essere resi inaccessibili simultaneamente, moltiplicando la pressione a pagare il riscatto.

Le vittime di aprile 2026: da Bladex alle logistiche europee


La settimana del 26-27 aprile 2026 ha visto LockBit 5.0 rivendicare una serie di attacchi di profilo elevato, in particolare:

  • Bladex (Panama): istituto finanziario multinazionale fondato direttamente dalle banche centrali dei paesi latinoamericani e caraibici. LockBit ha annunciato la pubblicazione dei dati entro 14-15 giorni. Un attacco a un istituto con questo profilo istituzionale ha implicazioni che vanno ben oltre il singolo incidente.
  • Merlo Teleskoplader (Germania): produttore tedesco di macchinari industriali; la rivendicazione include potenziale esfiltrazione di dati tecnici e commerciali.
  • D. Heinrichs Logistic GmbH (Bremerhaven, Germania): provider logistico nel porto di Bremerhaven, nodo strategico per il commercio europeo.

La concentrazione di vittime tedesche nel settore logistico/industriale suggerisce una campagna mirata, o quantomeno che gli affiliati di LockBit 5.0 stiano attivamente prendendo di mira la filiera produttiva e logistica europea.

Indicatori di compromissione e pattern di attacco

# File system indicators (Windows)
%TEMP%\ReadMeForDecrypt.txt         # Ransom note (naming convention LockBit 5.0)
*.{16-char random extension}         # File cifrati con estensione randomizzata
# Processi sospetti (behavior indicators)
vssadmin.exe (chiamate VSS API native invece di CLI)
wevtutil.exe (possibile log clearing pre-cifratura)
wmic.exe shadowcopy delete
# ETW patching (in-memory)
EtwEventWrite patched -> NOP sled   # Disabilita event tracing Windows
# Geolocation check (CIS exclusion)
GetUserDefaultLCID() / GetLocaleInfoW()  # Controllo locale pre-esecuzione
# Network indicators
Comunicazioni C2 su infrastrutture TOR
Data exfiltration pre-cifratura via tool personalizzato (data theft stage)
# Loader behavior
XOR + LZ decompression in memoria
Nessuna scrittura del payload cifrato su disco (fileless execution)

Il modello RaaS e la resilienza di LockBit


La sopravvivenza di LockBit alle operazioni delle forze dell’ordine non è un caso: è il risultato di un modello RaaS (Ransomware-as-a-Service) progettato con ridondanza in mente. Gli affiliati — decine di gruppi criminali indipendenti che noleggiano il malware in cambio di una percentuale dei riscatti — possono continuare a operare anche quando l’infrastruttura centrale viene sequestrata. Quando il codice e le build vengono trapelate o ricostruite, il lancio di una nuova versione diventa relativamente rapido.

LockBit 5.0 dimostra anche una capacità di adattamento tecnico reale: il patching in memoria di ETW, l’uso delle VSS API invece dei comandi shell, e l’architettura modulare cross-platform non sono aggiornamenti cosmetici ma miglioramenti mirati a sopravvivere agli EDR e ai SIEM di nuova generazione.

Raccomandazioni per i difensori


  • Proteggere i backup offline e immutabili: la strategia più efficace contro LockBit rimane avere copie fuori dalla portata del ransomware. I backup connessi alla rete sono sempre stati l’obiettivo primario degli operatori.
  • Monitorare le API di Volume Shadow Copy: rilevare chiamate anomale alle VSS API da processi inusuali, non solo l’esecuzione di vssadmin.
  • EDR con visibilità sulle patch in-memory: i provider che monitorano l’integrità del codice in memoria (PatchGuard bypass, EtwEventWrite tampering) hanno significativamente più chance di rilevare LockBit 5.0 prima dell’esecuzione del payload.
  • Segmentazione rigorosa degli ambienti VMware: i datastore ESXi non devono essere accessibili da host che non abbiano una necessità operativa diretta.
  • Threat hunting basato su estensioni randomizzate: configurare alert su mass-rename di file con estensioni sconosciute nei file server critici.
  • Verifica della geolocation check: se in un ambiente vengono rilevati controlli di locale da processi inusuali, potrebbe indicare una fase di reconnaissance pre-attivazione del payload.

LockBit 5.0 non è un fantasma del passato. È una minaccia attiva, tecnicamente evoluta e operativamente resiliente. L’attacco a Bladex — un’istituzione finanziaria nata per volontà delle banche centrali di un’intera regione del mondo — è il segnale che nessun settore, nessuna dimensione aziendale e nessuna geografia è fuori dal mirino del gruppo più prolifico del ransomware mondiale.


Cybersecurity & cyberwarfare ha ricondiviso questo.

#Medtronic discloses security incident after #ShinyHunters claimed theft of 9M+ records
securityaffairs.com/191391/cyb…
#securityaffairs #hacking

reshared this