EVs are less mechanically complicated than their combustion kin, but that doesn’t mean they’re immune to component failure. The Integrated Charge Control Unit (ICCU) has been the main failure point in recent Hyundai/Kia EVs, and ICCU Observer is an attempt to log data from the systems to find the culprit.

The ICCU handles all charging and voltage conversion duties from 800 V down to 12 V in the E-GMP platform EVs from Hyundai, Kia, and Genesis. The main failure mode appears to be when the circuit charging the 12 V fails, eventually rendering the vehicle inoperable. While the rate of failure is relatively low, the exact numbers are unknown, and Hyundai has remained quiet on if they know what’s causing it.

Unsurprisingly, speculation is rampant with owners experiencing failures relaying similarities and differences to others with the same problem. In an effort to bring actual data to the process, [broadwall] has started working on an open data set of information collected over the vehicle’s OBD II port in an effort to pinpoint similarities between the vehicles that have experienced failures.

Hyundai is currently replacing the failed units under warranty (recently expanded to 15 years in most markets), but that’s little comfort when you’re sitting on the side of the road waiting for a tow. These failures stand out in an otherwise easy to maintain platform, so hopefully this effort will lead to a permanent fix instead of merely swapping out for a new unit.

If you’d like to explore data analysis a little further, how about using astrophotography to detect exoplanets or learning more from Stanford?

hackaday.com/2026/07/25/iccu-m…

[Ivan Miranda] is famous for his large-scale 3D printed vehicles. They’re pretty fun, but they’re also pretty big and heavy—which can make transporting them around rather impractical. Hence, when he had reason to travel with a 3D printed go kart, he went back to the drawing board to create something light enough to pack in regular plane luggage.

The build started with some major compromises compared to [Ivan]’s previous go kart build. Notably, there are only three wheels instead of four, and a simplified control layout that eschews a regular steering wheel. These decisions were made to save weight and allow the design to be more compact. The kart uses a set of handles either side of the rider to handle steering. Drive is via a brushless motor, with power supplied from a series of 18 V drill batteries. Parts were produced on [Ivan]’s massive printer which comes in handy on large-scale projects like these.

All in all, the final build weighed around 20 kg. That’s light enough to be broken down across checked luggage and carry-on for a typical flight. We’d consider the project a success on that basis, even if quite a bit of assembly was required upon arriving at the destination. [Ivan]’s other builds in this realm are pretty fun too, from the printed scooter to the ride-on tank.

youtube.com/embed/0foNjHxT8bw?…

hackaday.com/2026/07/24/3d-pri…

Seizure in zebrafish larva imaged using AO setup. (Credit: Bingxi Liu et al., Biomedical Optics Express, 2026)
Key to understanding something like epilepsy is to be able to record highly transient events in biological tissues. Generally this is done using light sheet microscopy, which provides effectively a 2D ‘slice’ of the tissue in question, but to observe a brief event in a larger biological system you need to be able to rapidly change the layer and focus between the virtual layers. This is what [Bingxi Liu] et al. al did using adaptive optics with an electrically tunable lens (ETL) in order to capture seizures in the brain of zebrafishes.

Their system can capture a volume of 499 × 499 × 150 μm³ at 4 volumes per second, which is large enough to fit optically transparent zebrafish larva into. The optical setup is shown in the above image, with the design based on the OpenSPIM platform for selective plane illumination microscopy.

Here the 488 nm laser provides the illumination (excitation) of the layer, while the 543 nm laser is for calibration purposes. The ETL is thus in the imaging path that allows for capturing by a digital camera, while a beam splitter directs part of the captured data to a Shack-Hartmann wave front sensor (SHWFS), which is part of the adaptive optics system.

After a seizure was induced in the zebrafish larva using the drug pentylenetetrazol the results were recorded using this system. It showed the seizure’s origin in the posterior brain, with subsequent propagation to the anterior before subsiding gradually over tens of seconds.

This system should be quite useful even outside of seizure research, as there are a lot of 3D systems in biology where having a relatively high-speed microscopic capture can be very revealing.

hackaday.com/2026/07/24/fast-v…

The standard computer mouse is a perfectly useful peripheral if your hands work. If you’ve got some trouble in that area, you might appreciate an alternative input solution. To that end, [Varun Adinath Patil] created a neat hands-free solution for moving a cursor around a screen.

The build is based on the Neuro PlayGround Lite, a board built for physiological signal acquisition in the Feather form factor. It’s hooked up to an IMU sensor—both a MPU6050 or BMI270 work—which tracks head movements to allow the cursor to be panned around the screen. Other biological signals are then used to activate other standard mouse functions. Clenching the jaw fires off a left click, while a triple blink fires a right click. Clicking and dragging is achieved by a double-blink. The jaw muscles are sensed via EMG signals picked up with gel electrodes on the skin, while the blinks are detected via EOG signals via the same contact points.

Commercial solutions in this realm exist, but it’s great to see how such a device can be built from the ground up. We’ve looked at other neat applications of head-tracking before, too. If you’re working on your own innovative accessibility tools, don’t hesitate to let us know via the tipsline.

hackaday.com/2026/07/24/hands-…

Community-led open source project hosting site Codeberg has formally announced that projects whose code is largely or fully machine-generated through LLMs and other ‘AI’ tools will no longer be welcome. This follows on the heels of a similar ban on cryptocurrency-related projects.

The community vote was on two issues, the first being the notion that scraping of project code for the use in LLMs should be forbidden, which was a motion that easily passed. The second motion was on disallowing projects whose code was substantially generated by LLMs like Claude, OpenAI Codex, and similar. This motion passed with 358 in favor versus 144 against.

In the earlier linked blog post the reasoning behind especially this second issue is expanded upon, covering not only ‘license whitewashing’, but also the direct and indirect hardware costs, with the expanding ‘AI’ datacenter hyperscaling having massively increased hardware costs for Codeberg over the past years, as the costs have been largely externalized.

Also covered is also the aspect of these LLM-based tools destroying the OSS community, which is something that is backed up by recent studies. Even if we ignore that such LLM-tools are destroying the cognitive abilities of its users, there’s an argument to be made that if LLM-scraping is disallowed, then it’s consistent to also not allow LLM-generated code.

In the Terms of Use you can see these changes, both for LLMs and for cryptocurrency projects.

Thanks to [mk-fg] for the tip.

hackaday.com/2026/07/24/codebe…

[Myth Made] has a goal to get into writing. However, she likes to do things the aesthetic way, rather than the easy way. Thus, she has eschewed simple word processing on a conventional computer, instead choosing to build a remarkably attractive writing deck styled after a classic typewriter.
The keycap marking technique is worth watching the video for on its own.
The build began with a mechanical keyboard with a compact layout. The square keycaps were swapped out for custom 3D printed versions that were rounded to suit the desired look. [Myth Made] used a neat technique where the caps were colored in with a paint marker and then ran through a laser engraver to bond the paint to the surface to make all the key markings.

With the input side sorted, the rest of the build could progress. The typewriter shell was printed in multiple parts, and then welded together with acetone. This was then covered with an ABS-acetone solution that helped remove some of the surface artifacts, before priming and paint. As for the electronics side, a Raspberry Pi Zero runs the show, hooked up to a Waveshare e-ink display which can be cranked up and down like a piece of paper coming out of a typewriter. There’s also a lovely 7-segment display which displays the current word count.

It’s a fun build that looks utterly joyous to use. Sometimes leaning into the aesthetic side of a project is what makes it so magical.

youtube.com/embed/MEqnDIuDGxc?…

hackaday.com/2026/07/24/e-ink-…

On this episode, Hackaday editors Elliot Williams and Tom Nardi discuss their love of electronic paper, clunky cartridges, and keeping old games alive by any means possible. You’ll also hear about getting the most out of the sensors in our 3D printers, playing with X-rays at home, a ring that runs Java, and a roulette wheel that outgrew its 555 timer. Stick around to the end to learn about a different sort of IRC that’s even more niche than the one you’re probably familiar with, as well as the logistical challenges and potential benefits of catching rockets with a giant net.

Check out the links if you want to follow along, and as always, tell us what you think about this episode in the comments!

html5-player.libsyn.com/embed/…

Direct download in DRM-free MP3.

Where to Follow Hackaday Podcast

Places to follow Hackaday podcasts:

• iTunes
• Spotify
• Stitcher
• RSS
• YouTube
• Check out our Libsyn landing page

Episode 379 Show Notes:

News:

• 2026 Hackaday Supercon: Call For Proposals
• Remembering The Zilog Z80 As It Turns Fifty Years Old

What’s That Sound:

• We’re putting What’s That Sound on hold while we sort out new prizes. Stay tuned.

Interesting Hacks of the Week:

• 20 FPS On E-Paper Display Without Help
  
  • E-ink Display Driven DIY
  • Clever E-Ink Driver Does 32 Levels Of Grey, Avoids Update Flicker, And More
  • Behold A 60 Hz Refresh Rate E-ink Monitor

  
  

• Old SSDs Find New Life As Game Cartridges
• 60 FPS NES Emulator On ESP32
• Automated Pressure Advance Using A Bed-Leveling Sensor
  
  • Direct Pressure Advance Measurement For Fast Calibration

  
  

• Old TV Vacuum Tube Turned DIY X-Ray Machine
  
  • X-rays with a DY86 – BOGIN, JR.

  
  

• Dress Up Your YubiKey With This Web-Based Tool

Quick Hacks:

• Elliot’s Picks:
  
  • Echolocation For Drones
  • Java Ring Restored After Nearly 30 Years
  • Tired Of Xargs?

  
  

• Tom’s Picks:
  
  • Seven Ways To Install Magnets Into Your 3D Prints
  • ESP32-driven Roulette Wheel Could Have Used A 555, But That Didn’t Have WiFi
  • Flex Filament Stuck To Your Build Platform? Reach For The Isopropanol

  
  

Can’t-Miss Articles:

• Postal IRCs Are Almost A Thing Of The Past
• Launching Rockets Is Hard, Bring Them Back Is Harder

hackaday.com/2026/07/24/hackad…

Despite their small size, mosquitoes are one of the deadliest creatures on Earth, and keeping them away from you is one of the best ways to stay safe. DEET has been the mainstay of insect repellents for decades, but what if there was a repellent you could grow yourself?

Researchers at Cardiff University found that the essential oil from catnip plants (Nepeta cataria) could be as effective as DEET at repelling mosquitoes when applied as a 6% lotion. The oil has been shown to be effective against many species of mosquitoes, ticks, and mites in previous research. You can look at the paper for details, but the catnip oil was obtained through steam distillation followed by some processing with hexane. The essential oil was then mixed with “water, glycerin, emulsifying wax, cetyl alcohol, cetyl stearyl alcohol, shea butter, glycerol monostearate, olive oil, coconut oil, sunflower oil, methyl paraben, propyl paraben and silicone oil.” We suspect that list will look familiar to anyone who’s read an ingredient label of most any store bought lotion, unless it was paraben free.

The Guardian’s coverage quotes one of the researchers, [Dr. Simon Scofield]: “We did not conduct any experiments to see if it is attractive to cats, but given that the active ingredient [nepetalactone] has well-known cat-attractive properties, I would expect they would quite like it,” he said. Depending on how your cats react, you may want to consider applying the lotion shortly before departing home.

If you want some more options in your mosquito defense, how about becoming a bug zapper, using drones and sonar, or genetically modifying mosquitoes to curb their numbers.

hackaday.com/2026/07/24/keepin…

[Ayush Paul] posts about extracting data from Claude agents while it accesses web data to fulfill user requests.

But it wasn’t that easy. [Ayush] discovered that Anthropic anticipated many of the attacks, and set up guardrails in an attempt to keep the agent from accessing arbitrary web sites. For Claude to access a website, the user has to specify it, it must be the results of a web search, or it must be referenced by a website previously specified by the user or returned in a search.

To convince the Claude agent to navigate a malicious site designed to extract data, Ayush formed a false warning that Cloudflare was blocking the agent for authentication purposes, and asked it to spell out the name of the agents owner by clicking a list of alphabetical links. Of course Claude trusts Cloudflare and wants to be helpful, so it cheerfully completed the task.

Once the agent is trapped in the false authentication loop, it can be interrogated for all sorts of information it knows about the owner: Ayush was able to convince it to disclose employer, and even data about the user that could be linked to security questions, like their home town.

Since Claude can be detected by the user agent (the field attached to web requests that tells the web server what sort of browser is requesting the page) custom information can be fed to the bot while users see a normal website; clicking a link looks completely normal, but asking an agent to summarize the site triggers fooling the bot into spilling the beans.

After reporting the issue, Ayush was told that Anthropic had already identified the issue internally, and eventually prevented the attack for now by preventing the agent from following links on external pages.

Grok sends entire codebases

Cereblab discovered that the Grok coding agent uploaded the entire content of the codebase it’s working with – and all Git history – to xAI servers, almost immediately. Even when told to never upload a file, the agent would reply “OK”, and then begin uploading the code bundle anyway.

If uploading your code to a remote server isn’t bad enough, and this could be extremely bad in some situations involving sensitive company code, including the entire Git history means that previously deleted files, like accidentally committed secrets or authentication credentials and tokens, were also leaked. Attempting to opt out by disabling options to improve the model by uploading code had no effect.

After gaining attention, Grok has added a privacy option to opt out of data retention. xAI has committed to deleting the retained uploaded code, but it is unclear if users will be told when their data has been removed. To actually prevent the agent from uploading local files to the xAI servers, even temporarily, a global flag “disable_codebase_upload” is required. Watch out, the privacy retention flags are only per-session!

Steam malware used to steal crypto

Court filings in Washington state this month revealed an attempt to steal cryptocurrency using malware uploaded to the Steam gaming platform. Publicly identified and taken off the store in 2025, the filing alleges the same individuals were behind multiple games containing crypto stealing trojans: “Dashverse”, “Lunara”, “PirateFi”, “BlockBlasters”, and “Lampy”.

PC World covered the initial discovery of the malware on Steam. While Steam, overall, seems to do a good job preventing malware titles, 2025 had several high-profile cases. Prosecutors say the malware netted approximately $200,000 in stolen cryptocurrency wallets as well as other stolen credentials including Steam accounts.

OpenSSL DoS in 11 Bytes

Okta posts about a denial of service in OpenSSL where a single pre-auth packet is able to cause an allocation of up to 16 megabytes of RAM.

The “11 bytes” headline is very catchy, but more important than the actual number of bytes is the general asymmetric behavior; an attacker can send a very small amount of data and achieve a disproportionately large result. The OpenSSL vulnerability only has local impacts, exhausting server memory rather than generating network traffic, but similar attacks in the network space can fuel denial of service storms when extremely small requests result in amplified results.

The bug is ultimately due to being insufficiently suspicious of remotely supplied content, in this case the pre-authentication fields in the connection message that define the length of the incoming client message. Since the memory is pre-allocated in the server, the client doesn’t need to actually transmit that much data – it simply needs to hold the connection open. Keeping the connection open isn’t even required for causing problems – repeatedly allocating large blocks of different sizes can lead to memory fragmentation where the memory allocator keeps grabbing larger and larger ranges of memory because there isn’t sufficient ram available in a contiguous chunk.924899

Fortunately this bug has already been addressed in OpenSSL 4.0.1 and backported to maintenance releases of previous versions.

Exposed Interfaces on Car Chargers

Saiflow has a report on a range of exposures via the electric vehicle charging infrastructure.

In CVE-2026-9039 Saiflow exposes the risks in some CCS2 EV charging stations. As part of the standard, communication is established between the charging station and the operator network, which is typically strongly secured via TLS and VPN use. A second connection, however, is established over the charging plug between the charging station and the vehicle; the vehicle is assigned an IPv6 address for communicating with the charger for various charging protocols.

The XCharge C6 charging station exposes SSH and basic telnet network services on all network interfaces, including the interface connected to the vehicle. To make it even worse, they allow root login, with password “root”, giving full admin access to the charging station.

Once inside the charging station, an attacker has access to the network connection from the charging station to the company network, as well as root control over the charging station itself, with the possibility of damaging the charger, changing the power output levels, or getting free charging. If a future vulnerability was found in the management interface of the vehicle, a compromised charger could be used to attack future connected vehicles.

The main lessons for vendors seem to be ones we’re familiar with already: never leave default credentials, especially not “root” and “root” in a product, and be aware of what networks you expose services on. Good lessons for all of us; let those who have never left a Raspberry Pi with default credentials on a network cast the first stone.

Hugging Face Breach

In news that has likely been impossible to avoid, Axios reports on a compromise of the Hugging Face platform by an OpenAI model. The reports around the incident echo the frequently weird boastful statements from OpenAI, who state “We consider this to be an unprecedented cyber incident” and they “are responding accordingly”, despite being the originators of and cause of said incident.

Multiple vulnerabilities in the Hugging Face API were combined to accomplish the breach, including an unknown vulnerability in the package registry system. OpenAI says that safeguards on their model had been disabled for the test, which seems irresponsible given the outcome. Under almost any normal situation, conducting an unsolicited test of the security of a company because safeguards were ignored is considered illegal hacking, not fodder for a pre-IPO press release and humble-brag.

Linux Kernel Discloses 442 Vulnerabilities

Possibly feeling that Microsoft has all the press for a record-breaking Patch Tuesday last week, the Linux kernel developers have announced 442 CVEs related to the kernel.

With this many vulnerabilities in one report, it’s nearly impossible to isolate at a glance which ones are truly impactful and which are simply incorrect behavior. While CVE entries have been created, none have been assigned severity scores yet.

It appears the majority of the vulnerabilities were found with Sashiko, an agent developed by the Linux Foundation and trained on the Linux kernel for finding vulnerabilities in new submissions.

LG to Ban Residential Proxy Apps

After recent negative press (some of which we covered here) about the prevalence of residential proxy apps on the LG platform, Krebs on Security now reports that LG is banning the behavior from apps on the platform.

This comes after Spur reported that 42% of apps on the platform contained libraries to enable always-on residential proxies, which allow access to the network the television is connected to. Residential proxies can be used as a pivot point to attack companies and bypass geographic IP restrictions, commit ad fraud, or access the internal home networks of users.

Iran Attacking Industrial Logic Controllers

CISA, the US cyber security agency, has issued a warning that Iranian based attackers are targeting industrial control systems made by Rockwell Automation, Schneider Electric, and Siemens.

These sort of controllers are found in manufacturing, waste processing, water treatment, and other industrial processes, and attackers have been able to upload custom control logic, overriding “safe operating parameters” according to the report. Most of us will never be responsible for these systems, but they impact our lives all the time.

Cisco Releases Open-Weight Vulnerability-Finding Models

Finally, Cisco has released a set of open-weight models to aid in searching a codebase for known vulnerabilities. The Antares models are open-weight models designed to run fully locally and search a code base for vulnerabilities related to lists of known CVE issues. Cisco has published the models on Hugging Face.

Are you using AI tooling for security scans or research? How is it going?

hackaday.com/2026/07/24/this-w…