Day: June 6, 2025

This Week In Security: Roundcube, Unified Threat Naming, And AI Chat Logs

June 6, 2025 by 4 Comments

Up first, if you’re running a Roundcube install prior to 1.5.10 or 1.6.11, it’s time to update. We have an authenticated Remote Code Execution (RCE) in the Roundcube Webmail client. And while that’s not quite the level of chaos that an unauthenticated RCE would cause, it’s still to be taken seriously. Mainly because for the majority of the 53 million Roundcube installs out there, the users aren’t entirely trusted.

The magic at play in this vulnerability is the Roundcube user session code, and specifically the session deserialization scheme. There’s a weird code snippet in the unserialize function:
if ($str[$p] == '!') {
$p++;
$has_value = false;

The exclamation mark makes the code skip a character, and then assume that what comes next has no value. But if it does actually have a value, well then you’ve got a slightly corrupted deserialization, resulting in a slightly corrupted session. This really comes into force when combined with the file upload function, as the uploaded filename serves as a payload delivery mechanism. Use the errant exclamation mark handling to throw off deserialization, and the filename can contain arbitrary session key/value pairs. A GPG class from the PEAR library allows running an arbitrary command, and this can be hijacked with the session manipulation. Continue reading “This Week In Security: Roundcube, Unified Threat Naming, And AI Chat Logs” →

In Film, What’s Old May Still Be New Again

June 6, 2025 by 15 Comments

We recently published an affectionate look at a Polaroid Land camera, whose peel-apart instant film is long out of production except for a very few single exposure packs form a boutique manufacturer. All that was left was a discussion of modifying it for conventional roll film, or perhaps hacking a modern back-to-front Polaroid sheet into it.

Never say never though, because along come the Chinese company Light Lens Lab with a short announcement at the end of a post talking about grain structures and anti-halation layer materials for their black and white film.

Lastly, with our future development plan, we are currently developing and researching instant peel-apart film, with plans on producing and making available black and white peel-apart film by 2025 in various format. We aim to have an update on our packaging and test shot for the next development/research progress installment. We are also researching, developing and producing colour reversal films that consist of a dye-incorporating development process, commonly known as K-14, for 135 and 120 formats in 2026.

So there you go, no sooner has Hackaday declared a format unavailable, than it shows every sign of reappearing. At this point we’d like to take the opportunity to report that McDonalds Szechuan Chicken McNugget sauce will never ever be available again. Continue reading “In Film, What’s Old May Still Be New Again” →

Soviet Calculator Teardown Reveals Similarities And Differences

June 6, 2025 by 12 Comments

Tearing down hardware from different parts of the world can be revealing, showing unique parts, techniques, and tricks employed by engineers living in a very different world from our own. To that end, [msylvain59] has been kind enough to give us a look inside the Elektronika MK-26—a calculator built in the former Soviet Union.

There’s lots of interesting stuff to see from the get-go. The oddball button pad is covered in Cyrillic symbols, quite alien to those of us more accustomed to the Latin character set. It’s also constructed somewhat unlike more familiar models from Western-aligned companies like Casio or Commodore. It also rattles when shaken, which doesn’t inspire confidence. Inside, it’s got old-school brown PCBs without the usual green solder mask, a chunky IC in a weird package, and display is via a power-hungry VFD.

It doesn’t look so totally alien inside; much of the construction is pretty typical of the mid-1970s, wherever you went around the world. The most striking differences are more in the graphics and visual design than anything else.

Ultimately, there are reasons why manufacturers around the world tend to converge on similar techniques. Generally, it’s because it’s more economical or easier to do things a certain way. And yet, we still see regional variances because conditions, technologies, and parts availability varies around the world. This teardown highlights that quite clearly.

If you’re just getting a taste for Soviet hardware teardowns, you’ll love this video diving inside a real Soyuz clock.

Continue reading “Soviet Calculator Teardown Reveals Similarities And Differences” →