This Week In Security: Baked-in Malware, Freezers Not Freezing, Zoom Snoops Clipboards, And AI Makes Things Worse, Faster

September 4, 2026 by Mike Kershaw 18 Comments

The AI platform ServiceNow which offers both hosted and on-premises versions just patched a trifecta of CVSS-10 vulnerabilities.

CVSS rankings are determined by the severity of a flaw, the ease of exploiting the bug, if authentication is required for exploitation, if the vulnerability exposes confidential data, and other criteria. A CVSS of 10 is as bad as it gets, and having three of them at once is certainly attention-getting. Of the three vulnerabilities fixed, one allowed unauthenticated modification of data in the hosted instance, a second allowed arbitrary code execution via the GraphQL interface, and the third allowed arbitrary SQL commands that could modify the database.

ServiceNow claims Adobe, Lenovo, Fedex, and Fujitsu among their high-profile customers. With luck, the vulnerabilities were patched before significant public exploitation could happen.

Router Malware

Previously in 2026 the US Government warned against embedded malware found in consumer routers, which may be linked to the FCC enacting bans against certification and import of foreign-made consumer devices. This week, the NVD (National Vulnerability Database) reported specific embedded malware in the Zbtlink and MoreQuick brands of devices.

Multiple versions of the firmware, for multiple lines of products, contain a backdoor service that uses unencrypted UDP to connect to a command and control (C2) service. The service, or anyone able to intercept the network traffic, since it’s unencrypted, can execute commands as root, allowing them to change configurations, open tunnels, or steal ISP credentials.

The malware is baked into the firmware, so removing it is impossible for most users: a factory reset wouldn’t do. In theory if third-party firmware like OpenWRT supports these devices, the hardware could be made safer with a custom install.

Given how commonly the same device is marketed under dozens of names, likely the same devices and firmware have yet to be identified under other brands. Continue reading “This Week In Security: Baked-in Malware, Freezers Not Freezing, Zoom Snoops Clipboards, And AI Makes Things Worse, Faster” →

Take Tool Photo, Generate Custom Gridfinity Bin

September 4, 2026 by Donald Papp 24 Comments

What if the organization and storage benefits of tool shadowing could be had and improved with a modular, semi-automated process? Tracefinity attempts that by generating custom Gridfinity bins from photos of tools, and has quite a few nifty features that are worth a look.

Maintaining a library of tools makes it easy to create project-based custom layouts.

The basic workflow is this: place one or more tools on a sheet of paper, take a photo, then upload the photo and have the system trace and save the outline and add it to a private tool library. When one is ready to create some bins, use the library of saved tool outlines to generate custom Gridfinity layouts.

If you’re unfamiliar, Gridfinity is a modular system of standardized bins and baseplates designed with 3D printing in mind, making it an ideal match for highly-customized organization tasks and a particularly natural fit for a tool-tracing system like this one.

The idea of taking a photo of a tool and generating a custom bin is a compelling one, and a couple years ago we covered a project that did just that. Tracefinity seems like a natural evolution of the idea, and includes handy features like easy design adjustments, optional magnet holes, and we really like the concept of a tool library from which individual tools are scanned once then later selected to create specific, project-based layouts.

Tracefinity takes advantage of new software capabilities like machine learning to improve and streamline the tracing process, but that doesn’t mean it relies on any external services. It can be entirely self-hosted and by default uses a local, CPU-friendly object detection model for tool tracing. There is an option to provide a API key to use Google Gemini instead, but it’s not required. It can come in handy for especially complex tool outlines or dealing with non-ideal source photos, however.

The Birds Outside, Drawn For You Automatically

September 4, 2026 by Jenny List 23 Comments

With artificial intelligence being the bête noir of the moment, there are some projects using it which maybe don’t bring much to the table. So it’s nice to see one that uses it in a creative way, and delivers something new. [arnegiacomo]’s e-paper screen is a great example, as it draws a picture in real time of whatever birds are outside.

Behind the quite large screen sits a Raspberry Pi 5, and on that is BirdNet-Go, an AI-powered birdsong classifier. A USB microphone catches the birdsong, and Birdnet comes up with the species. The birds on the display are then those species as pictures from 19th century bird spotters guides, assembled into a collage. You can even see what the current set of birds it hears are, live, and they are a representative cross section of the European birds you’d find in Norway where it’s located.

We like this project, both for the bird book vibe it gives, and the creative use of machine classification. Surprisingly this isn’t the first project in this field we have seen over the years.