This Week In Security: Four-Digit Patch Tuesday, SSH Exploited, GitBook Breach, Android GhostMap

November 13, 2026 by No comments

It’s the second Tuesday of the month, and that means another Microsoft Patch Tuesday. The new normal is that the numbers are hard to believe. Brian Krebs reports that this month’s release fixes nearly 1,100 vulnerabilities, 63 of them rated critical, and over 500 that let an attacker elevate their privileges. Only one is reported as actively exploited: CVE-2026-124194, a spoofing bug in Outlook. Microsoft has now shipped more than 5,100 security fixes this year, after more than 1,400 last month, compared to an average of around 100 a month last year. Obviously AI tools get the credit for the volume of bugs fixed, but also of course for the volume of bugs found.

Everyone else is busy too. Apple pushed out-of-cycle updates for at least nine vulnerabilities across its operating systems, including an iMessage flaw which could let a remote attacker join a group chat and read its messages, and backported the fixes to iOS 18. Chrome 157 fixes CVE-2026-125350, another Chrome zero-day, a week after a Chrome release which fixed more than 200 bugs, Firefox 160 fixes almost 100 CVEs, and Adobe fixed more than 110.

Also since last week, zlib 1.4 shipped with more than a dozen security fixes, eight more vulnerabilities were disclosed in the X.Org server and XWayland, and Microsoft’s own Azure Linux update lists more than 470 CVEs fixed across the open source packages it ships. And for a perfect encapsulation of 2026, last month’s Patch Tuesday included a remote code execution bug in Windows Paint (CVE-2026-83844), though its description admits the code runs locally. So now I guess you can pop Calc through Paint? Does this count as a win?

Despite the absolute firehose of vulnerabilities, the Krebs article notices that of the roughly 95,000 CVEs assigned this year, only around 200 made it into the CISA list of known expoited vulnerabilities (KEV). If you have to pick and choose which updates are the most critical, start there.

Continue reading “This Week In Security: Four-Digit Patch Tuesday, SSH Exploited, GitBook Breach, Android GhostMap” →

Fixing A Dead Socket LGA 1851 Mainboard With A Resistor

November 13, 2026 by 3 Comments

Doing board level diagnosis on a PCB is hardly black magic, but some PCBs are definitely more daunting than others. The Socket LGA 1851 mainboard that [Fix the Pixel] got in for repair being one of the harder cases due to the sheer size and complexity. Adding to the excitement was having to purchase a used CPU for it off eBay to even test the board and work through the boot-up sequence to find the culprit.

A basic understanding of how these mainboards power up and verify that they can move on to the next phase is essential here, starting with the power rails. Although the culprit turned out to be a single missing 5.1 Ohm resistor on an SPI clock line, you still have to reason your way through the diagnosis. For this mainboard the boardview was fortunately available, but that still doesn’t make it easy to spot components that have quietly left the chat.

With the CPU and RAM installed the board doesn’t bother to boot up, with the VRM controller for the CPU’s power phases showing its enable pin to stay low. Going down the list of conditions for this pin to be pulled high the culprit was eventually found, when the PCH – the board’s chipset – never reading the BIOS chip.

Checking the SPI lines on the mainboard near the BIOS chip quickly showed the knocked-off resistor on the SPI clock line. Soldering a fresh resistor in place resulted in the board happily booting up once more. Although having a boardview here available helps a lot, checking such basics like the SPI line resistors around the BIOS can be a quick checklist item before dragging out the big diagnostics guns or shelling out money for a boardview file.

Continue reading “Fixing A Dead Socket LGA 1851 Mainboard With A Resistor” →

Hacked Nixie Clock Waits For The Bus

November 13, 2026 by 2 Comments

Nixie clocks have become popular enough that these days there’s no shortage of turn-key options that let you experience that warm glow with a minimum of fuss. Many still come as little more than a bare PCB, giving the purchaser some freedom to come up with their own enclosure, but at least the electronics are handled.

But for [Justin Scott], putting his new two-digit Nixie clock board into a handsome box was only half the battle. He also wanted to do something a bit more interesting than just tell the time. To convert the board from a simple clock to a device that could show how many minutes until the next bus showed up at his local stop, he had to hack the firmware and establish a communication link to a Raspberry Pi to do the heavy lifting.

The first step was to get a modified firmware on the clock PCB, and that required a ST-LINK V2 programmer and some time tracing out the pins on the STM8 microcontroller to determine how they controlled the various elements of the Nixie tubes. Fortunately, there were just I/O pins left over to stand up a serial link to a Raspberry Pi Zero through a level converter.

On the Pi side, a Python script hits the bus API to figure out what’s coming and when. There’s some creative blinking of the decimal points to indicate what’s happening behind the scenes, but primarily the display simply shows how many minutes are left before [Justin] should be out waiting for his ride.

It would be nice if all those commercial Nixie boards would talk I2C, but at least projects like this show it’s possible to get more out of them than just the time.

A Desktop OS For The ESP32-P4

November 12, 2026 by 36 Comments

The ESP32-P4 is Espressif’s high-end application processor, with two blistering fast RISC-V cores for a surprisingly reasonable price. As it’s a very capable computer in its own right, there have been a range of operating systems made for it. Latest among them is [Jthwho]’s BMDS, for Bare Metal Do Stuff, which targets an Olimex board.

At its heart is the FreeRTOS kernel we’ve seen in so many other similar projects, but on top is an OS which is described as being like DOS in its one-user minimally intrusive operation. It runs ELF binaries, and has some POSIX compliance, with BusyBox being a port. Perhaps most noticeable is its GUI, which provides a very slick desktop straight out of the late 1990s.

We can see that had this appeared as a contemporary of Amigas, 68k Macs, and Windows 3.x, it would have immediately been a real contender. But the question is, does such an OS have a niche here in 2026? We think it might, as this processor is slowly establishing itself in a new genre of powerful machines aimed at hackers and tinkerers. Either way it’s an impressive achievement, and we look forward to seeing it develop over time.

Hacking Meta’s Smart Glasses

November 12, 2026 by 3 Comments

Meta’s Ray-Ban smart glasses have attracted plenty of controversy in the relatively short time they have been available, given their potential for covert and unvanted surveillance. But given the chance to examine one it would be churlish to pass up on the opportunity to test its defences. Which is what [p0pcycle] did when the opportunity came her way.

Given that hardware-probing was not an option, she followed the course of intercepting a software update. A little app decompilation led her to the full firmware, and she was able to probe its secrets. There’s a developer mode allowing applications to be written for the glasses, and it takes the form of an APK that loads the application code. An early firmware version would trust self-signed apps, so she could get arbitrary code on the device. From there after some trial and error she was able to expose a network listener, and there she had it.

The write-up is an interesting walkthrough of the process, and ends with her reporting it through their bug bounty program. So sadly the steps outlined above won’t work on newer firmwares, but we’re guessing that won’t stop others probing this device further.

Watch That Sound: Your Own Chladni Plate

November 12, 2026 by 8 Comments

What if you could see sound? A Chladni plate uses a speaker and small particles, like sand, to give you a visual representation of sound, and [CrazyScience] shows you how to make one. The plate dates back to 1787, created by the eponymous physicist. Of course, back then, there were no speakers, so the original plate was metal with a violin bow raked across the edges.

The modern version uses an ESP32, a speaker, and salt. The patterns depend on the resonance points of the plate. The device has a rotary encoder to tune different frequencies. Check it out in the video below.

Continue reading “Watch That Sound: Your Own Chladni Plate” →

Upgrade Your CoCo The Modern Way

November 12, 2026 by 4 Comments

The Radio Shack TRS-80 Colour Computer may never have achieved the sales volume of its competitors from Commodore or Apple, but it offered a surprisingly capable set of hardware. There were three versions, with the final one being a significant upgrade in many ways. There was no upgrade path for owners of version 1 and 2 machines to have a version 3 back in the day, but now thanks to [Felipe Antoniosi] such an upgrade is possible. How? With a Tang Nano 20K FPGA board, of course!

The CoCo 3 had a paged memory system for expansion up to 512k, as well as a significantly more capable graphics chip which while compatible with the original Motorola part offered enhanced graphics. The upgrade emulates these, and connects to the CoCo via a set of daughter boards that connect to where the various motherboard chips sat. it offers an HDMI output as well as analog video and enhanced sound capability, bringing the machine firmly into the 21st century.

As mods go to classic hardware, this is quite an invasive one. Whether or not you’d prefer to do this to your CoCo is up to you, but ask yourself this, would you have done this had this board been available in the 1980s? Of course you would.

Meanwhile should you become bored with the CoCo, it can also be persuaded to emulate an Apple ][.