Hackaday Podcast Episode 393: Epaper, Tamagotchi Hacks, And Supercon Talks Galore

October 30, 2026 by Jenny List No comments

This week’s podcast comes from Europe, as Elliot Williams is joined by Jenny List, who wishes to apologies for the poor sound quality from her headset microphone. The news this week is our Supercon conference which is upcoming, we’ve released more speaker details.

We start the hacks with a follow-up to an exciting development. We’ve seen e-paper screens driven at high frame rates, but do the techniques used shorten the life of these displays? Then we have Tamagotchi hacking, re-using an old mobile phone as a flight controller, the oldest Windows app to run on Windows 11, and probably the prettiest mini TV studio rack you will ever see. Pushing Bluetooth out to 12 kilometres is the cherry on the cake.

In quick hacks there’s a swash plate-less helicopter, Commodore 64 keycaps, and the history of the mouse, before our can’t-miss look at infra-red transmission, and a forgotten Google VR headset.

Check out the links if you want to follow along, and as always, tell us what you think about this episode in the comments, or drop us a line on the mailbag.

Download yourself a little podcast, won’t you?

Continue reading “Hackaday Podcast Episode 393: Epaper, Tamagotchi Hacks, And Supercon Talks Galore” →

This Week In Security: Broken Embargoes, UEFI Overflow, Wormable Tailscale, Starlink Ad Snooping, And A DHS Directory Dump

October 30, 2026 by Mike Kershaw 1 Comment

Last week brought us at least two broken embargoes: php2shell leaked onto Hacker News a day early, and a batch of Linux kernel bugs landed on the public kernel mailing list instead of the private security list. This week has been slightly less exciting overall, fortunately, but Akamai’s security team published a pointed essay titled “TLP Is Not a Suggestion”, and it’s hard to argue with the timing.

When a researcher finds a serious bug, the usual process is “coordinated disclosure”. The developers get time to build a fix, and downstream vendors get advance notice under embargo so patches and protections are ready the moment details go public. The Traffic Light Protocol (TLP) is the vocabulary everyone uses to say who may know what: TLP:RED for named recipients only, TLP:AMBER for an organization and its clients on a need-to-know basis, TLP:GREEN for a trusted community, and TLP:CLEAR for anyone. It has no legal teeth whatsoever. It’s not classified data in a legal sense. It works because everyone involved agrees to make it work.

Akamai’s complaint isn’t really about the original php2shell leak, but about what came after: vendors and researchers racing to confirm, reproduce, and publish first. According to Akamai, a researcher published a reconstruction of the bug before the patch existed, and exploitation attempts started before most admins knew there was anything to patch. They draw parallels to Heartbleed in 2014, where a handful of companies got early notice and then advertised that they were already safe while Linux distributions were caught flat-footed, and to Meltdown and Spectre in 2018, where a six-month embargo collapsed six days early.

In the rush to publish, it’s also become less clear what the actual severity of the bug is in the real world. It clearly exists, and is of concern, but groups are still struggling to prove a complete exploit path, with several challenges showing results but nothing definitive so far.

Their advice boils down to “protect first, publish second”: push the detection rules and virtual patches, tell your customers privately, and save the blog post for after the official advisory. With AI tooling shrinking the time between “details exist” and “working exploit” to hours, the cost of a broken embargo is going up, not down.

Continue reading “This Week In Security: Broken Embargoes, UEFI Overflow, Wormable Tailscale, Starlink Ad Snooping, And A DHS Directory Dump” →

2026 Hackaday Supercon: All The Speakers!

October 29, 2026 by Elliot Williams 3 Comments

We announced our first round of speakers, and then the workshops, and we were going to dribble out updates on the rest of the speakers as they came in, but then time slipped away from us. So we are left here announcing a veritable cornucopia of twenty wonderful talks that you absolutely won’t want to miss.

Supercon is just about a week away, and there are still a few tickets left, so grab them now before it’s too late.

And the talks are just half the fun. Between food, merriment, a killer badge with the biggest e-paper display that you’ve ever seen, and all the assorted shenanigans, it’s the highlight of our hacking year. Come join us!

Continue reading “2026 Hackaday Supercon: All The Speakers!” →

Hackaday Links: October 25, 2026

October 25, 2026 by Tom Nardi 8 Comments

Some disappointing, but perhaps not entirely unsurprising news this week out of Denmark — after announcing last year that they would transition away from Microsoft’s proprietary software, the realities of making it work seem to have caught the government off guard. The word is that a trial program immediately ran into problems when government employees that had been given Collabora tried to collaborate with their peers running Office, and has since been quietly abandoned.

Although there’s probably a joke to be made about different parts of the government not knowing what the other ones are talking about, the reality is that if one group of staffers can’t reliably access the data being produced by another, that’s a pretty big problem. Of course, had they simply asked us nerds, we could have advised them that these sort of issues are inevitable if you don’t fully commit to the effort.

Had the entire government moved to the Open Document Format (ODF) at once they would have avoided the issue, at least when it came to newly created documents, but obviously that’s a considerably larger undertaking than installing Collabora or OpenOffice on a few dozen machines and calling it a day. There’s no word yet on how this stumble will impact Denmark’s larger effort to free themselves of proprietary software, but we’d hazard a guess it’s not a great sign. Hopefully things go better for the Dutch.

Continue reading “Hackaday Links: October 25, 2026” →

Making For Others

October 24, 2026 by Elliot Williams 3 Comments

One of the nicest things about the Hackaday community, and the open-source hardware community at large, is the incredible generosity of one hacker to another. But it’s not purely altruism – it’s also just a great feeling to be able to share your work with other folks who understand what it represents and how to use it.

I’m looking at my workbench right now. Because I’ve been testing out the Supercon badge prototype, there is a small pile of SAOs to the right. SAOs are the perfect size for giving out to fellow hackers, because they can be small, inexpensive, and yet still embody a ton of your creativity. [Tom]’s marvelous Ode to the SAO, even opens with this as one of the main benefits, alongside teaching you “full-stack” PCB production at small scale; they are cheap enough that you can give them away. Of course, you end up getting as many or more than you give, so it’s not just the pure joy of giving at work in the SAO scene.

On my left, I have a couple dev boards made by fellow hackers. One is a clone of the Raspberry Pi Pico that’s made by the high-school students of Hack Club, and the other is [CNLohr]’s ch32v003fun board and esp32s2-funprog programmer. I needed to test out a quick microcontroller application, and having a few dev boards on hand is always useful. Because I know the people who made these boards, I tend to reach for these over their commercial alternatives. Romantic? Maybe. But they were given to me by friends.

And of course the badge prototype is sitting in the middle of all this, and that’s how I really know about the joy of giving away your designs to fellow hackers. We at Hackaday are in the incredibly fortunate position of being able to dream up a new and fun badge every year, and give it out to hundreds of fellow hackers. Heck, this year, we’re making 1,000. I say “fortunate” because we don’t have to pay for them ourselves, but rather our Supercon sponsors help pick up the bill, and that means we can make stuff that’s far cooler than our budgets would otherwise allow.

So to everyone in the SAO scene, may you give away your designs to people who really appreciate them. For the folks who have built tools for other hackers to use, you should know that the recipients probably reach for your boards over their bland commercial alternatives. And for all of you coming to Supercon in two weeks, we hope you dig the badge. It has maybe become a bit of a cliché these days, but you should know that it’s made with love.

Hackaday Podcast Episode 392: Microscopes, Drones, And Other DIY Things

October 23, 2026 by Al Williams 1 Comment

Hackaday Editors Elliot Williams and Al Williams met to review the week in Hackaday. Turns out, it was a week for tiny things, cybersecurity, nostalgia, and projects that would have been nearly impossible for the average hacker not that long ago. But first, you can hear a little about the upcoming Supercon badge and the trials of importing and exporting parts for the badges.

How many props does your drone have? [Joshua] has one. Want to fabricate semiconductors at home? Do you have a microwave? What about using NFC in your next project? There’s all that and more in this episode.

The quick hacks include a request from NASA for ideas (and, yes, there is prize money) and slide rule tricks, among other things. For the can’t miss articles, the cybersecurity weekly got some appreciation and Al took a trip down memory lane at the Altair 8800 he always wanted.

Check out the links if you want to follow along, and as always, tell us what you think about this episode in the comments, or drop us a line on the mailbag.

Download in DRM-free macroscopic MP3.

Continue reading “Hackaday Podcast Episode 392: Microscopes, Drones, And Other DIY Things” →

This Week In Security: Record Patch Tuesday, PHP’s Bad Time, The Oldest Vuln, AI Armies, And More

October 23, 2026 by Mike Kershaw 26 Comments

It’s no longer a proper month without Microsoft breaking its own record for security fixes, and October’s Patch Tuesday was no exception. Brian Krebs brings the roundup: more than 1,400 vulnerabilities fixed in a single batch, dwarfing September’s record of nearly 1,000, which itself was about ten times the normal monthly load. According to Tenable, Microsoft has now passed 4,000 CVEs for the year with two months still to go.

Only one of the fixes is for a vulnerability already being exploited in the wild: CVE-2026-96951, a security feature bypass in the Windows Shell affecting Windows 10, 11, and some Server versions. A .NET Framework bypass, CVE-2026-108398, was publicly disclosed before the patch, giving attackers a head start, and with modern AI tooling, it seems like not much of a head start is needed. At least 78 of the bugs are rated critical, and most of those allow remote code execution with little or no user interaction. Windows 10 holdouts can relax a little: Microsoft quietly extended free updates through October 2027. Given the pace of exploitation, this is probably the only way to prevent an Internet-scale meltdown.

Microsoft credits LLM-driven bug hunting for the volume, which leaves the poor admins who have to test and deploy all of this in an unenviable spot. Fortra’s analysis shows that only 26 Microsoft vulnerabilities have landed in the CISA KEV catalog of actively exploited bugs so far this year, so start there. For the rest, the SANS Internet Storm Center and Cisco Talos have the usual breakdowns by severity. Or, you know, just patch everything and hope for the best, which is roughly what everyone does anyhow.

Continue reading “This Week In Security: Record Patch Tuesday, PHP’s Bad Time, The Oldest Vuln, AI Armies, And More” →