Commercialization And Innovation

August 1, 2026 by Elliot Williams 3 Comments

The last year or two has seen relatively affordable multi-material printers hit the market, and the question that [Tom Nardi] and I were kicking around when he was writing up the 2025 year-in-review article was what it was going to mean for our folks. I don’t think he got it wrong per se, but his heading for that section “Grandma is 3D-Printing in Color” only tells half the story.

He did get that part right, though. We’ve certainly seen a flourishing of multi-material designs out there that take advantage of the availability of (usually) four colors. The ability to print in color has given life to the purely decorative models, of course. Think full-color Pokemon desktop toys, for instance. But even functional prints have benefited from contrasting color labels printed right into the box, not to even mention the multi-material supports that pull off easier and cleaner than ever before.

Since most of these multi-filament machines are pretty much locked down as far as hardware tinkering goes, our sights were firmly locked on what the end-user would do with the new capability. But we overlooked the third axis of 3D printering: the software hackers. And it’s precisely in this area of slicer and path-planning that we’ve seen some of the coolest developments this year. Why? Because people have the hardware in their hands that they need to test out the algorithms.

FullSpectrum and the more recent ImageMap are two techniques to get the missing in-between colors out of a four-filament printer, and in particular ImageMap tries to get the job done faster, and with fewer purges. We are amazed to see two different approaches to color blending popping up in just a few months of each other, and we have no doubt that work on this is going to continue.

At the end of the day, this really is just “put new tools in the hands of creative hackers, and they’ll find new ways to use them”, so we shouldn’t have been surprised at all. But if this is what comes out of the commercialization of the multi-material printer, what’s going to come when some of the more esoteric machine designs go mainstream? We can’t wait to find out!

Hackaday Podcast Episode 380: 3D Printing The Rainbow, IR And IP Camera Hacks, And Americium 241 On The Loose

July 31, 2026 by Al Williams No comments

Elliot Williams and Al Williams got together to compare notes on the most interesting posts this week on the site. As usual, there are just too many choices, so you’ll have to settle for just the few that can fit in a podcast. The guys were excited about 3D printing — both FDM and SLA — as well as a few camera projects. Ever wanted your own starship? They do, too, and you’ll hear about it along with portable radar and more.

Want to make flexible PCBs? Fill up a carbon dioxide tank? Or play Doom via regular expressions? Tune in, and you’ll find out about those stories and more.

Follow along with the links, and as always, tell us what you think about this episode in the comments! Better still, drop us a note in the mailbag, and you might hear your question on a future episode. You can record audio or send us a message, and one of the hosts will read it on your behalf.

Direct download in IR color-corrected DRM-free MP3.

Continue reading “Hackaday Podcast Episode 380: 3D Printing The Rainbow, IR And IP Camera Hacks, And Americium 241 On The Loose” →

This Week In Security: What’s In A Name, The AI Bugpocalypse Hits Everyone, OpenWRT Flaws, And Duress Passwords

July 31, 2026 by Mike Kershaw 14 Comments

The great thing about standards is there’s so many to pick from, right?. (Insert obligatory XKCD #927 here.) Several companies have developed naming schemes to refer to groups of attacks, and now Google has too.

Sometimes, malware, ransomware, or exploit groups name themselves: “Shinyhunters”, “LapSus$”, “Cl0p”, “Lockbit”, and so on. For the groups that don’t advertise their presence, identification and naming can be more difficult. Mostly state-run affairs that didn’t want to draw attention to themselves, these Advanced Persistent Threats (APT) groups were originally simply given numbers. APT28 refers to the Russian GRU Intelligence Directorate suspected of hacking the Democratic Party email servers, APT38 is a North Korean governmental agency involved in financial and crypto currency theft.

Multiple companies and agencies have developed naming schemes to make referring to threat groups easier, typically including a regional identifier as well. CrowdStrike naming uses name groups like “Bear” group for suspected Russian actors, “Panda” for China, “Spider” for unattributed crime groups, while Microsoft uses “Blizzard”, “Typhoon”, and “Tempest”.

Google, deciding there weren’t enough classifications already, now introduces “RELIC”, “CASTLE”, and “COMET”. Of course, each naming organization has dozens of other classification groups as well, but now the next time you hear about an attack being attributed to “Scattered Spider” you know it’s the CrowdStrike name for a crime group.

Critical OpenWRT DHCP Flaw Fixed

The Hacker News reports on a major release of OpenWRT which includes fixes to the odhcpd server, the embedded DHCPv4 and DHCPv6 server written by OpenWRT.

The bug is a straight-forward stack style attack where a buffer is allocated, but not length-checked against the data required to reply to a malformed request. OpenWRT runs on a wide range of devices, but one of the most popular legacy platforms still in use, the MIPS processor architecture, lacks most modern security protections against stack-based attacks, making this attack sting more than it might on other architectures.

The latest OpenWRT releases also fix issues in the uhttpd embedded web server, multiple issues in the LUCI web configuration interface that allowed attackers to inject cross-site scripting content and Linux kernel security fixes. If you run a direct OpenWRT build on your equipment, update! These bugs will have an extremely long tail however, with tens of thousands, or likely more, OpenWRT-based devices that will never see updates.

The company behind several of the findings, Hacker House, say they used multiple AI tools and both open and frontier models to discover the bugs, then manual review and testing to confirm before reporting.

Cisco to Stop Assigning (some) CVEs

Cisco has announced it is moving to a twice-monthly patch cycle. Additionally, Cisco will no longer assign CVEs to each bug in the release.

Cisco says this is in reaction to the rapid increase in bugs found by AI tools, and that “Assessing security risk CVE-by-CVE and applying point mitigations is no longer fit for purpose.” Cisco will still assign a CVE to a bug that “requires compensating controls” or is known to be exploited.

It seems like it will be business as usual for the most severe bugs, but it will be interesting to see what happens when exploits are found for bugs which did not get a CVE in a prior release.

Microsoft Suggests Three-Day Patch Race

Microsoft is now recommending a 3 day patch window for new patches. This is, to say the least, an “aggressive” schedule for applying new patches, given the recent track record of issues introduced by patches.

A update that crashes is inconvenient on a home computer — even more so if it’s your parent’s computer — but could be catastrophic when it brings down an entire corporate fleet. Most large organizations have their own internal patch schedules and internal testing requirements before patches are deployed, delaying the patch process further.

Systems like the CISA KEV database, a list of vulnerabilities known to be actively exploited, are in place to help identify the most important issues. With repeated record-breaking numbers of vulnerabilities pushed in Patch Tuesday and the decreasing support of the KEV and related vulnerability indexing systems, the load on IT departments and administrators is becoming impossible.

The AI “bugpocalypse” is finding record numbers of vulnerabilities, while also closing the timeline between bug to exploit to hours in some cases. The time between bug and exploit then drives the patch cycle, which means less testing. With less testing, the patches are less stable, leading to less trust in rapidly installing them.

Oracle Patches Almost 1500 CVEs

Moving directly from the impacts of the flood of Microsoft security issues, the July 2026 patch set from Oracle included fixes for 1499 security issues and 1434 CVEs over 334 Oracle products.

Oracle is also pressuring administrators to move to a monthly patch cycle, but acknowledges “transitioning to a monthly security patching cadence may require updates to existing operational processes”. Not to worry – there is a Oracle consulting service you can hire to help you patch your Oracle problems.

Linux Patches 323 CVEs in Two Days

After announcing over 400 CVEs in the Linux kernel last week, Linux mainters have announced an additional 323 in the last three days alone. The vulnerabilities cover Bluetooth, Ethernet, USB gadget mode, WiFi drivers, virtualization systems, SMB file sharing, and of course more.

One benefit to the architecture of the Linux kernel is that typically all the fixes will arrive in a single kernel update, but when almost every week brings critical updates and a new kernel, patch fatigue is a real thing. Either users stop applying every update, or the uptime and testing requirements of a company prohibits constantly updating and changing servers.

Duress Passwords Aren’t Necessarily a Good Thing

The security-hardened Android variant Graphene, is in the news this week for the use of duress passwords.

A duress password is a mechanism where a second PIN or password can be used to initiate a device wipe. The hope is that in a situation where you are compelled to unlock a device, providing a password which then wipes the device is a preferable option.

The legality of a duress password depends on the environment it is used in. The United States Customs and Border Patrol claims that by wiping a device during an inspection at the US border, Samuel Tunick destroyed evidence and property in violation of federal laws. The issue is compounded because the stop happened at a border, where many US laws against search, seizure, and the availability of a lawyer are suspended, even for US citizens.

The inclusion of duress passwords, and their cousin hidden encrypted volumes, can sound like a good idea, but can place users in serious danger when in situations with less strict rules of law. Having the ability to wipe data sounds great in isolation, but protestors, human rights workers, and other targeted groups have faced direct and physical threats under some regimes. Facing retaliation for wiping a device, or facing physical violence before providing an unlock code out of fear that it might wipe a device, can be a real risk for some.

FreeBSD Fixes a WireGuard Bug

FreeBSD has issued a security update pertaining to the WireGuard VPN implementation.

WireGuard is a modern VPN with excellent performance even on low-end systems, and which has implementations on basically every platform. The FreeBSD implementation, however, didn’t fully validate VPN packets, accepting packets without checking one of the cryptographic validation measures.

Attackers are able to inject data to a FreeBSD WireGuard implementation if they are able to guess some attributes of the connection, and able to fully modify the data in the VPN if they are able to intercept the packets.

The bug impacts any FreeBSD user of WireGuard. FreeBSD has released updated kernels.

FLOSS Weekly Episode 877: RCE As A Service

July 29, 2026 by Jonathan Bennett No comments

This week Jonathan chats with Francois Proulx about SmokedMeat! That’s the third in a trio of Open Source security tools from Boost Security, and this one is the red team tool to demonstrate vulnerabilities. Why are Continuous Integration vulnerabilities such a persistent problem, and what’s on the horizon that may help? Watch to find out!

Continue reading “FLOSS Weekly Episode 877: RCE As A Service” →

Hackaday Links: July 26, 2026

July 26, 2026 by Tom Nardi 15 Comments

At a time when so-called “artificial intelligence” seems inescapable, we were encouraged to see news that Amazon will be cracking down on third-party sellers that use AI-generated images for their product listings. They won’t be prevented from using the images, but they will need to clearly indicate that they don’t represent reality and were produced via artificial means. This comes in response to a recently enacted New York law that requires the disclosure of AI in advertisements.

Will this be the end of the cat sleeping bag?

But it’s not quite a clear cut as it might seem on the surface, as the New York law is actually about AI-generated people rather than products. Specifically, it’s designed to make it clear when a “synthetic performer” has been used in place of a human actor. As such, it would appear that the easiest way for Amazon sellers to dodge the new rule is to simply not include any humans in their AI slop images and videos. In other words, they can continue to post fake pictures of products without having to inform the consumer so long as they don’t show a fake person holding it.

Under normal circumstances we’d leave something like this next one for our weekly security column, but the utter lack of security in the Pope’s official “Click To Pray” mobile application revealed by researcher BobDaHacker on Friday is just too good a story to pass up. For one thing, who knew that there was an “official” prayer app? We don’t dabble in theology around these parts, but we’re fairly sure the good book didn’t mention anything about requiring a smartphone to give praise.

Continue reading “Hackaday Links: July 26, 2026” →

Add Sensors To Everything!

July 25, 2026 by Elliot Williams 25 Comments

“You can’t control what you can’t measure” goes the old chestnut. But that’s a little bit negative, in my opinion. Instead, think of the benefits of sprinkling sensors around everywhere: you gain insight where you simply didn’t have it beforehand.

We were thinking about this in the context of the recent video on pressure advance in 3D printers. Essentially, the unmelted filament acts as a springy piston, and that springiness means that the pressure built up in the melted plastic lags the feedrate of new filament. We usually calibrate this out with a guesstimate constant, but it can be different for every different filament. Measuring that pressure directly with a strain gauge in the hot end makes more sense.

But then there are knock-on benefits of having a sensor in the hot end. You can use the strain gauge as Prusa does to run the nozzle gently into the bed and set the z-axis height. Or you can use over-pressure as a sign that the nozzle is clogged. It’s quite possible that you can use it to signal other things that can go wrong as well, but you can’t tell until you put the sensor on in the first place.

Of course, you don’t want to put a pressure sensor where you want to know the temperature, or vice-versa. But as a general rule, the more you can measure, the more you can discover about the way your system is running. How many strain gauges are too many?

Hackaday Podcast Episode 379: Driving E-ink DIY, NES On ESP, And The Other IRC

July 24, 2026 by Tom Nardi 1 Comment

On this episode, Hackaday editors Elliot Williams and Tom Nardi discuss their love of electronic paper, clunky cartridges, and keeping old games alive by any means possible. You’ll also hear about getting the most out of the sensors in our 3D printers, playing with X-rays at home, a ring that runs Java, and a roulette wheel that outgrew its 555 timer. Stick around to the end to learn about a different sort of IRC that’s even more niche than the one you’re probably familiar with, as well as the logistical challenges and potential benefits of catching rockets with a giant net.

Check out the links if you want to follow along, and as always, tell us what you think about this episode in the comments!

Direct download in DRM-free MP3.