This excellent content from the Hackaday writing crew highlights recurring topics and popular series like Linux-Fu, 3D-Printering, Hackaday Links, This Week in Security, Inputs of Interest, Profiles in Science, Retrotechtacular, Ask Hackaday, Teardowns, Reviews, and many more.
Join Hackaday Editors Elliot Williams and Tom Nardi as they talk about their favorite hacks and stories from the previous week. They’ll start things off with a small Supercon update, and go right into fusion reactors, AI surgeons, planned obsolescence, and robotic cats and dogs. They’ll also go over several entries from the ongoing 2025 One Hertz Challenge, an ambitious flight simulator restoration project, old school lightning detectors, and how Blu-ray won the battle against HD DVD but lost the war against streaming. Stick around to the end to hear an incredible story about a clandestine machine shop in a WWII prisoner of war camp, and the valiant fight to restore communications with the Lunar Trailblazer spacecraft.
Check out the links below if you want to follow along, and as always, tell us what you think about this episode in the comments!
Download in DRM-free MP3 and add it to your collection.
There’s a train vulnerability making the rounds this week. The research comes from [midwestneil], who first discovered an issue way back in 2012, and tried to raise the alarm.
Turns out you can just hack any train in the USA and take control over the brakes. This is CVE-2025-1727 and it took me 12 years to get this published. This vulnerability is still not patched. Here's the story: https://t.co/MKRFSOa3XY
To understand the problem, we have to first talk about the caboose. The caboose was the last car in the train, served as an office for the conductor, and station for train workers to work out of while tending to the train and watching for problems. Two more important details about the caboose, is that it carried the lighted markers to indicate the end of the train, and was part of the train’s breaking system. In the US, in the 1980s, the caboose was phased out, and replaced with automated End Of Train (EOT) devices.
These devices were used to wirelessly monitor the train’s air brake system, control the Flashing Rear End Device (FRED), and even trigger the brakes in an emergency. Now here’s the security element. How did the cryptography on that wireless signal work in the 1980s? And has it been updated since then?
The only “cryptography” at play in the FRED system is a BCH checksum, which is not an encryption or authentication tool, but an error correction algorithm. And even though another researcher discovered this issue and reported it as far back as 2005, the systems are still using 1980s era wireless systems. Now that CISA and various news outlets have picked on the vulnerability, the Association of American Railroads are finally acknowledging it and beginning to work on upgrading.
Laravel provides the encrypt() and decrypt() functions to make that process easy. The decrypt() function even does the deserialization automatically. … You may be able to see where this is going. If an attacker has the APP_KEY, and can convince a Laravel site to decrypt arbitrary data, there is likely a way to trigger remote code execution through a deserialization attack, particularly if the backend isn’t fully up to date.
So how bad is the issue? By pulling from their records of GitHub, GitGuardian found 10,000 APP_KEYs. 1,300 of which also included URLs, and 400 of those could actually be validated as still in use. The lesson here is once again, when you accidentally push a secret to Github (or anywhere on the public Internet), you must rotate that secret. Just force pushing over your mistake is not enough.
Fake Homebrew
There’s a case to be made that browsers should be blocking advertisements simply for mitigating the security risk that comes along with ads on the web. Case in point is the fake Homebrew install malware. This write-up comes from the security team at Deriv, where a MacOS device triggered the security alarms. The investigation revealed that an employee was trying to install Homebrew, searched for the instructions, and clicked on a sponsored result in the search engine. This led to a legitimate looking GitHub project containing only a readme with a single command to automatically install Homebrew.
The command downloads and runs a script that does indeed install Homebrew. It also prompts for and saves the user’s password, and drops a malware loader. This story has a happy ending, with the company’s security software catching the malware right away. This is yet another example of why it’s foolhardy to run commands from the Internet without knowing exactly what they do. Not to mention, this is exactly the scenario that led to the creation of Workbrew.
SQL Injection
Yes, it’s 2025, and we’re still covering SQL injections. This vulnerability in Fortinet’s Fortiweb Fabric Connector was discovered independently by [0x_shaq] and the folks at WatchTowr. The flaw here is the get_fabric_user_by_token() function, which regrettably appends the given token directly to a SQL query. Hence the Proof of Concept:
GET /api/fabric/device/status HTTP/1.1
Host: 192.168.10.144
Authorization: Bearer 123'//or//'x'='x
And if the simple injection wasn’t enough, the watchTowr write-up manages a direct Remote Code Execution (RCE) from an unauthenticated user, via a SQL query containing an os.system() call. And since MySQL runs as root on these systems, that’s pretty much everything one could ask for.
AI guided AI attacks
The most intriguing story from this week is from [Golan Yosef], describing a vibe-researching session with the Claude LLM. The setup is a Gmail account and the Gmail MCP server to feed spammy emails into Claude desktop, and the Shell MCP server installed on that machine. The goal is to convince Claude to take some malicious action in response to an incoming, unsolicited email. The first attempt failed, and in fact the local Claude install warned [Golan] that the email may be a phishing attack. Where this mildly interesting research takes a really interesting turn, is when he asked Claude if such an attack could ever work.
Claude gave some scenarios where such an attack might succeed, and [Golan] pointed out that each new conversation with Claude is a blank slate. This led to a bizarre exchange where the running instance of Claude would play security researcher, and write emails intended to trick another instance of Claude into doing something it shouldn’t. [Golan] would send the emails to himself, collect the result, and then come back and tell Researcher Claude what happened. It’s quite the bizarre scenario. And it did eventually work. After multiple tries, Claude did write an email that was able to coerce the fresh instance of Claude to manipulate the file system and run calc.exe. This is almost the AI-guided fuzzing that is inevitably going to change security research. It would be interesting to automate the process, so [Golan] didn’t have to do the busywork of shuffling the messages between the two iterations of Claude. I’m confident we’ll cover many more stories in this vein in the future.
Cryptojacking is the technique where a malicious website embeds a crypto miner in the site. And while it was particularly popular in 2017-2019, browser safeguards against blatant cryptojacking put an end to the practice. What c/side researchers discovered is that cryptojacking is still happening, just very quietly.
ZDI has the story of Firefox and a JavaScript Math confusion attack. By manipulating the indexes of arrays and abusing the behavior when integer values wrap-around their max value, malicious code could read and write to memory outside of the allocated array. This was used at Pwn2Own Berlin earlier in the year, and Firefox patched the bug on the very next day. Enjoy!
This week Jonathan and Katherine talk with Jamie Abrahams about Drupal, and how AI just makes sense. No, really. Jamie makes a compelling case that Drupal is a really good tool for building AI workflows. We cover security, personal AI, and more!
Supersonic air travel is great if you want to get somewhere quickly. Indeed, the Concorde could rush you from New York to London in less than three and a half hours, over twice as fast as a conventional modern airliner. Despite the speed, though, supersonic passenger service has never really been sustainable thanks to the noise involved. Disruption from sonic booms has meant that supersonic travel over land is near-universally banned. This strictly limits the available routes for supersonic passenger jets, and thus their economic viability.
Solving this problem has been a hot research topic for some time. Now, it appears there might be a way forward for supersonic air travel over land, using a neat quirk of Earth’s atmosphere.
There’s something ominous about robots taking over jobs that humans are suited to do. Maybe you don’t want a job turning a wrench or pushing a broom, but someone does. But then there are the jobs no one wants to do or physically can’t do. Robots fighting fires, disarming bombs, or cleaning up nuclear reactors is something most people will support. But can you climb through a water pipe from the inside? No? There are robots that are available from several commercial companies and others from university researchers from multiple continents.
If you think about it, it makes sense. For years, companies that deal with pipes would shoot large slugs, or “pigs”, through the pipeline to scrape them clean. Eventually, they festooned some pigs with sensors, and thus was born the smart pig. But now that it is possible to make tiny robots, why not send them inside the pipe to inspect and repair?
There’s interesting news out of Wyoming, where a coal mine was opened this week. But the fact that it’s the first new coal mine in 50 years isn’t the big news — it’s the mine’s abundance of rare earth elements that’s grabbing the headlines. As we’ve pointed out before, rare earth elements aren’t actually all that rare, they’re just widely distributed through the Earth’s crust, making them difficult to recover. But there are places where the concentration of rare earth metals like neodymium, dysprosium, scandium, and terbium is slightly higher than normal, making recovery a little less of a challenge. The Brook Mine outside of Sheridan, Wyoming is one such place, at least according to a Preliminary Economic Assessment performed by Ramaco Resources, the mining company that’s developing the deposit.
The PEA states that up to 1,200 tons of rare earth oxides will be produced a year, mainly from the “carbonaceous claystones and shales located above and below the coal seams.” That sounds like good news to us for a couple of reasons. First, clays and shales are relatively soft rocks, making it less energy- and time-intensive to recover massive amounts of raw material than it would be for harder rock types. But the fact that the rare earth elements aren’t locked inside the coal is what’s really exciting. If the REEs were in the coal itself, that would present something similar to the “gasoline problem” we’ve discussed before. Crude oil is a mixture of different hydrocarbons, so if you need one fraction, like diesel, but not another, like gasoline, perhaps because you’ve switched to electric vehicles, tough luck — the refining process still produces as much gasoline as the crude contains. In this case, it seems like the coal trapped between the REE-bearing layers is the primary economic driver for the mine, but if in the future the coal isn’t needed, the REEs could perhaps be harvested and the coal simply left behind to be buried in the ground whence it came.
One of the tropes of the space race back in the 1960s, which helped justify the spending for the part of the public who thought it wasn’t worth it, was that the technology developed for use in space would help us out here back on earth. The same goes for the astronomical expenses in Formula 1, or even on more pedestrian tech like racing bikes or cinematography cameras. The idea is that the boundaries pushed out in the most extreme situations could nonetheless teach us something applicable to everyday life.
This week, we saw another update from the Minuteman project, which is by itself entirely ridiculous – a 3D printer that aims to print a 3D Benchy in a minute or less. Of course, the Minuteman isn’t alone in this absurd goal: there’s an entire 3D printer enthusiast community that is pushing the speed boundaries of this particular benchmark print, and times below five minutes are competitive these days, although with admittedly varying quality. (For reference, on my printer, a decent-looking Benchy takes about half an hour, but I’m after high quality rather than high speed.)
One could totally be forgiven for scoffing at the Speed Benchy goal in general, the Minuteman, or even The 100, another machine that trades off print volume for extreme speed. But there is definitely trickle-down for the normal printers among us. After all, pressure advance used to be an exotic feature that only people who were using high-end homemade rigs used to care about, and now it’s gone mainstream. Who knows if the Minuteman’s variable temperature or rate smoothing, or the rigid and damped frames of The 100, or its successor The 250, will make normal printers better.
So here’s to the oddball machines, that push boundaries in possibly ridiculous directions, but then share their learnings with those of us who only need to print kinda-fast, but who like to print other things than little plastic boats that don’t even really float. At least in the open-source hardware community, trickle-down is very real.
This article is part of the Hackaday.com newsletter, delivered every seven days for each of the last 200+ weeks. It also includes our favorite articles from the last seven days that you can see on the web version of the newsletter.
Want this type of article to hit your inbox every Friday morning? You should sign up!
