This Week In Security: Baked-in Malware, Freezers Not Freezing, Zoom Snoops Clipboards, And AI Makes Things Worse, Faster

September 4, 2026 by Mike Kershaw 18 Comments

The AI platform ServiceNow which offers both hosted and on-premises versions just patched a trifecta of CVSS-10 vulnerabilities.

CVSS rankings are determined by the severity of a flaw, the ease of exploiting the bug, if authentication is required for exploitation, if the vulnerability exposes confidential data, and other criteria. A CVSS of 10 is as bad as it gets, and having three of them at once is certainly attention-getting. Of the three vulnerabilities fixed, one allowed unauthenticated modification of data in the hosted instance, a second allowed arbitrary code execution via the GraphQL interface, and the third allowed arbitrary SQL commands that could modify the database.

ServiceNow claims Adobe, Lenovo, Fedex, and Fujitsu among their high-profile customers. With luck, the vulnerabilities were patched before significant public exploitation could happen.

Router Malware

Previously in 2026 the US Government warned against embedded malware found in consumer routers, which may be linked to the FCC enacting bans against certification and import of foreign-made consumer devices. This week, the NVD (National Vulnerability Database) reported specific embedded malware in the Zbtlink and MoreQuick brands of devices.

Multiple versions of the firmware, for multiple lines of products, contain a backdoor service that uses unencrypted UDP to connect to a command and control (C2) service. The service, or anyone able to intercept the network traffic, since it’s unencrypted, can execute commands as root, allowing them to change configurations, open tunnels, or steal ISP credentials.

The malware is baked into the firmware, so removing it is impossible for most users: a factory reset wouldn’t do. In theory if third-party firmware like OpenWRT supports these devices, the hardware could be made safer with a custom install.

Given how commonly the same device is marketed under dozens of names, likely the same devices and firmware have yet to be identified under other brands. Continue reading “This Week In Security: Baked-in Malware, Freezers Not Freezing, Zoom Snoops Clipboards, And AI Makes Things Worse, Faster” →

Hackaday Europe 2026: Fluid Kernels And Optimizing C++ For MCUs

September 3, 2026 by Zoe Skyforest 6 Comments

Oftentimes, when we’re using a microcontroller, we’re whipping up some very specific code focused on executing a particular task. The device is set up to execute code that does exactly what we want with minimal overhead. However, sometimes, there are scenarios where it pays to go with a somewhat heavier setup, wherein the microcontroller runs an operating system for the benefits that offers.

Federico Terraneo came to Hackaday Europe to discuss this very topic. He talks about kernel architecture, real-time operating systems, and how to best use C++ in the world of microcontrollers.

Continue reading “Hackaday Europe 2026: Fluid Kernels And Optimizing C++ For MCUs” →

FLOSS Weekly Episode 880: The Two Wolves

September 2, 2026 by Jonathan Bennett 2 Comments

This week Jonathan chats with Benjamin Samuels of Trail of Bits! The conversation focuses on Patch the Planet, a new initiative to help Open Source projects deal with the fallout from AI coding and vulnerability research. What’s the unexpected dichotomy driving the polarized response to LLMs? And what does the future look like for Open Source in the age of AI? Watch to find out!

Continue reading “FLOSS Weekly Episode 880: The Two Wolves” →

PETG: The PLA Filament Alternative That Just Works

September 1, 2026 by Maya Posch 49 Comments

A typical response to the previous article on why PLA filament is so darn brittle. This has led some people to not use PLA filament at all, while others promote using PLA only for prototyping and throw-away parts, especially in light of PLA being compostable under the right conditions. For many mechanical parts, people turn to PETG.

Much like the PET polymer used for everything from food containers to drink bottles, PETG is durable, more resistant to degradation through mechanisms like hydrolysis and its filament form doesn’t need to be coddled like PLA does. PETG, on the other hand, tends to come from crude oil and shrugs at industrial composting conditions.

In terms of durability, degradation mechanisms and recyclability, is PETG the basic FDM filament which we should all just be using?

Continue reading “PETG: The PLA Filament Alternative That Just Works” →

Defeating Bacteria In Hot Water Systems With A Heat Exchanger

August 31, 2026 by Zoe Skyforest 74 Comments

The average hot water is a relatively simple appliance to understand. It uses gas or electricity to dump energy into water in the form of heat, keeping it at a pleasant temperature for uses like bathing and cleaning. Basic mechanisms are in place to ensure the water stays at a relatively constant temperature, neither too hot where it could cause burns, nor too cold such that it wouldn’t be fit for purpose.

One of the problems, though, is that sometimes storing water at the desired temperature can create the perfect breeding ground for bacteria. However, a neat little trick developed by NIST could solve that problem rather elegantly.

Continue reading “Defeating Bacteria In Hot Water Systems With A Heat Exchanger” →

Hackaday Links: August 30, 2026

August 30, 2026 by Tom Nardi 12 Comments

The big news today is, of course, the successful launch and deployment of NASA’s Nancy Grace Roman Space Telescope earlier this morning. The space agency’s latest observatory lifted off at 7:26 AM Eastern from Launch Complex 39A at Kennedy Space Center aboard a SpaceX Falcon Heavy, and by 8:00 AM it was separated from the rocket’s upper stage and flying on its own.

While the sound and fury of launch is exciting, it’s just the beginning of the journey for Roman. It will take several months for the spacecraft to complete its roughly 1.5 million-kilometer trek out to Earth’s second Lagrange point (L2), where it will set up shop near — in cosmic terms, anyway — the James Webb Space Telescope (JWST). Along the way, it will switch on and test various systems and components, with its primary 300 megapixel infrared camera scheduled to power up in three weeks or so.

There’s a lot to cover about the Roman Space Telescope. Built from spy satellite spare parts donated by the National Reconnaissance Office and featuring a field of view 100 times greater than that of Hubble, its launch is widely considered to be one of the most important scientific milestones of the decade. We’ll be bringing you more about the past, present, and future of this flagship mission as it progresses.

Continue reading “Hackaday Links: August 30, 2026” →

Same As It Ever Was

August 29, 2026 by Elliot Williams 143 Comments

Whether you like it or not, the use of LLMs to write code is kind of a big deal at the moment. We’ve been asking ourselves what, if anything, this means for us here at Hackaday. Should we try to figure out what percentage of a project was done by an actual human and how much was done by a machine? Does it really matter? What is our AI policy anyway?

Clearly, Hackaday is pro-human. We’re in it for the hackers as much as for the hacks. Our community is, like Soylent Green, made of people. It’s your inspirations and innovations that keep us reading and writing every day. And we produce 100% of our content the old-fashioned way, with projects selected through the taste and judgement of our writers, and their own words telling the story.

What about the hacks? We’ve seen a lot of projects recently that were coded with the help of an LLM. Does that diminish the work? In the end, what rings truest to us is what has always been Hackaday’s editorial guiding star: Is there something special in the hack that makes it worth talking about? Then we write about it. Was it written using vim or emacs? Did the author consult friends or a chatbot while working on the project? That’s not really relevant.

But in the past few years, the BS-generation machines have found our hobby, and we’re finding a lot more projects that don’t have any spark to them. We’re seeing circuits that make no sense, and claims that defy physics. Of course, we always have. The LLM-nonsense project is today’s version of the perpetual motion machines of old. Just like we never trust a hardware project that is all renders, seeing only AI-generated images is a huge red flag. It’s our job to separate out the wheat from the chaff for you all, but it’s something that you must be doing everyday as well.

We’ve seen amazing hacks over Hackaday’s 22-year history. Hackaday is older than YouTube and older than Stack Overflow. We’ve seen technology come and go. We’ve seen C-beams glitter in the dark near the Tannhäuser gate. (OK, maybe not.) And in the end, our AI policy is our same-old policy: we write up hacks that inspire us in the hope that they inspire you.

So if you’re using Claude to help you with the UI bits, or if you’re hand-writing it all in assembly, or wiring up the logic in diodes, we just want to see your cool hacks. And we hope that our collective signal will be so loud that we drown out the noise, at least in our own little corner of the hacker universe.