This Week In Security: Linux Flaws, Python Ownage, And A Botnet Shutdown

March 20, 2026 by Mike Kershaw 14 Comments

The ides of security March are upon us — Qualys reports the discovery by their threat research unit of vulnerabilities in the Linux AppArmor system used by SUSE, Debian, Ubuntu, and Kubernetes as an additional security mechanism and application firewall.

AppArmor was added to Linux in 2010, and the vulnerabilities Qualys discovered have been present since 2017, and allow unprivileged (non-root) local users to elevate privileges by executing arbitrary code in the kernel, gaining root access, or perform a denial-of-service attack across the entire system by replacing all AppArmor behavior with “deny all” rules.

All Linux kernels since Linux 4.11 are vulnerable. If your Linux distribution enables AppArmor, and quite a few do, you’ll want to be updating as soon as fixes are available from your distribution maintainers. On systems with untrusted users, such as shared environments, VPS server environments, and the like, this is even more critical and urgent. Even on single-user systems, vulnerabilities like these allow other exploits, like the Python attack below, mechanisms to elevate their access and persistence.

At the time of writing, the full details of the AppArmor vulnerability are limited until the Linux Kernel team releases a stable version with the fixes for distribution maintainers. Qualys has published the technical write-up with the currently public information.

Python Projects Compromised

StepSecurity reports on a new campaign to infect Python projects on GitHub with a complex malware that, once deployed, appears to be yet another crypto and login stealer.

The attacker first gains access to the GitHub credentials via another info stealing worm – the Glassworm stealer infects VSCode extensions with over 35,000 downloads of infected extensions in October of 2025. Glassworm harvests NPM, GitHub, and OpenVSX credentials and sends them to a remote command and control (C2) server. It also harvests a wide range of crypto currency wallet extensions to steal crypto directly. Continue reading “This Week In Security: Linux Flaws, Python Ownage, And A Botnet Shutdown” →

Illustrated Kristina with an IBM Model M keyboard floating between her hands.

Keebin’ With Kristina: The One With The Ultra-Thin Split

March 19, 2026 by Kristina Panos 4 Comments

But sir, it is wafer-thin. That’s how they get you! Just when you couldn’t possibly justify building another keyboard, let alone owning one, along comes the Kambala by [aroum2].

A wafer-thin keyboard in triple black. — Image by [aroum2] via reddit

Now, ‘Kambala’ means a few things, but here it refers to fish, as evidenced by logo and matching themed PCB key chain shown in the gallery.

This catch is so flat because of the switches: PG1316S, and 42 of them. These are better known to some as Kailh butterfly switches, and are meant for laptops. But, this is Hackaday.

No matter what you call them, those switches are controlled by a nice!nano V2-compatible controller, which allows for ZMK firmware support. There’s a 110 mAh battery and four status LEDs, and best of all, the charging indicator is in the fish’s eyes.

[aroum2] might share the files later. Here’s hoping!

Continue reading “Keebin’ With Kristina: The One With The Ultra-Thin Split” →

FLOSS Weekly Episode 866: BreezyBox And Embedded Compilers

March 18, 2026 by Jonathan Bennett No comments

This week Jonathan chats with Valentyn Danylchuk about BreezyBox — an interactive shell and toolkit that provides various tools and a compiler on an ESP32 microcontroller. What was the inspiration for this impressive project, and what direction is it heading? Watch to find out!

Continue reading “FLOSS Weekly Episode 866: BreezyBox And Embedded Compilers” →

Hackaday Europe Tickets On Sale Now, CFP Extended

March 18, 2026 by Elliot Williams 10 Comments

Hackaday Europe is approaching, and we’re putting tickets on sale now. “But wait, you haven’t selected the talks yet!” we hear you saying. Indeed! And that’s why we discount the first round of entries for our True Believers™ – the hard core who know that it’s going to be a fantastic event and turn up regardless. So if you want to come to Hackaday Europe on the cheap, go snap up your ticket before they’re gone.

Call for Participation Extended

Of course, giving a talk is always the best way to attend a hacker gathering like this. And we know that we said that today was the deadline for talk submissions. But we also know that many of you have advanced degrees in procrastineering, so we’re giving you a week’s extension.

Selected speakers get in free, and we’ll reserve you an early-bird ticket for putting together a legit talk proposal either way. So if you’re a first-time presenter or a wizened pro, and you have something that you’d like to say to an audience of like-minded hackers, we’d all like to hear from you. We won’t extend the deadline twice, though, so get your proposal in before March 25.

(A few people have reached out to us, wanting to avoid the Google login that the above form requires. If you’re in the same camp, write to us directly and let us know!)

Hackaday Europe

In case you don’t know, Hackaday Europe started out as a bi-annual event that we first held a decade ago in Belgrade. It has been such a success that we’re now doing it every year, and leap-frogging around Europe to spread the love. The last ~~two~~ three events have been in Berlin, and this is our first time in Lecco, Italy. This year, it runs the weekend of May 16th and 17th, with a pre-event on the evening of the 15th, to be announced.

What stays the same? We have a fantastic crowd who bring their passion projects with them, a fun badge to hack on, and of course food, drink, music, and merriment all along. Oh, and the talks. (You are submitting your talk, right?)

We’ll have more details coming your way in the next few weeks, so stay tuned. After March 25th, we’ll get to selecting talks, and let you all know. Get your tickets now – we can’t wait to see you all in eight-and-a-half weeks!

Ask Hackaday: Wired Or Wireless Headphones?

March 16, 2026 by Al Williams 71 Comments

They say you should never throw out old clothes because they will come back in style one day. Maybe they are right. We noted in a recent BBC post that, apparently, wired headphones are making a comeback. Like many people, we were dismayed when Apple took the headphone jack out of the iPhone and, as [Thomas Germain] notes, even Google eventually ejected the normal headphone jack. (Although, in fairness, most of the Pixel phones we’ve seen come with a pair of USB-C earbuds.)

On the face of it, though, wireless seems to be a good idea. You can get cheap Bluetooth earbuds now, although maybe still not as cheap as wired buds. Sure, they sound terrible, but so do cheap buds. It is a pain to charge them, of course, but not having to untangle wires is a benefit. On the other hand, you never have to charge your wired headphones.

Continue reading “Ask Hackaday: Wired Or Wireless Headphones?” →

Hackaday Links: March 15, 2026

March 15, 2026 by Tom Nardi 4 Comments

Some days, it feels like we’re getting all the bad parts of cyberpunk and none of the cool stuff. Megacorps and cyber warfare? Check. Flying cars and holograms? Not quite yet. This week, things took a further turn for the dystopian with the news that a woman was hospitalized after an altercation with a humanoid robot in Macau. Police arrived on scene, took the bot into custody, and later told the media they believed this was the first time Chinese authorities had been called to intervene between a robot and a human.

The woman, reportedly in her seventies, was apparently shocked when she realized the robot was standing behind her. After the dust settled, the police determined it was being operated remotely as part of a promotion for a local business. We’ve heard there’s no such thing as bad publicity, but we’re not sure the maxim holds true when you manage to put an old lady into the hospital with your ad campaign.

Continue reading “Hackaday Links: March 15, 2026” →

What Is A Computer?

March 14, 2026 by Elliot Williams 36 Comments

On the podcast, [Tom] and I were talking about the new generation of smartphones which are, at least in terms of RAM and CPU speed, on par with a decent laptop computer. If so, why not just add on a screen, keyboard, and mouse and use it as your daily driver? That was the question posed by [ETA Prime] in a video essay and attempt to do so.

Our consensus was that it’s the Android operating system holding it back. Some of the applications you might want to run just aren’t there, and on the open side of the world, even more are missing. Is the platform usable if you can’t get the software you need to get your work done?

But that’s just the computer-as-a-tool side of the equation. The other thing a computer is, at least to many of our kind of folk, is a playground. It’s a machine for experimenting with, and for having fun just messing around. Android has become way too polished to have fun, and recent changes on the Google side of things actively prevent you from installing arbitrary software. The hardware is similarly too slimmed-down to allow for experimentation.

Looking back, these have been the same stumbling blocks for the last decade. In 2018, I was wondering aloud why we as a community don’t hack on cell phones, and the answer then was the same as it is now – the software is not friendly to our kind. You can write phone apps, and I have tried to do so, but it’s just not fun.

The polar opposites of the smartphone-as-computer are no strangers in our community. I’m thinking of the Linux single-board computers, or even something like a Steam Deck, all of which are significantly less powerful spec-wise than a flagship cell phone, but which are in many ways much more suitable for hacking. Why? Because they make it easy to do the things that we like to do. They’re designed to be fun computers, and so we use them.

So for me, a smartphone isn’t a computer, but oddly enough it’s not because of the hardware. It’s because what I want out of a computer is more than Turing completeness. What I want is the fun and the freedom of computering.