So, You Found A Foden Steam Lorry In A Field. What Next?

August 23, 2026 by Jenny List 41 Comments

It’s quite likely that many readers will have harbored dreams of owning, or at least driving, a steam engine of some kind. [James Hervey-Bathurst] was lucky enough to do so in a time when it was still possible to find scrap steam-powered machinery for restoration, and at the recent Electromagnetic Field event in the UK he took the time to describe his journey from finding an abandoned steam lorry in a Buckinghamshire field in 1975, to a few years later, taking it to the road.

The talk starts with the story of its retrieval, then the long process of rebuilding, and finally its first run. He’s the owner of Eastnor Castle, the ancestral pile that serves as venue for EMF Camp, so we’re guessing that having somewhere spacious for such a project must have helped. Along the way, we get a comprehensive run through the workings of a 1920s steam vehicle, from its double-expansion compound engine to its three-speed gearbox, stopping for small details like its injectors, and a curious exhaust steam heater designed to reduce the clouds of visible steam.

Most of us will never get the chance to take the wheel of a Foden such as this one, but at least we’ve had a chance for a closer look thanks to EMF. The full video is below the break, meanwhile if you’d like more on steam injectors we have you covered.

Continue reading “So, You Found A Foden Steam Lorry In A Field. What Next?” →

This Week In Security: BugTraq, AI Hacks, And Being Dumb On Planes

August 14, 2026 by Mike Kershaw 17 Comments

After a multi-year hiatus, the venerable BugTraq mailing list is back!

For decades, BugTraq was the place where vulnerabilities were disclosed, from the early days when nearly all vendors viewed all security research as a hostile force, through to the modern era of working with vendors to coordinate disclosing bugs. With the rise of bug bounty programs and other social changes, the mailing list slowly died: what started in 1993 ended in 2021 is returning. The new maintainer, Jonathan Brossard, says in his announcement “The mission is unchanged: full disclosure, researcher-first, no corporate filter.”

Don’t Be Dumb on Planes

In the unlikely event anyone here needs to be told: Don’t do dumb things on planes.

It seems that someone coming home from from the DEF CON hacker conference in Las Vegas decided to mess with the in-plane WiFi, and is likely now in the “find out” phase of doing something dumb. There hasn’t been any public followup beyond the original reports: a passenger on a Delta flight leaving Las Vegas brought up a fake WiFi hotspot named “Delta WiFi FAST” to trick other passengers into connecting, and attempted to disable the in-flight WiFi using a denial of service attack.

Continue reading “This Week In Security: BugTraq, AI Hacks, And Being Dumb On Planes” →

This Week In Security: Arch AUR, Steam Marketplace, WordPress All Face Issues, Taco-Themed Coding, And Mythos Makes National News

June 19, 2026 by Mike Kershaw 7 Comments

Starting on June 11, 2026, the Arch User Repository (AUR) was targeted by malware which rapidly compromised over 1,500 packages. The AUR repository allows for abandoned community packages to be taken over by a new maintainer, which was exploited by the attackers to claim ownership.

Once the packages were adopted by the malicious maintainers, the next part should sound familiar: The package build scripts, which are executed by the Arch yay and paru package managers, were modified to install malicious NPM packages (atomic-lockfile and js-digest) each containing the now-usual suite of infostealer malware targeting browser credentials and tokens, SSH private keys, package repository tokens, cloud compute, AI tokens, and crypto wallets.

The malware once installed uses several tricks to cloak itself by renaming processes, and to install systemd services to restart itself, and leveraging eBPF filtering in the kernel to hide the sockets and processes further. It specifically targets browsers and Electron-based applications, which are basically a light-weight Chromium browser disguised as an application anyway. Slack, Discord, Signal, and many more use the Electron wrapper.

A preliminary analysis of the malware is available, which breaks down the exact behavior in more detail and lists the known targets of the malware.

Initially believed to be “only” a few hundred packages, the compromised list eventually grew to over 1500, and additional packages may still be discovered. On June 14, Phoronix reported that a second wave of compromised packages has been found in the AUR repositories, including NeoVim plugins and multiple browsers. The second set of infected packages were compromised in a similar fashion, but with more heavily obfuscated scripts.

Steam Wallpaper Malware

Kaspersky Labs finds that Steam users have been targeted by malware uploaded via a popular animated wallpaper application, “Wallpaper Engine”.

While Valve normally does an admirable job filtering the Steam store, it looks like an exploit has slipped through in “Wallpaper Engine”. Animated wallpapers can be videos, web pages, or full executables themselves. Obviously, being able to run any program masquerading as wallpaper directly is an excellent vector to install malware, so of course this is what happened.

Using the integrated Steam Workshop, which allows users to share game mods and other game content directly, malicious wallpapers install a wide variety of malware including the usual gamut of infostealers, remote access, residential proxy, key logging, and crypto miners. This makes it one of the rare times installing crypto miners almost makes sense, considering most Steam users likely have better than average video cards.

Once a user is infected, the malware also steals the current Steam login credentials, and several instances attempt to then upload additional infected wallpapers to the Steam Workshop under the compromised users identity, completing the supply chain circle of life.

Continue reading “This Week In Security: Arch AUR, Steam Marketplace, WordPress All Face Issues, Taco-Themed Coding, And Mythos Makes National News” →

Preparing To Fire Up A 90-Year-Old Boiler After Half A Century

March 17, 2026 by Maya Posch 5 Comments

Continuing the restoration of the #1 Lancashire boiler at the Claymills Pumping Station in the UK, the volunteers are putting on the final touches after previously passing the boiler inspection. Although it may seem that things are basically ready to start laying down a fire after the boiler is proven to hold 120 PSI with all safeties fully operating, they first had to reassemble the surrounding brickwork, free up a seized damper shaft and give a lot of TLC to mechanisms that were brand new in the 1930s and last operated in 1971.

Removing the ashes from a Lancashire boiler. (Credit: Claymills pumping station, YouTube)

The damper shaft is part of the damper mechanism which controls doors that affect the burn rate, acting as a kind of throttle for the boilers. Unfortunately the shaft’s bearings had seized up completely, and no amount of heat and kinetic maintenance could loosen it up again. This forced them to pull it out and manufacture a replacement, but did provide a good look at how it’s put together. The original dial indicator was salvaged, along with some other bits that were still good.

Next was to fit the cast-iron ash boxes that sit below the boiler and from where ash can be scraped out and deposited into wheelbarrows. The automatic sprinkler stokers are fitted above these, with a good look at their mechanism. The operator is given a lot of control over how much coal is being fed into the boiler, as part of the early 20th-century automation.

The missing furnace doors on the #1 boiler were replaced with replicas based on the ones from the other boilers, and some piping around the boiler was refurbished. Even after all that work, it’ll still take a few weeks and a lot more work to fully reassemble the boiler, showing just how complex these systems are. With some luck it’ll fire right back up after fifty years of slumbering and decades of suffering the elements.

Continue reading “Preparing To Fire Up A 90-Year-Old Boiler After Half A Century” →

How To Restore Your 19th-Century Lancashire Boiler To Hold 120 PSI

February 23, 2026 by Maya Posch 14 Comments

The Industrial Revolution was powered by steam, with boilers being a crucial part of each steam engine, yet also one of the most dangerous elements due to the high pressures involved. The five Lancashire boilers at the Claymills Pumping Station are relatively benign in this regard, as they operate at a mere 80 PSI unlike e.g. high-pressure steam locomotives that can push 200 – 300 PSI. This doesn’t mean that refurbishing one of these boilers is an easy task and doesn’t involve plugging a lot of leaks, as the volunteers at this pumping station found out.

At this Victorian-era pumping station there are a total of five of these twin-flue Lancashire boilers, all about 90 years old after a 1930s-era replacement, with them all gradually being brought back into service. The subject of the video is boiler 1, which was last used in 1971 before the pumping station was decommissioned. Boilers 2 and 3 were known to be in a pretty bad condition, and they needed a replacement for boiler 5 as it was about to go down for maintenance soon.

Although the basic idea behind a Lancashire boiler is still to boil water to create steam, it’s engineered to do this as efficiently as possible to save fuel. This is why it has two flues where the burning coal deposits its thermal energy, which then goes on to heat the surrounding water. The resulting pressure from the steam also means that there are a lot of safeties to ensure that things do not get too spicy.

Continue reading “How To Restore Your 19th-Century Lancashire Boiler To Hold 120 PSI” →

How Volunteers Saved A Victorian-Era Pumping Station From Demolition

February 16, 2026 by Maya Posch 13 Comments

D-engine of the Claymills Pumping Station. (Credit: John M)

Although infrastructure like a 19th-century pumping station generally tends to be quietly decommissioned and demolished, sometimes you get enough people looking at such an object and wondering whether maybe it’d be worth preserving. Such was the case with the Claymills Pumping Station in Staffordshire, England. After starting operations in the late 19th century, the pumping station was in active use until 1971. In a recent documentary by the Claymills Pumping Station Trust, as the start of their YouTube channel, the derelict state of the station at the time is covered, as well as its long and arduous recovery since they acquired the site in 1993.

After its decommissioning, the station was eventually scheduled for demolition. Many parts had by that time been removed for display elsewhere, discarded, or outright stolen for the copper and brass. Of the four Woolf compounding rotative beam engines, units A and B had been shut down first and used for spare parts to keep the remaining units going. Along with groundwater intrusion and a decaying roof, it was in a sorry state after decades of neglect. Restoring it was a monumental task.

Continue reading “How Volunteers Saved A Victorian-Era Pumping Station From Demolition” →

A Steam Machine Clone For An Indeterminate But Possibly Low Cost

January 2, 2026 by Bryan Cockfield 29 Comments

For various reasons, crypto mining has fallen to the wayside in recent years. Partially because it was never useful other than as a speculative investment and partially because other speculative investments have been more popular lately, there are all kinds of old mining hardware available at bargain prices. One of those is the Asrock AMD BC250, which is essentially a cut down Playstation 5 but which has almost everything built into it that a gaming PC would need to run Steam, and [ETA PRIME] shows us how to get this system set up.

The first steps are to provide the computer with power, an SSD, and a fan for cooling. It’s meant to be in a server rack so this part at least is pretty straightforward. After getting it powered up there are a few changes to make in the BIOS, mostly related to memory management. [ETA PRIME] is uzing Bazzite as an operating system which helps to get games up and running easily. It plays modern games and even AAA titles at respectable resolutions and framerates almost out-of-the-box, which perhaps shouldn’t be surprising since this APU has a six-core Zen 2 processor with a fairly powerful RDNA2 graphics card, all on one board.

It’s worth noting that this build is a few weeks old now, and the video has gotten popular enough that the BC250 cards that [ETA PRIME] was able to find for $100 are reported to be much more expensive now. Still, though, even at double or triple the price this might still be an attractive price point for a self-contained, fun, small computer that lets you game relatively easily and resembles the Steam Machine in concept. There are plenty of other builds based on old mining hardware as well, so don’t limit yourself to this one popular piece of hardware. This old mining rig, for example, made an excellent media server.

Continue reading “A Steam Machine Clone For An Indeterminate But Possibly Low Cost” →