Times are tough out there, and many are starting to feel the pressure at the grocery store checkout line or the gas pump. But whenever you start to worry about affording life’s necessities, take comfort in the knowledge that somebody is so flush with cash that on Friday they decided to treat themselves and spend $3 million for a sealed copy of Super Mario Bros for the Nintendo Entertainment System.

Although we’re not going to say it necessarily justifies the insane price — a new record for the most ever paid for a video game, incidentally — Heritage Auctions does note in their press release that this is an exceptionally rare version of what’s admittedly one of the most iconic pieces of software ever produced. This is only one of three copies of this particular variant known to exist, which Nintendo apparently distributed to test markets in the United States ahead of the game’s official 1985 release.

In slightly more modern gaming news, Asha Sharma, the new head of Microsoft’s Xbox division, has been making some big swings to try and get Microsoft’s gaming division back on track after years of declining sales. As part of that effort, she recently penned an article detailing some of the challenges the company is facing, which includes some interesting hardware details.

According to the blog post, she claims that in February, the cost of memory and storage components for the Xbox console had doubled compared to the previous year. But those numbers have jumped again, and by the time the holidays roll around, she expects they’ll be paying five times what they did in 2024. That’s bad news for anyone looking to put an Xbox under the tree come Christmas, but even worse news as the company works on the console’s successor. Considering that today’s hardware from Sony and Microsoft can already set you back $700 USD depending on which version you get, it seems like we’re approaching a point where gaming consoles could price themselves out of the market.

Those thinking of mowing some lawns this summer to save up for their $1K next-generation consoles may be interested to hear that the Food and Drug Administration has put its stamp of approval on the first new sunscreen ingredient in the US in more than two decades. Bemotrizinol is a broad-spectrum UV absorber that knocks out 310 and 340 nm, and while Uncle Sam has taken his sweet time to give it the OK, the European Union has been slathering it on since 2000. The first company authorized to sell it in the US will be marketing it under the name Parsol Shield later this year, with other manufacturers set to follow in 2027.

While it seems the world has agreed on adding bemotrizinol to their sunscreens, many people are decidedly less enthusiastic about AI code in their open-source projects. One of those people is Drew DeVault, which is why he decided to fork Vim once he found out its maintainers were merging in code written by large language models (LLMs). Rather than break off at the last version untainted by clankers, Drew decided to divert from the upstream project at version 8.2.x. This means that some newer plugins may have compatibility issues, although security fixes and other selected updates from the 9.x branch have been back-ported to the newly coined Vim Classic. If you give it a shot, let us know in the comments.

Finally, if a non-AI fork of Vim is still too mainstream to scratch that itch for you, Phoronix is reporting that ReactOS can now run Half Life. If this were any other website, we might devote the next paragraph to explaining the significance of a nearly 30-year-old PC game being run on a free and open-source operating system designed to provide binary compatibility with Microsoft Windows. But it’s Sunday evening, and you’re reading Hackaday, so just take the win.

See something interesting that you think would be a good fit for our weekly Links column? Drop us a line, we’d love to hear about it.

I studied physics in college, and I’m always surprised how fundamental some of the concepts are. Take waves for example. You really wouldn’t expect the same underlying concept to be at work on surface of a pond, the string of a guitar, light passing through two slits, and then in the probabilistic behavior of electrons orbiting inside nuclei. But here we are, in a world filled with wave-like phenomena.

What little control theory I know, I’ve learned in the school of hard knocks. But it’s equally amazing that the same basic concepts govern the tuning of car shock absorbers, PID controllers, active audio filters, and other more complex systems where feedback matters. Crucial in all of these systems is the judicious balance of amplification and damping.

And last week on vacation, learning to drive a covered wagon pulled by a heavy draft horse, I saw the same patterns again. The horse likes to pull, and when the wagon comes over the crest of the top of a hill, it starts to roll forward into his harness, pushing him from behind. This makes the horse uneasy, and he slows down, the wagon pushes him harder, and positive feedback gets out of control.

The man who was teaching me to drive the wagon said, “it’s not like a car” in that you don’t tap the brakes to slow down and then let go. Rather, you hold on the brakes for a lot longer than you think is necessary – until the horse tells you that he feels like pulling again – and then you let up only a tiny bit at a time. Otherwise, you end up in the under-damped case, where you let the wagon go too much, it slows the horse, you slam the brakes, the horse pulls hard, and you let up on the brakes, and the cycle continues anew.

What he meant by “not like a car” was that the brakes aren’t just slowing down the wagon, they’re adding damping to keep the horse-wagon system from oscillating. Once that clicked in my mind, everything was smooth sailing. After a couple of days, I even started adding some feed-forward to my mental PID controller, letting the brakes go a little bit more when the horse was approaching the bottom of a hill, and he obviously wanted to pick up a little more speed before the grade ahead.

The horse seemed happy that I was finally getting it, but I don’t think he had any understanding of tuning PID loops. He did have me pondering, on a long stretch of rolling hills on a summer morning, if there were a good minimal set of patterns that explained a maximal breadth of phenomena. I’m starting with the physics of waves and the control of feedback systems, but what’s next?

Last week, Elliot got his foot stepped on by a 1.5 metric ton draft horse, and boy is he glad to be back to the relative safety of podcasting! Joining him today is Jenny List, no stranger to farm life, who has been trodden by a cow. It’s going to be one of those podcasts, folks.

Another thing the two hosts have in common is a love for the mystery of the numbers station. But did you know that GPS satellites, for the last 20 years, have broadcast literally millions of secret messages to everyone on the earth with a receiver? After that bombshell, we have an ATtiny85 emulating an 8080, a primer on how to embed magnets in 3D prints, definitive proof that more than one cassette mechanism is still being manufactured, and a look at what makes home automation enthusiasts tick.

Check out the links below if you want to follow along, and as always, tell us what you think about this episode in the comments!

Download in DRM-free MP3 and play it in space.

Episode 373 Show Notes:

News:

• No news is good news.  No Mailbag, on the other hand, is no fun!  Write or mail in a question to mailbag@hackaday.com.

What’s That Sound:

• Jenny came in with a sound this week. Have a guess at it!

Interesting Hacks of the Week:

• • Spy Tech: The GPS Numbers Station
    • New address for GNSS data and products – GFZ GNSS Observatory
    • Investigation into September 2020 GPS SVN 74 Performance Anomaly
  • Secret Radio Stations By The Numbers
    • Numbers Station Simulator, Right In Your Browser
  • An Unlikely Host For An 8080 Emulator
    • Because You Can: Linux On An Arduino Uno
  • Ways To Embed Magnets In 3D Prints And Not Ruin Printers
  • As It Turns Out, There’s More Than One Cassette Mechanism Being Made After All
    • Know Audio: Mixtapes, Tape Loops, And Razor Blades
  • Vintage Turntable Gets Brain Transplant And Home Assistant Integration
  • Connecting Your Car To Home Assistant
  • Print Your Own Robby The Robot
    • 3D Printing Computer Space

Quick Hacks:

• • • Elliot’s Picks:
      • The Winners Of The 2025 Obfuscated C Code Contest
      • If You Want To Hack Me, Come In Through The Speaker
      • Pico-Driven Ultrasound Enables Scaled Acoustic Model Of Home Stereo
      • Optimizing Pancakes From Chemical Principles
    • Jenny’s Picks:
      • Re-Enable All Compute Units On The PS5-like BC-250 Cryptomining Card
      • Less Than 10 Years? Commonwealth Fusion Systems Applies To Plug Into Grid In 2030s
      • A New Life For A Rare Console

Can’t-Miss Articles:

• • • Questions Remain About Tense Moment Aboard ISS
    • NASA Announces Artemis III Crew And Ambitious Goals
    • 10 Years Ago: EVA 23 – How A High Visibility Close Call Cut Short a Spacewalk – NASA
    • Remember When Flash Drives Were Going To Make Your PC Faster?

Supply chain attacks continue, with Microsoft’s own open source Azure repositories being automatically disabled by GitHub following a compromise of the packages by the Miasma worm.

OpenSourceMalware reports that the infection resulted in 73 Microsoft-related package repositories being flagged and taken offline in a little over a minute by the GitHub automated security system, with over 40 repositories being related to Azure and the rest distributed across the Microsoft organization.

The center of the infection appears to be the Microsoft Durabletask package, which was previously compromised in May and used to push infected packages to PyPi. Considering that all of the supply chain worms also steal credentials for every service they can find in the build or developer environment they infect, it seems likely that credentials stolen in the original attack were never properly disabled.

Disabling the repositories can help stem the infected packages and GitHub actions from spreading and infecting more organizations, but of course any build processes depending on those packages will not function. In May, the Durabletask package showed over 400,000 downloads per month.

The OpenSourceMalware report includes a full list of the impacted repositories.

Microsoft Fixes GitHub Token Exploit

Microsoft has finally fixed a bug in GitHub which could steal a GitHub authentication token with access to all of an accounts repositories via the embedded web-based VSCode editor which is part of GitHub itself.

Ammar Askar discovered the bug and discusses it on their blog; by manipulating the sandboxed VS Code into treating an embedded web view as user keyboard strokes, it is possible to to cause it to install a VS Code extension which is then used to exfiltrate the GitHub authentication tokens of the user using the embedded VS Code instance.

TP-Link Takeover via Unregistered Domain

Julian B demonstrates capturing traffic from TP-Link routers and access points thanks to an unregistered domain name in the firmware.

After finding an archive of the firmware releases for every TP-Link product, Julian simplified the list to the latest versions, and ran a custom scraper tool to extract domain names referenced in the firmware and search for matching domain names.

After registering an available domain, Julian began receiving requests from TP-Link devices checking in to a server which had lapsed, likely years ago. Fortunately, Julian reported the issue to TP-Link and was able to transfer the domain.

It’s unclear what the risks of the unregistered domain name were in the context of the TP-Link devices, however unregistered domain names can lead to all sorts of issues in the wrong situations.

A Pile of OpenSSL Vulns

The OpenSSL library has a new collection of vulnerabilities which range from low-severity flaws in message verification in functions which aren’t used in any of the OpenSSL implemented protocols to a high-severity use-after-free bug in PKCS7 handling which could be used to run arbitrary code.

Use-after-free bugs occur when a chunk of memory is dynamically allocated, then freed and returned to the memory pool, but a later piece of code re-uses the memory that is no longer claimed. In the meantime, this memory could have been assigned to another variable or otherwise restructured, leading to memory corruption. In the case of OpenSSL, the memory associated with a PKCS7 container (a certificate storage method) or a S/MIME message (usually used in secure email) can be manipulated into using freed memory.

The advisory warns that applications processing PKCS7 or S/MIME are affected; fortunately most uses of OpenSSL are unlikely to be directly impacted (neither of those functions are common in web servers or similar), but as always, update as soon as possible!

NightmareEclipse is Back

The researcher previously identified as NightmareEclipse, known for releasing advanced Windows vulnerabilities with working proof of concept code, has returned as MSNightmare releasing several new exploits after previously being removed from GitHub. Despite a strongly worded (and poorly received) public statement by Microsoft threatening criminal investigations, the researcher returns with the RoguePlanet vulnerability.

RoguePlanet exploits race conditions in Windows Defender under Windows 10 and Windows 11 to gain a system-level shell, a fairly common trend in the vulnerabilities found by this researcher.

Additionally, another BitLocker bypass has been released, called GreatXML, which unlocks BitLocker protected drives if a Windows Defender offline scan has ever been run.

Of course, these releases coincide with Patch Tuesday, so they’re unlikely to be addressed before the July patch day.

It appears Microsoft has backed down from their initial press release which appeared to claim that vulnerability research and development outside of the guidelines Microsoft decided would be treated as criminal behavior; this was not well received by much of the security industry. At the start of the modern security industry in the late 1990s, public release of vulnerabilities was common. Companies had no way to reach a security contact to get it fixed, simply did not care to fix it, or were actively hostile to researchers. Through years and decades of community programs, it is now normal to reach out to a company with security flaws and have an expectation they will be fixed, and often rewarded either monetarily through structured bounty programs like HackerOne or through public credit to the researchers who found the flaws (nobody wants to be paid in exposure, but security is now an industry, and having a well-known name and track record can be valuable.)

Unfortunately, recently, it seems Microsoft may have forgotten that while disclosure to the vendor has become the norm, it is simply a social contract. Having already publicly alienated one skilled researcher (NightmareEclipse), the company seems to be doing the best it can to alienate others by burning community good will. Expect more publicly released vulnerabilities in the wake.

Linux Arm Fixes

Phoronix reports that the Linux kernel has patched a critical-severity flaw on Arm CPUs in the memory allocation logic. The list of processors affected continues to grow, including some NVIDIA embedded platforms.

The flaw lies in specific ordering requirements for accessing memory via the TLB, or “Translation Lookaside Buffer”, a critical part of the virtual memory and memory protection system. The TLB is a cache of recently resolved lookups of physical memory locations, so any corruption of the TLB can cause invalid memory reads, leading to almost the same results as recent kernel vulnerabilities in the Linux page cache system which allowed binaries to be replaced in RAM.

The bug was found thanks to advisories from Arm themselves clarifying that additional protections were needed around modifications to the TLB cache on these chips. The real-world impact remains to be seen, but now that the bug and patches are public, I’d expect proof of concept code to follow soon after. It’s also safe to assume that this flaw affects other operating systems on Arm platforms, as well, but there is no public information yet.

FreeBSD Gets a Page-Cache Bug

FreeBSD racks up another kernel bug this week, the amusingly named Bumsrakete (“Bum Rocket” or “Bang Rocket”), complete with a well-crafted troll of an announcement, right down to the use of Comic Sans for the announcement site.

Beneath the crap-posting exterior lies a legitimate CVE (CVE-2026-45257) where any user with access to the PMAP_HAS_DMAP system (the standard configuration) can overwrite the disk page cache in memory. This is the FreeBSD flavor of the kernel cache flaws in Linux used by CopyFail, DirtyPipe, and friends, and even involves decryption primitives in the kernel similar to the original CopyFail process.

It’s not surprising that following the multiple disk cache corruption bugs in Linux disclosed this spring, other operating systems with similar functionality are being examined and new flaws showing up.

NPM to Block Auto Install Scripts

NPM is introducing major changes in NPM 12 to attempt to stem the flood of supply-chain vulnerabilities by removing the automatic execution of commands from the install phase of packages and disabling the use of remote URLs as dependencies.

Most of the NPM-based worms infecting packages at record rates use the install script process, hooking either pre-install, install, or post-install scripts to run commands automatically as a package dependency is included. Since the install script runs as the user (or build service) pulling the dependencies, it has direct access to any credentials or files that user and service has. Under the new model an infected package could still perform malicious actions inside a compiled application or site, but a major mechanism for automatic spreading of malicious packages will be addressed.

It’s good to see progress made towards addressing the underlying weaknesses in the package ecosystem which aid in spreading malicious packages.

Libinput Security Fix

The libinput library sees a pair of security fixes this week, centered around the handling of device names for uinput and uhid devices. Maliciously named devices could execute commands as root.

To be able to exploit this, a user needs to already be on the system and have the ability to create new uinput devices. This is normally restricted to root, however if steam-devices, antimicrox, or kdeconnectd packages are installed, the permissions to create a device are modified and any user logged into the system can create a uinput device.

Go forth, and update!

Mini Shai-Hulud Hides in Censorship

The Shai-Hulud, Mini Shai-Hulud, and Miasma worms have been prolifically infecting packages on NPM and PyPi as well as VS Code extensions and GitHub actions. Using a combination of captured worm code and publicly released versions of the worms, researchers have been reverse engineering the behavior of the worm using the decrypted payloads.

Amusingly, they have discovered that the Mini Shai-Hulud worm attempts to hide from automatic analysis and detection via AI prompt injection. The payload file executed during a NPM package install contains a block of comment text referencing biological and nuclear weapons, topics many AI models refuse to allow.

Interpreting the comment as a banned request, the AI models may immediately stop processing the rest of the file, either blocking further analysis by researchers or disabling AI-based malware detection tools scanning for malicious payloads.

Another Record Patch Tuesday

For the second time this year, Microsoft has a record-breaking number of fixes included in Patch Tuesday with more than 200 security fixes, including fixes for two vulnerabilities released by NightmareEcllipse in recent weeks, however none of the fixes specifically reference the conflict between Microsoft and the researcher.

Outside of the Patch Tuesday fixes, Microsoft also fixed 360 browser vulnerabilities.

With the increasing automatic bug finding via AI tools, this may become the new normal for Patch Tuesday fix counts.

Python Linter Blocks Shai-Hulud

Sometimes pedantry pays off. StepSecurity brings the tale of a supply chain infection of the popular Pythagoria-io GPT Pilot package, an AI coding assistant tool. After one of the developers was infected by the Miasma supply chain worm, the worm performed the typical trick of attempting to reversion and push compromised versions of all accessible packages.

This time, the commits containing the trojaned were rejected by the Python linter, Ruff, for not matching the style guidelines of the project. Linters analyze code for style, comments, and syntax (think the pretty printing in a code editor that highlights incorrect tabs and spaces or deprecated functions.)

The developer will still need to clean up their system and make sure to revoke all tokens the worm has access to, but the project itself was spared infection by a humble syntax styler.

Deep Dive into Miasma

Finally, we have a dive into the Miasma worm thanks to SafeDep.

The payload source for Miasma has been open sourced, apparently by some of the developers of the malware. Previously the payload was heavily encrypted, however progress was made in decoding it during the initial wave of attacks. By open sourcing the worm, the developers likely hope to muddy the waters by creating copy-cat worms using modified techniques and signatures.

SafeDep takes a deep look into the capabilities of the payload, noting several unusual abilities including disabling GitHub environment protections, a full list of the credential harvesting capabilities, and more. Be sure to check out the full write up for an extremely detailed breakdown of each major component of the worm and the actions it takes, if that sort of thing is interesting to you!

This week Jonathan chats with Alexander Neumann about Restic, a particularly compelling backup and restore solution written in Go. Why did the world need one more backup program? And what’s Alexander’s personal take on transitioning from programmer to maintainer? Watch to find out!

• https://restic.net/
• https://github.com/restic/restic
• https://fosstodon.org/@restic

Did you know you can watch the live recording of the show right on our YouTube Channel? Have someone you’d like us to interview? Let us know, or have the guest contact us! Take a look at the schedule here.

Direct Download in DRM-free MP3.

If you’d rather read along, here’s the transcript for this week’s episode.

Theme music: “Newer Wave” Kevin MacLeod (incompetech.com)

Licensed under Creative Commons: By Attribution 4.0 License

Christopher Nolan’s The Odyssey isn’t hitting theaters for another month or so, but if you’re already planning your trip to the cineplex, you may want to check out this page on the movie’s website which lets you view the trailer in the six (!) different formats it’s being released in.

We don’t really have an opinion on the big-screen adaptation of the epic tale as a piece of media, but from a technical standpoint, it’s interesting to see how the viewing experience changes between the 70mm IMAX version with an aspect ratio of 1.43:1 and the 35mm cut at 2.39:1. Unfortunately, the website offers no way to approximate what the movie will look like once compressed, streamed over the Internet, and displayed on a cheap TCL TV, to say nothing of how the viewing experience will be impacted should you watch the movie on your phone by way of a series of short YouTube clips while going to the bathroom. Maybe Nolan is saving that for his next film.

If you head over to the movies in one of Waymo’s vehicles, you can feel a little better about the long-term ecological impact of your trip thanks to a recently announced partnership between the autonomous car maker and B2U Storage Solutions. Under the agreement, old batteries pulled from Waymo’s fleet of self-driving electric cars will get a second life as localized grid storage.

The idea is that batteries which no longer hold enough charge to power a robo-taxi should still have enough capacity to store the energy produced by renewable sources so it can be doled out later when the demand goes up. By installing these batteries in the cities that Waymo actually operates their vehicles in, they don’t have to worry about shipping them around either — they can just yank them out of the car, and wire them right into the grid. Of course, eventually the batteries will be too cooked to adequately perform in this role as well, but this should give them a few more productive years before they get torn down and scrapped.

Speaking of scrapping, the Ladybird project has announced a pretty radical change for an open source project: as of Friday no public pull requests to the codebase will be accepted, and the only people who can make changes to the code will be the official maintainers. The license for the project isn’t changing, so folks are still free to create forks and modify the code of the scratch-built browser however they wish, but they’ll have to do so with the understanding that their changes will likely never get merged back upstream.

So why the change? You probably guessed it already: they are sick of people sending in patches developed with AI. We’ve talked about this issue previously, and the Ladybird devs are hardly the only ones struggling to separate the wheat from the vibecoded chaff. For what it’s worth, the announcement makes it clear that the team isn’t necessarily against the responsible use of AI in software development. Their concern stems more from the fact that AI lets anybody and everybody produce code that at least looks valid, and it makes it harder to figure out what’s good and worthy of inclusion and what should probably stay in somebody’s personal repo.

On the subject of software development, health-conscious free software aficionados will be excited to hear that the GNUtrition project hit version 0.33 on Friday. For those keeping track, the free-as-in-speech tool for *nix nerds looking to keep track of their caloric intake hasn’t seen a major release since 2012. The update takes into account the latest US Department of Agriculture (USDA) dietary data, and somewhat surprisingly, switches the whole codebase from Python 2 to pure C. Patches which would have allowed the new build of GNUtrition to calculate the nutritional value of substances eaten off of one’s shoe were mysteriously vetoed from the highest levels of the Free Software Foundation.

One more software link for the road: assuming it hasn’t been taken down by Nintendo’s rabid lawyers by the time this hits the front page, check out this WebASM port of Pokemon Emerald that you can play right in the browser.

The game came out more than 20 years ago for the Game Boy Advance, so the fact that it can run in a modern browser isn’t exactly shocking given how much of today’s software lives on the web. But we still love seeing these decompilation efforts and all the hacks that are made possible once you’ve got the code to work from rather than having to emulate the original system.

Finally, the good folks at iFixit have released a video wherein they take apart fake Apple products that were purchased in the electronics wonderland of Shenzhen. As you might expect, the gadgets they picked up all look fairly convincing at arm’s length, but many of their features don’t actually work and their internals are cobbled together with random ill-fitting bits and bobs.

At the end of the video they do note that the knock-offs are in general easier to take apart than their Cupertino counterparts, but that this doesn’t really help with their repairability or long-term viability as you’ll likely have a hell of a time tracking down replacement parts for the Number 1 Best AirPoods Max.

See something interesting that you think would be a good fit for our weekly Links column? Drop us a line, we’d love to hear about it.

This week, we’re shaking things up a little, with Tom Nardi still in the host seat, and someone besides Al Williams in the other, namely Kristina Panos.

In Hackaday news, we have a new Frikkin’ Lasers Challenge going on now, although we acknowledge that no one can actually enter their project into it at the moment. We hope to have that fixed in short order. Procrastinators, disregard.

You’ll have to wait another week for the triumphant return of What’s That Sound, but we do have an audio mailbag for you this week. Thanks, Dillon!

We look at loading SEGA games from a vinyl record, discuss a really cool project that puts live plane data on your ceiling, and debate the name ‘PopTuber’. We also discuss DIY routers, and stress over the future of electronic shelf labels.

Check out the links below if you want to follow along, and as always, tell us what you think about this episode in the comments!

Download in DRM-free MP3 and share it with your favorite PopTuber.

Episode 372 Show Notes:

News:

• The Frikkin Lasers Contest Starts Now

Mailbag:

• Dillon asks the crew whether they take notes while working on projects, and how. And how!

Interesting Hacks of the Week:

• Texas Instruments Changes The NE5532 And Others Into Incompatible Versions
• Loading Sega Genesis Games Off A Vinyl Record
  • VCF East 2018: The Mail Order App Store
• Make Your Ceiling Disappear With ADS-B And Short-Throw Projector
• Like A Wire Bender, But For Pop Tubes
  • GETULA
• An RGB Keyboard For Your Hackaday Communicator Badge
  • Announcing The 2025 Hackaday Superconference Communicator Badge
• DIY Ceramic Circuit Boards Surely Count As Solarpunk

Quick Hacks:

• Tom’s Picks:
  • Ways To Embed Magnets In 3D Prints And Not Ruin Printers
  • Fixing A Nintendo Game Boy Clone That Runs Too Fast
  • Ebike Display Uses Reflective LCD
• Kristina’s Picks:
  • A Camera Viewfinder Makes A Great TV
  • The Uncooperative Mirror Will Not Help You
  • A Diffraction Grating Makes This Clock Readable

Can’t-Miss Articles:

• Revisiting Making Your Own Internet Router In 2026
• Ask Hackaday: How Do You Feel About Electronic Shelf Labels?