Production KiCad Template Covers All Your Bases

Ever think about all the moving parts involving a big KiCad project going into production? You need to provide manufacturer documentation, assembly instructions and renders for them to reference, every output file they could want, and all of it has to always stay up to date. [Vincent Nguyen] has a software pipeline to create all the files and documentation you could ever want upon release – with an extensive installation and usage guide, helping you turn your KiCad projects truly production-grade.

This KiBot-based project template has no shortage of features. It generates assembly documents with custom processing for a number of production scenarios like DNPs, stackup and drill tables, fab notes, it adds features like table of contents and 3D renders into KiCad-produced documents as compared to KiCad’s spartan defaults, and it autogenerates all the outputs you could want – from Gerbers, .step and BOM files, to ERC/DRC reports and visual diffs.

This pipeline is Github-tailored, but it can also be run locally, and it works wonderfully for those moments when you need to release a PCB into the wild, while making sure that the least amount of things possible can go wrong during production. With all the features, it might take a bit to get used to. Don’t need fully-featured, just some GitHub page images? Use this simple plugin to auto-add render images in your KiCad repositories, then.

youtube.com/embed/63R6Wnx44uY?…

We thank [Jaac] for sharing this with us!

hackaday.com/2025/12/10/produc…

FLOSS Weekly Episode 858: YottaDB: Sometimes the Solution is Bigger Servers

This week Jonathan chats with K. S. Bhaskar about YottaDB. This very high performance database has some unique tricks! How does YottaDB run across multiple processes without a daemon? Why is it licensed AGPL, and how does that work with commercial deployments? Watch to find out!

• yottadb.com/feed/
• github.com/YottaDB/YDB

youtube.com/embed/aUhdny-zHdw?…

Did you know you can watch the live recording of the show right on our YouTube Channel? Have someone you’d like us to interview? Let us know, or have the guest contact us! Take a look at the schedule here.

play.libsyn.com/embed/episode/…

Direct Download in DRM-free MP3.

If you’d rather read along, here’s the transcript for this week’s episode.

Places to follow the FLOSS Weekly Podcast:

• Spotify
• RSS

Theme music: “Newer Wave” Kevin MacLeod (incompetech.com)

Licensed under Creative Commons: By Attribution 4.0 License

hackaday.com/2025/12/10/floss-…

Why LLMs are Less Intelligent than Crows

The basic concept of human intelligence entails self-awareness alongside the ability to reason and apply logic to one’s actions and daily life. Despite the very fuzzy definition of ‘human intelligence‘, and despite many aspects of said human intelligence (HI) also being observed among other animals, like crows and orcas, humans over the ages have always known that their brains are more special than those of other animals.

Currently the Cattell-Horn-Carroll (CHC) theory of intelligence is the most widely accepted model, defining distinct types of abilities that range from memory and processing speed to reasoning ability. While admittedly not perfect, it gives us a baseline to work with when we think of the term ‘intelligence’, whether biological or artificial.

This raises the question of how in the context of artificial intelligence (AI) the CHC model translate to the technologies which we see in use today. When can we expect to subject an artificial intelligence entity to an IQ test and have it handily outperform a human on all metrics?

Types Of Intelligence

While the basic CHC model contains ten items, the full model is even more expansive, as can be seen in the graphic below. Most important are the overarching categories and the reasoning for the individual items in them, as detailed in the 2014 paper by Flanagan and McGrew. Of these, reasoning (Gf, for fluid intelligence), acquired knowledge and memory (long and short term) are arguably the most relevant when it comes to ‘general intelligence’.
Current and expanded CHC theory of cognitive abilities. Source: Flanagan & McGrew (1997).
Fluid intelligence (Gf), or reasoning, entails the ability to discover the nature of the problem or construction, to use a provided context to fill in the subsequent steps, and to handle abstract concepts like mathematics. Crystallized intelligence (Gc) can be condensed to ‘basic skills’ and general knowledge, including the ability to communicate with others using a natural language.

The basic memory abilities pertain to short-term (Gsm) and long-term recall (Glr) abilities, in particular attention span, working memory and the ability to recall long-term memories and associations within these memories.

Beyond these basic types of intelligence and abilities we can see that many more are defined, but these mostly expand on these basic four, such as visual memory (Gv), various visual tasks, speed of memory operations, reaction time, reading and writing skills and various domain specific knowledge abilities. Thus it makes sense to initially limit evaluating both HI and AI within this constrained framework.

Are Humans Intelligent?

North American Common Raven (Corvus corax principalis) in flight at Muir Beach in Northern California (Credit: Copetersen)
It’s generally considered a foregone conclusion that because humans as a species possesses intelligence, ergo facto every human being possesses HI. However, within the CHC model there is a lot of wriggle room to tone down this simplification. A big part of IQ tests is to test these these specific forms of intelligence and skills, after all, creating a mosaic that’s then boringly reduced to a much less meaningful number.

The main discovery over the past decades is that the human brain is far less exceptional than we had assumed. For example crows and their fellow corvids easily keep up with humans in a range of skills and abilities. As far as fluid intelligence is concerned, they clearly display inductive and sequential reasoning, as they can solve puzzles and create tools on the spot. Similarly, corvids regularly display the ability to count and estimate volumes, demonstrating quantitative reasoning. They have regularly demonstrated understanding water volume, density of objects and the relation between these.

In Japanese parks, crows have been spotted manipulating the public faucets for drinking and bathing, adjusting the flow to either a trickle or a strong flow depending on what they want. Corvids score high on the Gf part of the CHC model, though it should be said that the Japanese crow in the article did not turn the faucet back off again, which might just be because they do not care if it keeps running.

When it comes to crystallized intelligence (Gc) and the memory-related Gsm and Glr abilities, corvids score pretty high as well. They have been reported to remember human faces, to learn from other crows by observing them, and are excellent at mimicking the sounds that other birds make. There is evidence that corvids and other avian dinosaur species (‘birds’) are capable of learning to understand human language, and even communicating with humans using these learned words.

The key here is whether the animal understands the meaning of the vocalization and what vocalizing it is meant to achieve when interacting with a human. Both parrots and crows show signs of being able to learn significant vocabularies of hundreds of words and conceivably a basic understanding of their meaning, or at least what they achieve when uttered, especially when it comes to food.

Whether non-human animals are capable of complex human speech remains a highly controversial topic, of course, though we are breathlessly awaiting the day that the first crow looks up at a human and tells the hairless monkey what they really think of them and their species as a whole.

The Bears

The bear-proof garbage bins at Yosemite National Park. (Credit: detourtravelblog)
Meanwhile there’s a veritable war of intellects going on in US National Parks between humans and bears, involving keeping the latter out of food lockers and trash bins while the humans begin to struggle the moment the bear-proof mechanism requires more than two hand motions. This sometimes escalates to the point where bears are culled when they defeat mechanisms using brute force.

Over the decades bears have learned that human food is easier to obtain and fills much better than all-natural food sources, yet humans are no longer willing to share. The result is an arms race where bears are more than happy to use any means necessary to obtain tasty food. Ergo we can put the Gf, Gc and memory-related scores for bears also at a level that suggests highly capable intellects, with a clear ability to learn, remember, and defeat obstacles through intellect. Sadly, the bear body doesn’t lend itself well to creating and using tools like a corvid can.

Despite the flaws of the CHC model and the weaknesses inherent in the associated IQ test scores, it does provide some rough idea of how these assessed capabilities are distributed across a population, leading to a distinct Bell curve for IQ scores among humans and conceivably for other species if we could test them. Effectively this means that there is likely significant overlap between the less intelligent humans and smarter non-human animals.

Although H. sapiens is undeniably an intelligent species, the reality is that it wasn’t some gods-gifted power, but rather an evolutionary quirk that it shares with many other lifeforms. This does however make it infinitely more likely that we can replicate it with a machine and/or computer system.

Making Machines Intelligent

Artificial Intelligence Projects for the Commodore 64, by Timothy J. O’Malley
The conclusion we have thus reached after assessing HI is that if we want to make machines intelligent, they need to acquire at least the Gf, Gc, Gsm and Glr capabilities, and at a level that puts them above that of a human toddler, or a raven if you wish.

Exactly how to do this has been the subject of much research and study the past millennia, with automatons (‘robots’) being one way to pour human intellect into a form that alleviates manual labor. Of course, this is effectively merely on par with creating tools, not an independent form of intelligence. For that we need to make machines capable of learning.

So far this has proved very difficult. What we are capable of so far is to condense existing knowledge that has been annotated by humans into a statistical model, with large language models (LLMs) as the pinnacle of the current AI hype bubble. These are effectively massively scaled up language models following the same basic architecture as those that hobbyists were playing with back in the 1980s on their home computers.

With that knowledge in mind, it’s not so surprising that LLMs do not even really register on the CHC model. In terms of Gf there’s not even a blip of reasoning, especially not inductively, but then you would not expect this from a statistical model.

As far as Gc is concerned, here the fundamental flaw of a statistical model is what it does not know. It cannot know what it doesn’t know, nor does it understand anything about what is stored in the weights of the statistical model. This is because it’s a statistical model that’s just as fixed in its functioning as an industrial robot. Chalk up another hard fail here.

Finally, although the context window of LLMs can be considered to be some kind of short-term memory, it is very limited in its functionality. Immediate recall of a series of elements may work depending on the front-end, but cognitive operations invariably fail, even very basic ones such as adding two numbers. This makes Gsm iffy at best, and more realistically a complete fail.

Finally, Glr should be a lot easier, as LLMs are statistical models that can compress immense amounts of data for easy recall. But this associative memory is an artefact of human annotation of training data, and is fixed at the time of training the model. After that, it does not remember outside of its context window, and its ability to associate text is limited to the previous statistical analysis of which words are most likely to occur in a sequence. This fact alone makes the entire Glr ability set a complete fail as well.

Piecemeal Abilities

Although an LLM is not intelligent by any measure and has no capacity to ever achieve intelligence, as a tool it’s still exceedingly useful. Technologies such as artificial neurons and large language models have enabled feats such as machine vision that can identify objects in a scene with an accuracy depending on the training data, and by training an LLM on very specific data sets the resulting model can be a helpful statistical tool, as it’s a statistical model.

These are all small fragments of what an intelligent creature is capable of, condensed into tool form. Much like hand tools, computers and robots, these are all tools that we humans have crafted to make certain tasks easier or possible. Like a corvid bending some wire into shape to open a lock or timing the dropping of nuts with a traffic light to safely scoop up fresh car-crushed nuts, the only intelligence so far is still found in our biological brains.

All of which may change as soon as we figure out a way to replicate abstract aspects such as reasoning and understanding, but that’s still a whole kettle of theoretical fish at this point in time, and the subject of future articles.

hackaday.com/2025/12/10/why-ll…

Cheap 10x10cm Hotplate Punches Above Its Weight

For less than $30 USD, you can get a 10×10 centimeter hotplate with 350 Watts of power. Sounds mighty fine to us, so surely there must be a catch? Maybe not, as [Stefan Nikolaj]’s review of this AliExpress hotplate details, it seems to be just fine enough.

At this price, you’d expect some shoddy electronics inside, or maybe outright fiery design decisions, in the vein of other reviews for similar cheap heat-producing tech that we’ve seen over the years. Nope – the control circuitry seems to be more than well-built for our standards, with isolation and separation where it matters, the input being fused away, and the chassis firmly earthed. [Stefan] highlights just two possible problem areas: a wire nut that could potentially be dodgy, and lack of a thermal fuse. Both can be remedied easily enough after you get one of these, and for the price, it’s a no-brainer. Apart from the review, there’s also general usage recommendations from [Stefan] in the end of the blog post.

While we’re happy to see folks designing their own PCB hotplates or modifying old waffle irons, the availability of cheap turn-key options like this means there’s less of a reason to go the DIY route. Now, if you’re in the market for even more build volume, you can get one of the classic reflow ovens, and maybe do a controller upgrade while you’re at it.

hackaday.com/2025/12/10/cheap-…

Ask Hackaday: Solutions, or Distractions?

The “Long Dark” is upon us, at least for those who live north of the equator, and while it’s all pre-holiday bustle, pretty lights, and the magical first snow of the season now, soon the harsh reality of slushy feet, filthy cars, and not seeing the sun for weeks on end will set in. And when it does, it pays to have something to occupy idle mind and hands alike, a project that’s complicated enough to make completing even part of it feel like an accomplishment.

But this time of year, when daylight lasts barely as long as a good night’s sleep, you’ve got to pick your projects carefully, lest your winter project remain incomplete when the weather finally warms and thoughts turn to other matters. For me, at least, that means being realistic about inevitabilities such as competition from the day job, family stuff, and the dreaded “scope creep.”

It’s that last one that I’m particularly concerned with this year, because it has the greatest potential to delay this project into spring or even — forbid it! — summer. And that means I need to be on the ball about what the project actually is, and to avoid the temptation to fall into any rabbit holes that, while potentially interesting and perhaps even profitable, will only make it harder to get things done.

Pushing My Buttons

For my winter project this year, I chose something I’ve been itching to try for a while: an auto-starter for my generator. Currently, my solar PV system automatically charges its battery bank when the state of charge (SOC) drops below 50%, which it does with alarming frequency during these short, dark days. But rather than relying on shore power, I want my generator to kick on to top off the batteries, then turn itself off when the charge is complete.
Primer assembly for the generator auto-start. The silver part is the regulator; the solenoid pushes the primer button when it fires. All the parts needed to be custom-made.
In concept, it’s a simple project, since the inverter panel I chose has dry contacts that can trigger based on SOC. It seems like a pretty easy job, just a microcontroller to sense when the inverter is calling for a charge and some relays to kick the generator on. It’s a little — OK, a lot — more complicated than that when you think about it, since you have to make sure the generator actually cranks over, you’ve got to include fail-safes so the generator doesn’t just keep cranking endlessly if it doesn’t catch, and you have to make everything work robustly in an electrically and mechanically noisy environment.

However, in my case, the most challenging aspect is dealing with the mechatronics of the project. My generator is fueled by propane, which means there’s a low-pressure regulator that needs to be primed before cranking the starter. When cranking the generator manually, you just push the primer button a few times to get enough propane into the fuel intake and turn the key. Automating this process, though, is another matter, one that will surely require custom parts, and the easiest path to that would be 3D printing.

But, up until a couple of weeks ago, I didn’t own a 3D printer. I know, it’s hard to believe someone who writes for Hackaday for a living wouldn’t own one of the essential bits of hacker kit, but there it is. To be fair to myself, I did dip my toe into additive manufacturing about six or seven years ago, but that printer was pretty awful and never really turned out great prints. It seemed like this project, with its potential need for many custom parts, was the perfect excuse to finally get a “big boy” printer.

Pick Your Project

And that’s where I came upon the first potential rabbit hole: should I buy an out-of-the-box solution, or should I take on a side-quest project? I was sorely tempted to take the latter course by getting one of those used Enders returned to Amazon, having heard that they’re about half the price of new and often need very little work to get them going. But then again, sometimes these printers have gone through a lot in the short time they were in a customer’s hands, to the point where they need quite a bit of work to get them back in good order.

While I like the idea of a cheap printer, and I wouldn’t mind tinkering with one to get it going again, I decided against the return route. I really didn’t like my odds, given that our Editor in Chief, Elliot Williams, says that of the two returned printers he’s purchased, one worked basically out of the box, while the other needed more work to get in shape. I wanted to unbox the printer and start making parts right away, to get this project going. So, I took the plunge and bought a Bambu P1S on a pre-Black Friday sale that was much less than list price, but much more than what I would have paid for a returned Ender.

Now, I’m not going to turn this into a printer review — that’s not really the point of this article. What I want to get across is that I decided to buy a solution rather than take on a new hobby. I got the Bambu up and running in about an hour and was cranking out prototype parts for my project later that afternoon. Yes, I might have had the same experience with a returned printer at about half the price of the Bambu, but I felt like the perceived value of a new printer was worth the premium price, at least in this case.

I think this is a pretty common choice that hackers face up and down the equipment spectrum. Take machine tools, for instance. Those of us who dream of one day owning a shop full of metalworking tools often trawl through Facebook Marketplace in search of a nice old South Bend lathe or a beautiful Bridgeport milling machine, available for a song compared to what such a machine would cost new. But with the difficulty and expense of getting it home and the potential for serious mechanical problems like worn ways or broken gears that need to be sorted before putting the machine to use, the value proposition could start to shift back toward buying a brand new machine. Expensive, yes, but at least you stand a chance of making parts sooner.

Your Turn

Don’t get me wrong; I’d love to find a nice old lathe to lovingly restore, and I just may do that someday. It’s like buying a rusty old classic car; you’re not doing it to end up with a daily driver, but rather for the joy of restoring a fine piece of engineering to its former glory. In projects like that, the journey is the point, not the destination. But if I need to make parts right away, a new lathe — or mill, or CNC router, or 3D printer — seems like the smarter choice.

I’ll turn things over to you at this point. Have you come up against this kind of decision before? If so, which path did you choose? Has anyone had a satisfying out-of-the-box experience with returned printers? Was I unnecessarily pessimistic about my chances in that market? What about your experience with large machine tools, like lathes and mills? Is it possible to buy used and not have the machine itself become the project? Sound off in the comments below.

hackaday.com/2025/12/10/ask-ha…

Failed 3D Printed Part Brings Down Small Plane

Back in March, a small aircraft in the UK lost engine power while coming in for a landing and crashed. The aircraft was a total loss, but thankfully, the pilot suffered only minor injuries. According to the recently released report by the Air Accidents Investigation Branch, we now know a failed 3D printed part is to blame.

The part in question is a plastic air induction elbow — a curved duct that forms part of the engine’s air intake system. The collapsed part you see in the image above had an air filter attached to its front (towards the left in the image), which had detached and fallen off. Heat from the engine caused the part to soften and collapse, which in turn greatly reduced intake airflow, and therefore available power.
Serious injury was avoided, but the aircraft was destroyed.
While the cause of the incident is evident enough, there are still some unknowns regarding the part itself. The fact that it was 3D printed isn’t an issue. Additive manufacturing is used effectively in the aviation industry all the time, and it seems the owner of the aircraft purchased the part at an airshow in the USA with no reason to believe anything was awry. So what happened?

The part in question is normally made from laminated fiberglass and epoxy, with a glass transition of 84° C. Glass transition is the temperature at which a material begins to soften, and is usually far below the material’s actual melting point.

When a part is heated at or beyond its glass transition, it doesn’t melt but is no longer “solid” in the normal sense, and may not even be able to support its own weight. It’s the reason some folks pack parts in powdered salt to support them before annealing.

The printed part the owner purchased and installed was understood to be made from CF-ABS, or ABS with carbon fiber. ABS has a glass transition of around 100° C, which should have been plenty for this application. However, the investigation tested two samples taken from the failed part and measured the glass temperature at 52.8°C and 54.0°C, respectively. That’s a far cry from what was expected, and led to part failure from the heat of the engine.

The actual composition of the part in question has not been confirmed, but it sure seems likely that whatever it was made from, it wasn’t ABS. The Light Aircraft Association (LAA) plans to circulate an alert to inspectors regarding 3D printed parts, and the possibility they aren’t made from what they claim to be.

hackaday.com/2025/12/10/failed…

Il QDay è vicino? QuantWare presenta il processore quantistico da 10.000 qubit

Il mondo della tecnologia quantistica ha compiuto un balzo in avanti impressionante:

QuantWare ha presentato il primo processore al mondo da 10.000 qubit, 100 volte più di qualsiasi dispositivo esistente. Inoltre, il nuovo chip occupa ancora meno spazio rispetto ai sistemi attuali, rendendo questa svolta particolarmente degna di nota in un contesto di anni di stagnazione nella scalabilità dei processori quantistici.

Per quasi un decennio, il settore non è riuscito a superare la soglia dei 100 qubit. Google è riuscita a passare da 53 a 105 qubit solo in sei anni, mentre IBM ha introdotto un processore da 1.121 qubit nel 2023 e non prevede una crescita significativa almeno fino al 2028. Di fronte alle limitazioni hardware, le aziende sono state costrette a combinare più chip di piccole dimensioni anziché aumentare la potenza di uno solo. Ciò ha complicato l’architettura, aumentato i costi e ostacolato il progresso reale.

QuantWare sostiene che la sua nuova architettura rimuove questa barriera.

Si basa sulla scalabilità 3D e su un design modulare a livello di chiplet, supportando 40.000 linee di I/O e interconnessioni interchip ad alta precisione. Questo approccio consente la costruzione di unità di elaborazione quantistica (QPU) monolitiche di grandi dimensioni senza sacrificare affidabilità o prestazioni.

L’azienda sostiene che il nuovo sistema offre una potenza di calcolo significativamente maggiore per dollaro e per watt rispetto alle soluzioni multi-chip, e l’architettura stessa potrebbe diventare uno standard di scalabilità a livello di settore. Qualsiasi organizzazione che lavori con qubit superconduttori potrà utilizzarlo per creare dispositivi quantistici più potenti.

QuantWare sta sviluppando contemporaneamente l’ecosistema Quantum Open Architecture, che ora includeNVIDIA NVQLink. Combinata con l’architettura proprietaria di QuantWare, questa tecnologia combina il calcolo quantistico iperscalabile con il calcolo classico ad alte prestazioni, accessibile tramite NVIDIA CUDA-Q. L’azienda è convinta che la combinazione di VIO e NVQLink offra la scalabilità di cui il settore ha disperatamente bisogno oggi.

Insieme all’annuncio, l’azienda ha anche annunciato l’intenzione di costruire un impianto Kilofab su larga scala. L’impianto, la cui apertura è prevista per il 2026 a Delft, nei Paesi Bassi, diventerà la prima fabbrica al mondo dedicata ai dispositivi Quantum Open Architecture e uno dei più grandi impianti di produzione quantistica mai progettati. QuantWare spedisce già più processori quantistici di qualsiasi altro produttore commerciale in termini di volume, e Kilofab aumenterà questa capacità di 20 volte.

Matt Rijlaarsdam, CEO di QuantWare, ha definito questo un punto di svolta atteso da tempo.

Ha osservato che per anni gli specialisti si erano limitati a teorizzare le capacità dei sistemi quantistici, poiché il settore era limitato a 100 qubit e non poteva raggiungere una potenza di calcolo economicamente significativa. Il nuovo processore, ha affermato, rimuove finalmente questa barriera e apre la strada a computer quantistici realmente utili . “Con il VIO-40K, stiamo offrendo all’intero ecosistema l’accesso all’architettura di processore quantistico più potente e scalabile mai realizzata”, ha sottolineato.

I preordini sono già aperti e le prime unità saranno consegnate ai clienti nel 2028.

Ricordiamo che nel 2019 Craig Gidney e Martin Ekerå stimarono, nel loro lavoro intitolato “How to factor 2048-bit RSA integers in 8 hours using 20 million noisy qubits”, che un dispositivo quantistico con circa 20 milioni di qubit fisici “rumorosi” — connessi in una griglia piana e corretti con codice superficie (surface code) — sarebbe teoricamente in grado di fattorizzare una chiave RSA a 2048 bit in circa 8 ore.

Tuttavia, in un aggiornamento del 2025 lo stesso Gidney propone ottimizzazioni sostanziali: grazie a tecniche come l’approximate residue arithmetic e una gestione più efficiente dei qubit logici dormienti, secondo l’articolo “How to factor 2048 bit RSA integers with less than a million noisy qubits” oggi sarebbe sufficiente un quantum computer con meno di un milione di qubit fisici rumorosi per scomporre una chiave RSA-2048, in un tempo “meno di una settimana.

L'articolo Il QDay è vicino? QuantWare presenta il processore quantistico da 10.000 qubit proviene da Red Hot Cyber.

@Friendica Support hello, may i pls get some help on this query about #Circles ?

i have sub-divided my list of follows & followers into several Circles. one of these is for all my followed #newsbots. i have found to my chagrin that a basic design feature of #Friendica is working against me here. atm, if i read a particular newsbot's post whilst in my "Bot" circle, then decide to quote-boost / quote-share it, with some pertinent commentary by me, it's a complete waste of time... the default Friendica permissions / visibility feature makes my resultant post "Locked", ie visible only to members of this circle, ie, a heap of bots. no actual human will ever see it.

[how] can i avoid this? how can i manually allow any/all posts / replies / boosts / shares that i do from this circle, be visible across all the fediverse?

when circles comprise actual human accounts, this baked-in Friendica privacy concept makes sense. it is however actively unhelpful, indeed plain obstructive, for the specific case of a bot circle.

thx.

🤞 🤞 🤞

CISA avverte: bug critici in WinRAR e Windows aggiunti al KEV. Patch immediate necessarie

A seguito della scoperta di exploit attivi, la Cybersecurity and Infrastructure Security Agency (CISA) ha inserito due vulnerabilità critiche al catalogo Known Exploited Vulnerabilities (KEV) dell’agenzia, il quale include vulnerabilità rilevate in software molto diffusi sfruttate attivamente.

La prima vulnerabilità, il CVE-2025-6218, riguarda il popolare strumento di compressione file WinRAR. Questa falla di path traversal ed è particolarmente pericolosa perché consente agli aggressori di aggirare i controlli di sicurezza e di installare malware nel sistema di un utente semplicemente chiedendogli di estrarre un file.

“Quando si estrae un file, le versioni precedenti di WinRAR, le versioni Windows di RAR, UnRAR, il codice sorgente portatile di UnRAR e UnRAR.dll possono essere ingannate e utilizzare un percorso definito in un archivio appositamente creato, invece del percorso specificato dall’utente”, si legge nel changelog.

La falla riguarda le versioni 7.11 e precedenti di WinRAR su Windows. Secondo il rapporto, la vulnerabilità consente ad archivi dannosi di indurre il software a estrarre “silenziosamente” i file in posizioni sensibili, come la cartella di avvio di Windows.

Nel luglio 2025, un autore di minacce noto come “zeroplayer” è stato visto vendere un exploit zero-day WinRAR sul forum del dark web Exploit.in per 80.000 dollari. Secondo gli esperti di sicurezza, il gruppo di hacker noto come Paper Werewolf (anche conosciuto come GOFFEE) avrebbe ottenuto questo exploit, che sarebbe stato utilizzato in recenti campagne di attacco sfruttando tale vulnerabilità.

La seconda vulnerabilità, il CVE-2025-62221 del quale abbiamo parlato questa mattina, colpisce il cuore del sistema operativo Windows. Si tratta di una falla di escalation dei privilegi localizzata nel driver Windows Cloud Files Mini Filter.

Sfruttando con successo questa falla, l’aggressore ottiene privilegi di SYSTEM, il livello di accesso più elevato su un computer Windows. Sebbene Microsoft non abbia rivelato i meccanismi specifici dell’exploit, la falla è stata attribuita al Microsoft Threat Intelligence Center (MSTIC).

Microsoft descrive il problema come una vulnerabilità “Use after free”. “La vulnerabilità Use after free nel driver Windows Cloud Files Mini Filter consente a un aggressore autorizzato di elevare i privilegi localmente”, spiega l’avviso.

Dato lo sfruttamento attivo di queste falle, il CISA ha fissato una scadenza rigorosa.

Le agenzie del Federal Civilian Executive Branch (FCEB) sono tenute a porre rimedio a queste vulnerabilità entro il 30 dicembre 2025, per proteggere le proprie reti da queste minacce in continua evoluzione.

L'articolo CISA avverte: bug critici in WinRAR e Windows aggiunti al KEV. Patch immediate necessarie proviene da Red Hot Cyber.

Malware in Visual Studio Code: due estensioni dannose rubano dati sensibili

Sono state scoperte due estensioni dannose che infettano i computer degli sviluppatori con programmi stealer sul marketplace di Visual Studio Code di Microsoft. Il malware può acquisire screenshot, rubare password e wallet di criptovalute e persino dirottare le sessioni del browser.

I ricercatori di Koi Security hanno scoperto le estensioni dannose Bitcoin Black e Codo AI, che si mascherano da tema e assistente AI.

Entrambi i malware sono stati pubblicati con il nome dello sviluppatore BigBlack. Al momento della pubblicazione del rapporto dei ricercatori, Codo AI era ancora disponibile nello store, sebbene avesse meno di 30 download. Bitcoin Black aveva una sola installazione.

Secondo gli esperti, Bitcoin Black utilizza l’evento di attivazione “*”, che viene attivato da ogni azione in VSCode. Il plugin può anche eseguire codice PowerShell.

Nelle versioni precedenti, l’estensione utilizzava uno script di PowerShell per scaricare un archivio protetto da password contenente il payload. Tuttavia, ciò causava la visualizzazione di una finestra di PowerShell, che poteva allertare l’utente. Nelle versioni più recenti del malware, il processo è stato spostato in uno script batch (bat.sh), che richiama curl per scaricare un file DLL e un file eseguibile .exe, il tutto in modalità stealth.

Per quanto riguarda Codo AI, l’estensione può effettivamente aiutare l’utente con il codice utilizzando ChatGPT o DeepSeek, ma contiene anche un componente dannoso simile.

Entrambe le estensioni contengono un file eseguibile Lightshot legittimo e una DLL dannosa, che viene caricata tramite dirottamento della DLL e distribuisce un infostealer denominato runtime.exe sul sistema della vittima. Solo 29 dei 72 programmi antivirus su VirusTotal rilevano la DLL dannosa.

Sul computer infetto, il malware crea una directory in %APPDATA%Local e una cartella Evelyn per archiviare i dati rubati, tra cui informazioni sui processi in esecuzione, contenuti degli appunti, credenziali Wi-Fi, dati di sistema, screenshot, un elenco dei programmi installati e processi attivi.

Per rubare i cookie e dirottare le sessioni degli utenti, il malware avvia Chrome ed Edge in modalità headless, da dove recupera i cookie memorizzati e dirotta le sessioni.

Inoltre, lo stealer, nascondendosi nelle estensioni, ruba dati da portafogli di criptovalute come Phantom, Metamask ed Exodus e cerca anche password e altre credenziali.

I rappresentanti di Microsoft segnalano che entrambe le estensioni dannose sono state rimosse dal marketplace VSCode.

L'articolo Malware in Visual Studio Code: due estensioni dannose rubano dati sensibili proviene da Red Hot Cyber.