Кацапські воєнкриси заявляють про нібито нову атаку морських безпілотників по танкеру тіньового флоту рф «Дашан», що ходить під прапором Гамбії

Атака нібито відбулась дві години тому в Чорному морі. Ступінь ушкодження посудини невідома.

Лідери Коаліції охочих проведуть зустріч у Берліні 15 грудня — Reuters

Метою зустрічі є обговорення мирного плану для України.

Посли країн Євросоюзу погодили нові санкції щодо Росії, повідомив редактор Радіо Свобода з питань Європи Рікард Йозвяк.

За його даними, дипломати домовилися додати до санкційних списків дев'ятьох фізичних та юридичних осіб, які сприяють діяльності «тіньового флоту» та 43 судна, 12 людей і дві компанії, які «дестабілізують ЄС».

Посли ЄС мають формально ухвалити нові санкції в п’ятницю 12 грудня, додав Йозвяк.

Your Supercomputer Arrives in the Cloud

For as long as there have been supercomputers, people like us have seen the announcements and said, “Boy! I’d love to get some time on that computer.” But now that most of us have computers and phones that greatly outpace a Cray 2, what are we doing with them? Of course, a supercomputer today is still bigger than your PC by a long shot, and if you actually have a use case for one, [Stephen Wolfram] shows you how you can easily scale up your processing by borrowing resources from the Wolfram Compute Services. It isn’t free, but you pay with Wolfram service credits, which are not terribly expensive, especially compared to buying a supercomputer.

[Stephen] says he has about 200 cores of local processing at his house, and he still sometimes has programs that run overnight. If your program already uses a Wolfram language and uses parallelism — something easy to do with that toolbox — you can simply submit a remote batch job.

What constitutes a supercomputer? You get to pick. You can just offload your local machine using a single-core 8GB virtual machine — still a supercomputer by 1980s standards. Or you get machines with up to 1.5TB of RAM and 192 cores. Not enough for your mad science? No worries, you can map a computation across more than one machine, too.

As an example, [Stephen] shows a simple program that tiles pentagons:

When the number of pentagons gets large, a single line of code sends it off to the cloud:

RemoteBatchSubmit[PentagonTiling[500]]

The basic machine class did the work in six minutes and 30 seconds for a cost of 5.39 credits. He also shows a meatier problem running on a 192-core 384GB machine. That job took less than two hours and cost a little under 11,000 credits (credit cost from just over $4/1000 to $6/1000, depending on how many you buy, so this job cost about $55 to run). If two hours is too much, you can map the same job across many small machines, get the answer in a few minutes, and spend fewer credits in the process.

Supercomputers today are both very different from old supercomputers and yet still somewhat the same. If you really want that time on the Cray you always wanted, you might think about simulation.

hackaday.com/2025/12/10/your-s…

Ivanti risolve 4 vulnerabilità critiche in Endpoint Manager (EPM)

Un aggiornamento urgente è stato pubblicato da Ivanti per la sua piattaforma Endpoint Manager (EPM), al fine di risolvere un insieme di vulnerabilità significative che potrebbero permettere agli aggressori di eseguire codice a loro scelta o di prendere il controllo delle sessioni amministrative.

Tra le vulnerabilità corrette, vi sono quattro falle specifiche, compresa una particolarmente critica, contraddistinta da un punteggio di elevata gravità, che sono state sanate grazie a questo aggiornamento.

Per le organizzazioni che non sono in grado di applicare immediatamente la patch, e suggerisce di segregare al meglio le proprie reti riportando che : “Se i clienti non hanno esposto la propria soluzione su Internet, il rischio di questa vulnerabilità è significativamente ridotto”.

Una falla di sicurezza di Stored Cross-Site Scripting (XSS) monitorata con il CVE-2025-10573, ha ottenuto un punteggio CVSS di 9,6. Le versioni del software EPM antecedenti alla 2024 SU4 SR1 sono interessate da questa vulnerabilità.

L’avviso segnala che la vulnerabilità permette ad un aggressore remoto non autenticato di eseguire codice JavaScript a sua scelta all’interno di una sessione di amministrazione.

La falla richiede l’interazione dell’utente, in quanto è probabile che un amministratore venga indotto a visualizzare una pagina dannosa, tuttavia il rischio di un dirottamento dell’intera sessione impone una priorità assoluta per i responsabili della difesa.

Oltre al bug critico XSS, Ivanti ha corretto altre tre vulnerabilità di elevata gravità che espongono il sistema all’esecuzione di codice remoto (RCE) e alla manipolazione non autorizzata dei file:

• Scrittura di file arbitraria (CVE-2025-13659): classificata CVSS 8.8, questa falla riguarda il “controllo improprio delle risorse di codice gestite dinamicamente”, consentendo a un aggressore remoto e non autenticato di scrivere file arbitrari sul server.
• Errore di verifica della firma (CVE-2025-13662): con un punteggio CVSS di 7,8, questa vulnerabilità deriva da una “verifica impropria delle firme crittografiche nel componente di gestione delle patch”. Consente ad aggressori remoti non autenticati di eseguire codice arbitrario, sebbene richieda l’interazione dell’utente.
• Path Traversal (CVE-2025-13661): questo problema (CVSS 7.1) consente a un aggressore autenticato di “scrivere file arbitrari al di fuori della directory prevista”, compromettendo potenzialmente l’integrità del sistema.

Sebbene Ivanti affermi di “non essere a conoscenza di alcun cliente sfruttato da queste vulnerabilità al momento della divulgazione”, consiglia vivamente ai clienti di effettuare immediatamente l’aggiornamento.

L'articolo Ivanti risolve 4 vulnerabilità critiche in Endpoint Manager (EPM) proviene da Red Hot Cyber.

Volumetric Display With Lasers and Bubbly Glass

There’s a type of dust-collector that’s been popular since the 1990s, where a cube of acrylic or glass is laser-etched in a three-dimensional pattern. Some people call them bubblegrams. While it could be argued that bubblegrams are a sort of 3D display, they’re more like a photograph than a TV. [Ancient] had the brainwave that since these objects work by scattering light, he could use them as a proper 3D video display by controlling the light scattered from an appropriately-designed bubblegram.

Appropriately designed, in this case, means a point cloud, which is not exactly exciting to look at on its own. It’s when [Ancient] adds the colour laser scanning projector that things get exciting. Well, after some very careful alignment. We imagine if this was to go on to become more than a demonstrator some sort of machine-vision auto-aligning would be desirable, but [Ancient] is able to conquer three-dimensional keystoning manually for this demonstration. Considering he is, in effect, projection-mapping onto the tiny bubbles in the crystal, that’s impressive work. Check out the video embedded below.

With only around 38,000 points, the resolution isn’t exactly high-def, but it is enough for a very impressive proof-of-concept. It’s also not nearly as creepy as the Selectric-inspired mouth-ball that was the last [Ancient] project we featured. It’s also a lot less likely to take your fingers off than the POV-based volumetric display [Ancient] was playing DOOM on a while back.

For the record, this one runs the same DOOM port, too– it’s using the same basic code as [Ancient]’s other displays, which you can find on GitHub under an MIT license.

Thanks to [Hari Wiguna] for the tip.

youtube.com/embed/wrfBjRp61iY?…

hackaday.com/2025/12/10/volume…

Production KiCad Template Covers All Your Bases

Ever think about all the moving parts involving a big KiCad project going into production? You need to provide manufacturer documentation, assembly instructions and renders for them to reference, every output file they could want, and all of it has to always stay up to date. [Vincent Nguyen] has a software pipeline to create all the files and documentation you could ever want upon release – with an extensive installation and usage guide, helping you turn your KiCad projects truly production-grade.

This KiBot-based project template has no shortage of features. It generates assembly documents with custom processing for a number of production scenarios like DNPs, stackup and drill tables, fab notes, it adds features like table of contents and 3D renders into KiCad-produced documents as compared to KiCad’s spartan defaults, and it autogenerates all the outputs you could want – from Gerbers, .step and BOM files, to ERC/DRC reports and visual diffs.

This pipeline is Github-tailored, but it can also be run locally, and it works wonderfully for those moments when you need to release a PCB into the wild, while making sure that the least amount of things possible can go wrong during production. With all the features, it might take a bit to get used to. Don’t need fully-featured, just some GitHub page images? Use this simple plugin to auto-add render images in your KiCad repositories, then.

youtube.com/embed/63R6Wnx44uY?…

We thank [Jaac] for sharing this with us!

hackaday.com/2025/12/10/produc…

FLOSS Weekly Episode 858: YottaDB: Sometimes the Solution is Bigger Servers

This week Jonathan chats with K. S. Bhaskar about YottaDB. This very high performance database has some unique tricks! How does YottaDB run across multiple processes without a daemon? Why is it licensed AGPL, and how does that work with commercial deployments? Watch to find out!

• yottadb.com/feed/
• github.com/YottaDB/YDB

youtube.com/embed/aUhdny-zHdw?…

Did you know you can watch the live recording of the show right on our YouTube Channel? Have someone you’d like us to interview? Let us know, or have the guest contact us! Take a look at the schedule here.

play.libsyn.com/embed/episode/…

Direct Download in DRM-free MP3.

If you’d rather read along, here’s the transcript for this week’s episode.

Places to follow the FLOSS Weekly Podcast:

• Spotify
• RSS

Theme music: “Newer Wave” Kevin MacLeod (incompetech.com)

Licensed under Creative Commons: By Attribution 4.0 License

hackaday.com/2025/12/10/floss-…