A PSOne In the Palm of Your Hand

Sony’s original Playstation wasn’t huge, and they did shrink it for re-release later as the PSOne, but even that wasn’t small enough for [Secret Hobbyist]. You may have seen the teaser video a while back where his palm-size Playstation went viral, but now he’s begun a series of videos on how he redesigned the vintage console.

Luckily for [Secret Hobbyist], the late-revision PSOne he started with is only a two-layer PCB, which made reverse engineering the traces a lot easier. Between probing everything under the microscope and cleaning the board off to follow all the traces in copper, [Hobbyist] was able to reproduce the circuit in KiCAD. (Reverse engineering starts at about 1:18 in the vid.)

With a schematic in hand, drafting a smaller PCB than Sony built is made easier by the availability of multi-layer PCBs. In this case [Hobbyist] was able to get away with a four-layer board. He was also able to ditch one of the ICs from the donor mainboard, which he called a “sub-CPU” as its functionality was recreated on the “PSIO” board that’s replacing the original optical drive. The PSIO is a commercial product that has been around for years now, allowing Playstations to run from SD cards– but it’s not meant for the PSOne so just getting it working here is something of a hack. He’s also added on a new DAC for VGA output, but otherwise the silicon is all original SONY.

This is the first of a series about this build, so if you’re into retro consoles you might want to keep an eye on [Secret Hobbyist] on YouTube to learn all the details as they are released.

youtube.com/embed/q0sUCJE2s6A?…

hackaday.com/2026/01/16/a-pson…

Origin-mo: il trucco pigro che ha aperto 40.000 siti WordPress agli hacker

@Informatica (Italy e non Italy 😁)
I ricercatori hanno scoperto una vulnerabilità critica nel plugin Modular DS per WordPress che ha permesso a hacker di compromettere oltre 40.000 siti con un metodo sorprendentemente semplice. La vulnerabilità CVE-2026-23550 Il plugin Modular DS, installato su

(in)sicurezza digitale

2026-01-16 10:07:49

Origin-mo: il trucco pigro che ha aperto 40.000 siti WordPress agli hacker

Si parla di:
Toggle

• La vulnerabilità CVE-2026-23550
• Il trucco con l’header Origin
• Impatto e risposta

I ricercatori hanno scoperto una vulnerabilità critica nel plugin Modular DS per WordPress che ha permesso a hacker di compromettere oltre 40.000 siti con un metodo sorprendentemente semplice.

La vulnerabilità CVE-2026-23550

Il plugin Modular DS, installato su decine di migliaia di siti WordPress, presentava una falla di privilege escalation classificata con un punteggio CVSS di 10.0, il massimo livello di severità. Questa debolezza, identificata come CVE-2026-23550 e catalogata nel database di Positive Technologies, riguardava le versioni 2.5.1 e 2.5.2 e derivava da una mancanza di autenticazione adeguata nell’endpoint API /apimodular-connector/login. Gli attaccanti potevano inviare una richiesta GET a questo endpoint senza credenziali, sfruttando parametri come login, server-information e manager per elevare i privilegi e ottenere accesso amministrativo completo, inclusi moduli per il login, la gestione del server e i backup.

Patchstack ha rilevato le prime exploitation il 13 gennaio 2026 alle 02:00 UTC, con richieste anomale provenienti da IP come 45.11.89.19 e 185.196.0.11, che puntavano proprio a quell’endpoint vulnerabile. La tecnica non richiedeva payload complessi né exploit zero-day elaborati: bastava una semplice chiamata HTTP per bypassare i controlli e iniettare un account amministratore, permettendo l’esecuzione di comandi arbitrari sul server sottostante.

Il trucco con l’header Origin

Gli hacker hanno affinato l’attacco aggiungendo un header HTTP "Origin: mo.", una stringa apparentemente innocua che il plugin Modular DS interpretava come indicatore di una richiesta legittima proveniente dal dominio “originmo”. Questo header, combinato con la mancanza di validazione sull’API apimodular-connector, convinceva il sistema a trattare la chiamata come interna, eludendo ulteriori verifiche di sicurezza. In pratica, l’attaccante simulava una richiesta dal pannello di controllo del plugin stesso, ottenendo accesso istantaneo a funzionalità sensibili come la gestione dei backup e le informazioni sul server.

Tale approccio, definito il “metodo più pigro” dagli analisti, ha colpito siti vulnerabili in modo massivo perché non necessitava di scansioni personalizzate o tool avanzati: una semplice modifica all’header in una richiesta GET standard era sufficiente per compromettere l’intero ambiente WordPress. Positive Technologies ha dettagliato come questo meccanismo permettesse non solo l’elevazione di privilegi ma anche l’inserimento di backdoor persistenti, con potenziali ramificazioni su database e file system.

Impatto e risposta

L’exploit ha interessato circa 40.000 installazioni attive del plugin, esponendo siti a rischi di defacement, furto dati e ulteriore propagazione di malware tramite i manager di backup integrati. Patchstack ha rilasciato una patch urgente nella versione 2.5.2, che introduce validazioni rigorose sugli header Origin e sull’autenticazione API, bloccando richieste non autorizzate attraverso controlli nonce e verifica IP whitelisting.

Gli amministratori di WordPress devono verificare immediatamente la presenza del plugin Modular DS, aggiornarlo alla versione corretta e monitorare i log di accesso per endpoint sospetti come /apimodular-connector/.

Questa discussione è aperta anche su Feddit in @informatica

Origin-mo: il trucco pigro che ha aperto 40.000 siti WordPress agli hacker - (in)sicurezza digitale

^{Dario Fadda (inSicurezzaDigitale.com)}

Origin-mo: il trucco pigro che ha aperto 40.000 siti WordPress agli hacker
#CyberSecurity
insicurezzadigitale.com/origin…

(in)sicurezza digitale

2026-01-16 10:07:49

Origin-mo: il trucco pigro che ha aperto 40.000 siti WordPress agli hacker

Si parla di:
Toggle

• La vulnerabilità CVE-2026-23550
• Il trucco con l’header Origin
• Impatto e risposta

I ricercatori hanno scoperto una vulnerabilità critica nel plugin Modular DS per WordPress che ha permesso a hacker di compromettere oltre 40.000 siti con un metodo sorprendentemente semplice.

La vulnerabilità CVE-2026-23550

Il plugin Modular DS, installato su decine di migliaia di siti WordPress, presentava una falla di privilege escalation classificata con un punteggio CVSS di 10.0, il massimo livello di severità. Questa debolezza, identificata come CVE-2026-23550 e catalogata nel database di Positive Technologies, riguardava le versioni 2.5.1 e 2.5.2 e derivava da una mancanza di autenticazione adeguata nell’endpoint API /apimodular-connector/login. Gli attaccanti potevano inviare una richiesta GET a questo endpoint senza credenziali, sfruttando parametri come login, server-information e manager per elevare i privilegi e ottenere accesso amministrativo completo, inclusi moduli per il login, la gestione del server e i backup.

Patchstack ha rilevato le prime exploitation il 13 gennaio 2026 alle 02:00 UTC, con richieste anomale provenienti da IP come 45.11.89.19 e 185.196.0.11, che puntavano proprio a quell’endpoint vulnerabile. La tecnica non richiedeva payload complessi né exploit zero-day elaborati: bastava una semplice chiamata HTTP per bypassare i controlli e iniettare un account amministratore, permettendo l’esecuzione di comandi arbitrari sul server sottostante.

Il trucco con l’header Origin

Gli hacker hanno affinato l’attacco aggiungendo un header HTTP "Origin: mo.", una stringa apparentemente innocua che il plugin Modular DS interpretava come indicatore di una richiesta legittima proveniente dal dominio “originmo”. Questo header, combinato con la mancanza di validazione sull’API apimodular-connector, convinceva il sistema a trattare la chiamata come interna, eludendo ulteriori verifiche di sicurezza. In pratica, l’attaccante simulava una richiesta dal pannello di controllo del plugin stesso, ottenendo accesso istantaneo a funzionalità sensibili come la gestione dei backup e le informazioni sul server.

Tale approccio, definito il “metodo più pigro” dagli analisti, ha colpito siti vulnerabili in modo massivo perché non necessitava di scansioni personalizzate o tool avanzati: una semplice modifica all’header in una richiesta GET standard era sufficiente per compromettere l’intero ambiente WordPress. Positive Technologies ha dettagliato come questo meccanismo permettesse non solo l’elevazione di privilegi ma anche l’inserimento di backdoor persistenti, con potenziali ramificazioni su database e file system.

Impatto e risposta

L’exploit ha interessato circa 40.000 installazioni attive del plugin, esponendo siti a rischi di defacement, furto dati e ulteriore propagazione di malware tramite i manager di backup integrati. Patchstack ha rilasciato una patch urgente nella versione 2.5.2, che introduce validazioni rigorose sugli header Origin e sull’autenticazione API, bloccando richieste non autorizzate attraverso controlli nonce e verifica IP whitelisting.

Gli amministratori di WordPress devono verificare immediatamente la presenza del plugin Modular DS, aggiornarlo alla versione corretta e monitorare i log di accesso per endpoint sospetti come /apimodular-connector/.

Questa discussione è aperta anche su Feddit in @informatica

Origin-mo: il trucco pigro che ha aperto 40.000 siti WordPress agli hacker - (in)sicurezza digitale

^{Dario Fadda (inSicurezzaDigitale.com)}

CORSO NIS2 SENZA SEGRETI: LA FORMAZIONE PER AZIENDE E PROFESSIONISTI FIRMATA RED HOT CYBER!

📌 𝗔𝗰𝗰𝗲𝘀𝘀𝗼 𝗳𝗹𝗲𝘀𝘀𝗶𝗯𝗶𝗹𝗲: corso in e-learning con contenuti sempre disponibili
📌 𝗟𝗶𝘃𝗲𝗹𝗹𝗼: Base
📌 𝗣𝗿𝗲𝗿𝗲𝗾𝘂𝗶𝘀𝗶𝘁𝗶 𝗽𝗲𝗿 𝗶𝗹 𝗰𝗼𝗿𝘀𝗼: conoscenza base della valutazione del rischio
📌 𝗦𝘂𝗽𝗽𝗼𝗿𝘁𝗼 𝗮𝗹 𝗰𝗼𝗿𝘀𝗼: docente disponibile via mail

👉Iscriviti all'Academy per vedere l'anteprima gratuita del corso academy.redhotcyber.com/course…
👉Scrivici ad academy@redhotcyber.com o Whatsapp al 3791638765

#redhotcyber #hacking #cti #ai #online #it #cybercrime #cybersecurity #threat #OnlineCourses #Elearning #DigitalLearning #RemoteCourses #VirtualClasses #CourseOfTheDay #LearnOnline #OnlineTraining #Webinars #academy #corso #formazioneonline #direttivanis #nis2

How Advanced Autopilots Make Airplanes Safer When Humans go AWOL

It’s a cliché in movies that whenever an airplane’s pilots are incapacitated, some distraught crew member queries the self-loading freight if any of them know how to fly a plane. For small airplanes we picture a hapless passenger taking over the controls so that a heroic traffic controller can talk them through the landing procedure and save the day.

Back in reality, there have been zero cases of large airliners being controlled by passengers in this fashion, while it has happened a few times in small craft, but with variable results. And in each of these cases, another person in the two- to six-seater aircraft was present to take over from the pilot, which may not always be the case.

To provide a more reliable backup, a range of automated systems have been proposed and implemented. Recently, the Garmin Emergency Autoland system got its first real use: the Beechcraft B200 Super King Air landed safely with two conscious pilots on board, but they let the Autoland do it’s thing due to the “complexity” of the situation.

Human In The Loop

Throughout the history of aviation, a human pilot has been a crucial component for the longest time for fairly obvious reasons, such as not flying past the destination airport or casually into terrain or rough weather. This changed a few decades ago with the advent of more advanced sensors, fast computing systems and landing assistance systems such as the ILS radio navigation system. It’s now become easier than ever to automate things like take-off and landing, which are generally considered to be the hardest part of any flight.

Meanwhile, the use of an autopilot of some description has become indispensable since the first long-distance flights became a thing by around the 1930s. This was followed by a surge in long-distance aviation and precise bombing runs during World War II, which in turn resulted in a massive boost in R&D on airplane automation.
A USAF C-54 Skymaster. (Credit: US Air Force)
While the the early gyroscopic autopilots provided basic controls that kept the airplane level and roughly on course, the push remained to increase the level of automation. This resulted in the first fully automatic take-off, flight and landing being performed on September 22, 1947 involving a USAF C-54 Skymaster. As the military version of the venerable DC-4 commercial airplane its main adaptations included extended fuel capacity, which allowed it to safely perform this autonomous flight from Newfoundland to the UK.

In the absence of GNSS satellites, two ships were located along the flight path to relay bearings to the airplane’s board computer via radio communication. As the C-54 approached the airfield at Brise Norton, a radio beacon provided the glide slope and other information necessary for a safe landing. The fact that this feat was performed just over twenty-eight years after the non-stop Atlantic crossing of Alcock and Brown in their Vickers Vimy airplane shows just how fast technology progressed at the time.

Nearly eighty years later, it bears asking the question why we still need human pilots, especially in this age of GNSS navigation, machine vision, and ILS beacons at any decently sized airfield. The other question that comes to mind is why we accept that airplanes effectively fall out of the sky the moment that they run out of functioning human pilots to push buttons, twist dials, and fiddle with sticks.

State of the Art

In the world of aviation, increased automation has become the norm, with Airbus in particular taking the lead. This means that Airbus has also taken the lead in spectacular automation-related mishaps: Flight 296Q in 1988 and Air France Flight 447 in 2009. While some have blamed the 296Q accident on the automation interfering with the pilot’s attempt to increase thrust for a go-around, the official explanation is that the pilots simply failed to notice that they were flying too low and thus tried to blame the automation.
The Helios Airways 737-300, three days before it would become a ghost flight. (Credit: Mila Daniel)
For the AF447 crash the cause was less ambiguous, even if took a few years to recover the flight recorders from the seafloor. Based on the available evidence it was clear by then that the automation had functioned as designed, with the autopilot disengaging at some point due to the unheated pitot tubes freezing up, resulting in inconsistent airspeed readings. Suddenly handed the reins, the pilots took over and reacted incorrectly to the airspeed information, stalled the plane, and crashed into the ocean.

One could perhaps say that AF447 shows that there ought to be either more automation, or better pilot training so that the human element can fly an airplane unassisted by an autopilot. When we then consider the tragic case of Helios Airways Flight 522, the ‘ghost flight’ that flew on autopilot with no conscious souls on board due to hypoxia, we can imagine a dead-man switch that auto-lands the airplane instead of leaving onlookers powerless to do anything but watch the airplane run out of fuel and crash.

Be Reasonable

Although there are still a significant number of people who would not dare to step a foot on an airliner that doesn’t have at least two full-blooded, breathing human pilots on board, there is definitely a solid case to be made for emergency landing systems to become a feature on airplanes, starting small. Much like the Cirrus Airframe Parachute System (CAPS) – a whole-airplane parachute system that has saved many lives as well as airframes – the Garmin Autoland feature targets smaller airplanes.
The Garmin Autoland system communicates with ATC and nearby traffic and lands unassisted. (Credit: Garmin)
After a recent successful test with a HondaJet, this recent unscheduled event with the Beechcraft B200 Super King Air twin-prop airplane turned out to be effectively another test. As the two pilots in this airplane were flying between airports for a repositioning flight, the cabin suddenly lost pressurization. Although both pilots were able to don their oxygen masks, the Autoland system engaged due to the dangerous cabin conditions. They then did not disengage the system as they didn’t know the full extent of the situation.

This effectively kept both pilots ready to take full control of the airplane should the need have arisen to interfere, but with the automated system making a textbook descent, approach and landing, it’s clear that even if their airplane had turned into another ghost flight, they would have woken up groggy but whole on the airstrip, surrounded by emergency personnel.

Considering how many small airplanes fly each year in the US alone, systems like CAPS and Autoland stand to save many lives both in the air and on the ground the coming years. Combine this with increased ATC automation at towers and elsewhere such as the FAA’s STARS and Saab’s I-ATS, and a picture begins to form of increased automation that takes the human element out of the loop as much as possible.

Although we’re still a long way off from the world imagined in 1947 where ‘electronic brains’ would unerringly fly all airplanes and more for us, it’s clear that we are moving in that direction, with such technology even within the reach of the average owner of an airplane of some description.

hackaday.com/2026/01/06/how-ad…