Surplus Industrial Robot Becomes two-ton 3D Printer

As the saying goes — when life gives you lemons, you make lemonade. When life gives you a two-ton surplus industrial robot arm, if you’re [Brian Brocken], you apparently make a massive 3D printer.

The arm in question is an ABB IRB6400, a serious machine that can sling 100 to 200 kilograms depending on configuration. Compared to that, the beefiest 3D printhead is effectively weightless, and the Creality Sprite unit he’s using isn’t all that beefy. Getting the new hardware attached uses (ironically) a 3D printed mount, which is an easy enough hack. The hard work, as you might imagine, is in software.

As it turns out, there’s no profile in Klipper for this bad boy. It’s 26-year-old controller doesn’t even speak G-code, requiring [Brian] to feed the arm controller the “ABB RAPID” dialect it expects line-by-line, while simultaneously feeding G-code to the RAMPS board controlling the extruder. If you happen to have the same arm, he’s selling the software that does this. Getting that synchronized reliably was the biggest challenge [Brian] faced. Unfortunately that means things are slowed down compared to what the arm would otherwise be able to do, with a lot of stop-and-start on complex models, which compromises print quality. Check the build page above for more pictures, or the video embedded below.

[Brian] hopes to fix that by making better use of the ABB arm’s controller, since it does have enough memory for a small buffer, if not a full print. Still, even if it’s rough right now, it does print, which is not something the engineers at ABB probably ever planned for back before Y2K. [Brian]’s last use of the arm, carving a DeLorean out of styrofoam, might be closer to the original design brief.

Usually we see people using 3D printers to build robot arms, so this is a nice inversion, though not the first.

youtube.com/embed/peY_KK_nGc8?…

hackaday.com/2025/12/19/surplu…

This Week in Security: PostHog, Project Zero Refresh, and Thanks For All the Fish

There’s something immensely satisfying about taking a series of low impact CVEs, and stringing them together into a full exploit. That’s the story we have from [Mehmet Ince] of Prodraft, who found a handful of issues in the default PostHog install instructions, and managed to turn it into a full RCE, though only accessible as a user with some configuration permissions.

As one might expect, it all starts with a Server Side Request Forgery (SSRF). That’s a flaw where sending traffic to a server can manipulate something on the server side to send a request somewhere else. The trick here is that a webhook worker can be primed to point at localhost by sending a request directly to a system API.

One of the systems that powers a PostHog install is the Clickhouse database server. This project had a problem in how it sanitized SQL requests, namely attempting to escape a single quote via a backslash symbol. In many SQL servers, a backslash would properly escape a single quote, but Clickhouse and other Postgresql servers don’t support that, and treat a backslash as a regular character. And with this, a read-only SQL API is vulnerable to SQL injection.

These vulnerabilities together just allow for injecting an SQL string to create and run a shell command from within the database, giving an RCE and remote shell. The vulnerabilities were reported through ZDI, and things were fixed earlier this year.

FreePBX

Speaking of SQL injections, FreePBX recently fixed a handful of SQL injections and an authentication bypass, and researchers at horizon3.ai have the scoop. None of these particular issues are vulnerable without either questionable configuration changes, or access to a valid PHP session ID token. The weakness here seems to be a very similar single quote injection.

Another fun SQL injection in FreePBX requires the authorization type swapped to webserver. But with that setting in place, an injected authentication header with only a valid user name is enough to pull off an SQL injection. The attack chosen for demonstration was to add a new user to the users table. This same authentication header spoof can be used to upload arbitrary files to the system, leading to an easy webshell.

Google Project Zero’s Refresh

We’ve often covered Google’s Project Zero on this column, as their work is usually quite impressive. As their blog now points out, the homepage design left something to be desired. That’s changed now, with a sleek and modern new look! And no, that’s not actually newsworthy here; stop typing those angry comments. The real news is the trio of new posts that came with the refresh.

The most recent is coverage of a VirtualBox VM excape via the NAT network driver. It’s covering a 2017 vulnerability, so not precisely still relevant, but still worth a look. The key here is a bit of code that changes the length of the data structure based on the length of the IP header. Memory manipulation from an untrusted value. The key to exploitation is to manipulate memory to control some of the memory where packets are stored. Then use IP fragmentation packets to interleave that malicious data together and trigger the memory management flaw.

The second post is on Windows exploitation through race conditions and path lookups. This one isn’t an exploit, but an examination of techniques that you could use to slow the Windows kernel down, when doing a path lookup, to exploit a race condition. The winner seems to be a combination of nested directories, with shadow directories and symbolic links. This combination can cost the kernel a whopping three minutes just to parse a path. Probably enough time.

The third entry is on an image-based malware campaign against Samsung Android phones. Malicious DNG files get processed by the Quram image processing library on Samsung devices. DNG images are a non-proprietary replacement for .raw image files, and the DNG format even includes features like embedding lens correction code right in the file format. This correction code is in the form of opcodes, that are handled very much like a script or small program on the host device. The Quram library didn’t handle those programs safely, allowing them to write outside of the allocated memory for the image.

Bits and Bytes

The E-note domain and servers have been seized by law enforcement. It’s believed that $70 million worth of ransomware and cryptocurrency theft has passed through this exchange service, as part of a money laundering operation. A Russian national has been named as the man behind the service, and an indictment has been made, but it seems that no actual arrests have been made.

Dropbear 2025.89 has been released, fixing a vulnerability where a user with SSH access could connect to any unix socket as root. This mishandling of socket permissions can lead to escalation of privilege in a multitude of ways.

React2shell was exploited in the wild almost as soon as it was announced. We covered the vulnerability as it was happening a couple weeks ago, and now it’s clear that ransomware campaigns were launched right away to take advantage of the exploit. It’s also reported that it was used in Advanced Persistent Threat (APT) campaigns right away as well. Real Proof of Concept code is also now available.

Thanks for All the Fish!

And lastly, on a personal note: Thank you to all the readers of this column over the last six years, and to the Hackaday editors for making it happen. I’ve found myself in the position of having four active careers at once, and with the birth of my son in November, I have four children as well. Something has to give, and it’s not going to be any of the kids, so it’s time for me to move on from a couple of those careers. This Week in Security has been a blast, ever since the first installment back in May of 2019. With any luck, another writer will pick up the mantle early next year. (Editor’s note: We’re working on it, but we’ll miss you!)

And if you’re a fan of FLOSS Weekly, the other thing I do around here, don’t worry, as it’s not going anywhere. Hope to see you all there!

hackaday.com/2025/12/19/this-w…

Vulnerabilità critica in FreeBSD: eseguibile codice arbitrario via IPv6

Una nuova vulnerabilità nei componenti FreeBSD responsabili della configurazione IPv6 consente l’esecuzione remota di codice arbitrario su un dispositivo situato sulla stessa rete locale dell’aggressore. Il problema riguarda tutte le versioni supportate del sistema operativo e richiede un’azione immediata per proteggere i dispositivi.

È stata scoperta una vulnerabilità nelle utility “rtsold” e “rtsol“, utilizzate per elaborare i messaggi pubblicitari del router come parte del meccanismo di configurazione automatica degli indirizzi IPv6. È stato scoperto che questi programmi non convalidano il parametro del suffisso di dominio passato in tali messaggi, inviandolo direttamente all’utility “resolvconf“, responsabile dell’aggiornamento della configurazione DNS.

Tuttavia, “resolvconf” è scritto come uno script shell e non filtra i dati in arrivo. L’assenza di escape implica che qualsiasi codice dannoso passato tramite il parametro domain list può essere eseguito sul sistema. Pertanto, un aggressore sulla stessa subnet può eseguire comandi sul dispositivo di destinazione senza richiedere privilegi di amministratore o interazioni precedenti.

Secondo gli sviluppatori di FreeBSD , il problema è limitato alle reti locali, poiché gli annunci del router non vengono instradati e non possono attraversare i confini dei segmenti di rete. Tuttavia, riguarda tutti i sistemi che utilizzano l’autoconfigurazione IPv6, in particolare le interfacce con il flag “ACCEPT_RTADV” abilitato, verificabile tramite “ifconfig“.

Per gli utenti che non utilizzano IPv6, non vi è alcun rischio. In caso contrario, si consiglia di aggiornare urgentemente il sistema all’ultima versione.

Gli aggiornamenti sono ora disponibili per tutte le branch di FreeBSD supportate, incluse le versioni 15.0, 14.3 e 13.5. L’aggiornamento è possibile sia tramite il meccanismo di patching binario integrato sia applicando modifiche al codice sorgente.

L’identificatore della vulnerabilità registrata è CVE-2025-14558. Le correzioni sono state pubblicate il 16 dicembre 2025 e sono incluse nei rami stabile e di rilascio di FreeBSD.

L'articolo Vulnerabilità critica in FreeBSD: eseguibile codice arbitrario via IPv6 proviene da Red Hot Cyber.

@Friendica Support hello, i would like some help please to understand how to solve my confusion about the "right" way to follow #hashtags, using #Channels ... or otherwise some better way.

i follow a large number of hashtags [as a glance at my profile would attest]. afaict / afaik, fediverse posts bearing these tags appear [or are supposed to] in my "Network" timeline [with "Everybody" Circle & "Latest posts" Channel selected].

of my many tags, possibly my most "important" ones are #AusPol, #FOSS, & #Linux. in order to be able to efficiently locate all posts with these tags each day, rather than have to meticulously scroll down the full "Network" timeline [which is dissipated via also having all the other tags, & all my Followed accounts' posts], in Settings i created three dedicated Channels [one for each of those tags, ofc]. then i added each of those custom Channels to my Timelines, in Display Settings.

however, the result is just hopeless; really disappointing & frustrating. over recent years i have had several Friendica accounts, ie, at several instances, & doing the above has never worked properly in any of them, not only my current instance.

using the AusPol Channel for example, as it is the worst by far, every time i check it, its most recent post is several hours old, & often as bad as 12 - 18 hours old, with numerous other posts entirely missing.

i say "missing" because otoh, reviewing my Saved Search for #AusPol shows all these other posts, which therefore also appear, buried, in my full "Network" timeline.

over the months & years in exasperation, i have revisited the dedicated Channels in Settings, & for the Circle/Channel field have tried each of Latest posts, Latest Creation, Global community, & Latest activity, but none of them has solved the problem [indeed, a few make it even worse!].

please, what am i doing wrong? what aspect of Friendica's Settings have i been consistently misunderstanding / misusing, that causes this disappointment?

Свердловчанину, который пожаловался Путину во время прямой линии на дефицит лекарств, перезвонили из местного Минздрава и потребовали «быть лояльнее», пишут СМИ.

Глава Минздрава области уже выступила с заявлением, что препараты у пациента есть. Их должно хватить «ещё на несколько дней».

Путин призвал россиян не перерабатывать и вовремя уходить с работы.

Он добавил, что нужно пораньше ложиться спать, чтобы оставаться в форме и быть продуктивными.

Путина попросили не отключать интернет диабетикам. Тот в ответ велел им потерпеть ради «безопасности».

Журналистка призвала его внести приложения для мониторинга глюкозы в «белый список» Минцифры — чтобы те работали при отключении мобильной сети. Путин ничем не может помочь больным детям и предложил переходить на отечественное ПО, потому что интернет будут и дальше отключать из-за украинских дронов.

Рост утильсбора нужен «для решения благородной цели» — технологического развития, сообщил Путин. Он надеется, что сбор не будет вечным.

По его словам, повышение сбора затрагивает граждан с хорошими доходами из крупных городов.

Граждане из регионов, как известно, не покупают автомобили

Нужно, чтобы рождение детей стало модным — Путин

Традиция выдавать детей замуж в раннем возрасте, как на Кавказе — «это реально правильно и надо бы брать с них пример», заявил Путин.

Россиян хотят обязать платить за регистрацию смартфонов в единой государственной базе IMEI, которую планируют запустить с 2028 года.

Механизм сейчас прорабатывает Минцифры, а сумма сбора может рассчитываться как процент от стоимости устройства. Если телефон не окажется в базе, его просто отключат от мобильной сети.

ALT TEXT

❄️ В пустыне в Саудовской Аравии выпал снег

Снег выпал в нескольких регионах страны, горных районах и пустынях. В столице страны Эр-Рияде школьников перевели на дистанционное обучение. В некоторых регионах температура опустилась ниже нуля, на дорогах образовался гололёд.

Количество снега в ближайшие дни в северных районах Саудовской Аравии может увеличиться, говорят синоптики.

🎉 В Туле возбудили уголовное дело против пенсионерки, продавшей квартиру по «схеме Долиной»: женщину обвинили в мошенничестве

Даниил купил однушку у 69-летней старушки, заплатив за жилье 1,6 миллиона рублей. Спустя несколько дней его риелтор стала получать от родственников продавца угрозы о расправе. Как те объяснили позже, они перепутали покупателя с мошенниками. Тогда же бабушка подала заявление в полицию, сообщив, что отдала неизвестным 600 000 рублей со своих счетов.

ALT TEXT

🚛 «Автоваз» начал вывозить из России свои нераспроданные автомобили Lada на Ближний Восток

В декабре у компании появились сразу два новых дилера в экзотичных странах: один уже открылся в Сане — столице Йемена, контролируемой хуситами, второй готовится к запуску в Тегеране.

🫣 Бабушка застряла на козырьке балкона четвёртого этажа в Нижегородской области

Пенсионерку заперли дома без присмотра. У неё проблемы с психическим здоровьем, поэтому женщина оделась и вылезла через перила на улицу, чтобы прогуляться. Но всё уже хорошо — спасатели аккуратно сняли её и вернули в квартиру.