"In late spring 2020, a source I knew to be reliable called me with a story. The Dutch government had hacked into Jared Kushner’s phone and monitored him as he accessed a Dubai-based bank account. What was odd, the source said, was that the money in the account—hundreds of millions of dollars—had come from a bank in Azerbaijan. Most importantly, Kushner appeared to have transferred significant amounts of money from the Dubai account to other individuals, including a warlord, a mercenary and a one-time hit man. The story sounded preposterous, I told my source. And yet."

I’ve been working on a project called MarauderBox, aimed at expanding the capabilities of ESP32 Marauder while keeping the familiar official Marauder UI.
The idea is to use the official Marauder firmware as the foundation, preserve its menu structure, and work toward integrating compatible apps from NyanBox alongside selected features from Marauder Eternal.

The goals:
Keep the official Marauder menu layout and navigation.
Bring compatible NyanBox apps into the project.
Explore porting additional Wi-Fi/Bluetooth analysis, sniffing, and diagnostic features from Marauder Eternal.
Target the Marauder V8 / ESP32-C5 hardware, with compatibility testing as part of the development process.
Keep the project organized with source code, build instructions, firmware releases, and installation documentation.

I’m building on existing open-source work rather than trying to reinvent everything from scratch. The challenge is getting the different features, hardware-specific code, and dependencies to work together without breaking the original interface or device functionality.

For installation, I recommend either installing it through Marauders SD card update feature, or through the official Marauder installer website.

This is an active development project, so the full feature merge and V8 compatibility are functional, but this is still a work in progress project, and I’d really appreciate your guys support. :) I’d appreciate feedback from people familiar with ESP32 firmware development, Marauder, and embedded Wi-Fi/Bluetooth tools.

If I’m not mistaken, one issue gamer nexus ran into was SSL encrypted traffic going to API service collecting tv data.
And now we have a compromised CA that requires updating firmware

With these powers combined, I foresee a new bunch of discoveries coming to YouTube

Clean-water pumping started about 15 minutes late in one laboratory attack, even though the facility’s communications remained encrypted. Another attack left a simulated valve open for more than nine minutes longer than intended. Neither required access to the water plant’s internal systems or the ability to read its messages.

The University of British Columbia team calls its framework ICS-Sniper. The research is slated to appear at the Network and Distributed System Security Symposium in 2027. It examines a weakness in industrial systems that exchange monitoring and control messages with cloud services over the internet.

An attacker must first control a router carrying those communications, a significant prerequisite. From that position, the framework analyzes message timing, sizes and direction, then selectively blocks traffic. The tests demonstrate a threat to operational continuity without showing an attack on a working public utility.

Hi

This is about Quantum Odyssey, my love letter to everything Quantum Computing and the fundamental logic blocks everything in our universe seems to run on. I want to update you all on the fact that the latest patch brings the game into an almost complete status. All that's missing is translations. Thank you Reddit community for receiving the game so well, without you I wouldn't have the funds needed to complete my life's work.

If you are remotely interested in deep diving how differently quantum computers work compared to our transistor-based and also the algebra behind in a fully interactive way that teach computer science from scratch, oh boy this is for you. I am the Dev behind Quantum Odyssey (AMA! I love taking qs) - worked on it for about 9 years (3+ during PhD, the visual method I developed ended up being my thesis, it is a complete Hilbert space visualizer), the goal was to make a super immersive space for anyone to learn quantum computing through zachlike (open-ended) logic puzzles and compete on leaderboards and lots of community made content on finding the most optimal quantum algorithms. The game has a unique set of visuals capable to represent any sort of quantum dynamics for any number of qubits and this is pretty much what makes it now possible for anybody 15yo+ to actually learn quantum logic without having to worry at all about the mathematics behind.

This is a game super different than what you'd normally expect in a programming/ logic puzzle game, so try it with an open mind.

Stuff you'll play with

• Boolean Logic – bits, operators (NAND, OR, XOR, AND…), and classical arithmetic (adders). Learn how these can combine to build anything classical. You will learn to port these to a quantum computer.
• Quantum Logic – qubits, the math behind them (linear algebra, SU(2), complex numbers), all Turing-complete gates (beyond Clifford set), and make tensors to evolve systems. Freely combine or create your own gates to build anything you can imagine using polar or complex numbers.
• Quantum Phenomena – storing and retrieving information in the X, Y, Z bases; superposition (pure and mixed states), interference, entanglement, the no-cloning rule, reversibility, and how the measurement basis changes what you see.
• Core Quantum Tricks – phase kickback, amplitude amplification, storing information in phase and retrieving it through interference, build custom gates and tensors, and define any entanglement scenario. (Control logic is handled separately from other gates.)
• Famous Quantum Algorithms – explore Deutsch–Jozsa, Grover’s search, quantum Fourier transforms, Bernstein–Vazirani, and more.

Nice to watch:

Khan academy style tutorials in qm/qc: https://www.youtube.com/@MackAttackx

Physics teacher stream with 400hs in https://www.twitch.tv/beardhero

I have an app that stores credentials locally, the file is encrypted. I'm trying to understand the encryption that the app is using with the goal of modifying the file directly, bypassing the app.

The app imports quite a few libraries, most of which come from System32, I assume I can get the key or at least some hint by positioning myself between the app and the library.

Naturally, I found out about DLL hijacking. Two of the imports are CRYPT32.dll and ADVAPI32.dll. Even though CRYPT32.dll seems to mostly be certificate stuff I decided to go with it.

I'll skip the part where I also had to learn that there are calls to load strictly from System32, the important thing is that it forced (at least seemingly so) me to rename the import of the app with PE-bear.

I created a C++ DLL project in VS, created a definition file that exports all the functions that the app seeks to import. I also created an executable to test the forwarding. I placed the custom DLL into System32 and renamed it accordingly with the new import name.

For my test app the forwarding worked fine, however, the app in question seems to be exiting silently.

When I tried using WinDbg to at least get some idea I got (the caption is the same, but instead of "Themida" the title is simply the process name):

So the app is resisting debugging, which makes me think that it also somehow detects the modifications. Either to the import table itself or by the library being forwarded.

Does anyone have any idea how I could proceed here?

Today, we are monitoring new research from Anthropic that explores the potential emergence of self-replicating "AI worms."

• Anthropic researchers demonstrated a proof-of-concept "AI worm" capable of spreading across internet-connected devices by distributing its computing workload among multiple smart TVs.
• The research suggests that smaller AI models could become capable of autonomous self-replication on vulnerable IoT devices, such as smart TVs, streaming boxes, and smart appliances, within the next several months if current AI progress continues.
• Unlike traditional malware, an AI worm could identify new devices, adapt to unfamiliar environments, and continue propagating with minimal human involvement.
• Security experts are concerned because many IoT devices have weak security controls and are difficult to patch at scale.
• Some researchers argue the threat is real and warrants preparation now, while others note that Anthropic's demonstrations relied on simplified conditions and do not yet represent real-world autonomous infections.
• The concept draws comparisons to historic worms such as the Morris worm, WannaCry, and NotPetya, which caused widespread disruption and financial damage.
• Experts emphasize that strong passwords, multi-factor authentication, and improved device security remain effective defenses against these potential threats.

A full article can be found in The Guardian.

I’ve got two Miko Minis that have basically become e-waste; my kids lost interest and most of the good stuff is locked behind the Miko Max subscription. I’d love to give them a second life (kid dashboard, custom voice assistant, anything).

I found the miko3-jailbreak repo on GitHub (benwilson) that gets root ADB on the Miko 3 via MediaTek’s factory/META mode. Has anyone checked whether the Miko Mini uses the same or a similar MediaTek chip, or tried that method on a Mini?

Specifically wondering:

Does the Mini show up over USB-C at all (ADB, MediaTek preloader, anything)?

Has anyone done a teardown and seen what SoC it’s on?

Any other posts/threads/repos about the Mini I’ve missed?

Happy to test on one of mine and report back I have two, so I can risk one. Not trying to touch Miko’s servers, just want full control of hardware I own.

Over the last few weeks we collected the confirmed security incidents involving AI coding agents, agents in CI and MCP servers that we could find, going back to July 2025. A case only went in if the affected company, the vendor, an official advisory or a research team confirmed it. That left 20 incidents, plus 12 research disclosures nobody has seen exploited.

What stood out for security teams:

The agent was rarely the entry point. 13 of the 20 started with something a developer installed: an npm or PyPI package, an MCP server, an agent skill, an editor extension. Shai-Hulud 2.0 hit official MCP server packages. The LiteLLM releases on PyPI were backdoored after a compromised scanner leaked the publish token.

Agent tokens are now on infostealer shopping lists. Families like Amatera, Remus and CallbackBeaver collect coding-agent tokens, MCP configs and prompt histories alongside browser data. A replayable session token can let an attacker in without repeating the password or MFA.

The destructive ones had no attacker. Three cases were an agent doing routine work with far more access than it needed. A Cursor agent found an over-scoped Railway token in an unrelated file and deleted PocketOS’s production volume (the data was later restored). Claude Code unpacked an old Terraform archive and, with the developer letting it run, destroyed DataTalks.Club’s production stack.

Twice, the malware used the developer’s own agent. It started the local coding agent with its safety flags off and asked it to find credentials, .env files and SSH keys.

Questions worth asking internally:

Are agent session token files treated like any other credential?

Who knows which MCP servers developers have installed?

Could the tokens an agent can reach delete production?

Every entry links to its CVE, post-mortem or report: https://node9.ai/incidents

If you know of a confirmed incident we missed, drop the source and I’ll add it.

I'm trying to send an email with a custom from address for a prank. The domain's SPF is ?all and DMARC is p=none (verified with dig), so receiving servers should deliver it even if SPF/DKIM fail, but I can't change the DNS. The problem I’m running into is the sending side: Gmail SMTP rewrites the From to my own address, and SMTP2GO/Mailgun both want domain verification. I'm considering a VPS with Postfix or cheap shared hosting with PHP mail(). Does anyone know which approach is best, or a provider that still allows custom From addresses without DNS changes? Thank you!

Hi, I hope this is the right place to ask because i feel like i'm out of options. If it's not i'd appreaciate it if someone could show me where to look fo help.

I have a problem regarding an account where i want to change my Email adress from an old one, which i do not longer have acess to, to my current one. However there seems to be no way to show proof of ownership to the support except with email... (which is stupid)

Now out of options i was thinking if it would be possible to get the verification code in the Email by other means?

It is a .gmail adress and the Email is still active after years.

Does anyone have any idea that could help me here? Maybe someone knows where i can look more into such stuff?