Connect with us
DAPA Banner
DAPA Coin
DAPA
COIN PAYMENT ASSET
PRIVACY · BLOCKDAG · HOMOMORPHIC ENCRYPTION · RUST
ElGamal Encrypted MINE DAPA
🚫 GENESIS SOLD OUT
DAPAPAY COMING

Tech

Millions of AI agents imperiled by critical vulnerability in open source package

Published

on

Millions of AI agents and tools around the world have been imperiled by a critical vulnerability that can allow hackers to breach the servers running them and make off with sensitive data and credentials to third-party accounts, a security researcher is warning.

The vulnerability is present in Starlette, an open source framework that its developer says receives 325 million downloads per week. Thousands of other open source projects are also vulnerable because they require Starlette to work. The framework is an implementation of the ASGI (asynchronous server gateway interface), which allows large numbers of requests to be efficiently processed simultaneously. Starlette is the base of FastAPI and other widely used frameworks for building services in Python apps, as well as many others.

Trivial to exploit, millions of servers exposed

ASGI, and by extension Starlette, have access to servers running the MCP (model context protocol), which allows AI agents from major providers to access external sources, including user data bases, email and calendar accounts, and all manner of other resources. To connect with these external systems, MCP servers store credentials for each one, making them especially valuable storehouses for attackers to breach.

The vulnerability, tracked as CVE-2026-48710 and under the name BadHost, is trivial to exploit and works against most systems that aren’t behind a properly configured firewall. Besides FastAPI, other widely used packages—including vLLM, and LiteLLM—are also affected. BadHost affects Starlette versions prior to 1.0.1, which was released Friday.

Advertisement

“A single character injected into the HTTP Host header bypasses path-based authorization in Starlette, the routing core of FastAPI,” researchers from Secwest wrote. “Through FastAPI, this primitive (now tracked as CVE-2026-48710 and branded BadHost by the discoverers) reaches a large segment of the Python AI tooling ecosystem: vLLM (where the bug was discovered), LiteLLM, Text Generation Inference, most OpenAI-shim proxies, MCP servers, agent harnesses, eval dashboards, and model-management UIs.”

BadHost carries a severity rating of 7 out of 10. Secwest said the classification “materially understates” the threat it poses to people using other apps that depend on Starlette. X41 D-Sec, the security firm that discovered it, described it as having “critical severity.” X41 D-Sec partnered with fellow security firm Nemesis to create an online scanner that can check if a given server is vulnerable.

Source link

Advertisement
Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Tech

My Kid Vibe Coded Their Way To Actually Learning Math

Published

on

from the sometimes-it-can-be-a-useful-tool dept

I’ve spoken to enough teachers and professors to know that LLM tools are absolutely a challenge for many of them in the classroom. Many struggle with making sure they’re actually teaching students how to learn, worrying that the tools are doing the work for them, and skipping over the actual learning. Many are (understandably) resorting to outright bans on students using the tools (which they often know they can’t enforce). Others say that students can use these tools but are fully responsible for any work they turn in, hoping that this will encourage students to be wary of relying too much on the tech. Still others are trying clever workarounds (I appreciate the assignment in which students are asked to have an LLM generate an essay and then the student has to review/grade the essay themselves, which is engaging and also teaches some of the limitations of the tools).

But I’ve also heard from both teachers/professors and students that there are concerns that as students go out into the job market, having some skills with these tools is often a requirement in whatever fields they pursue, leading them to wonder how to best teach the subject in a world where LLM tech isn’t likely to go away, and is seen as part of the toolbox that many employers will expect their employees to use.

I don’t necessarily have good answers to that, but I did recently have an experience in my own home that struck me as potentially relevant as an example of how the tech can actually be useful as a learning tool. I’ve been meaning to write about this for a few months now, but there always seemed to be something more urgent to cover. With the school year almost over, I figure I should get this out. For all the talk of how kids are cheating using AI, it might be worth showing at least one example where the tool is genuinely useful — in this case, one of my kids and their friends.

At the beginning of this year I had actually set up my kids with some (very sandboxed) agentic coding tools, after walking them through how I used such tools for a fairly simple project so they could see both how it worked, but also some of the limitations with the tools.

Advertisement

Soon after that, my 12-year-old had asked about my opinion on AI in schools. We talked through how using them to avoid doing the work is genuinely damaging to learning, but there are cases where they can be legitimately helpful. I used the calculator analogy: you first have to learn basic arithmetic by hand, but once you genuinely understand it, a calculator is a perfectly legitimate tool for tackling harder problems — it stops being a crutch and starts being a multiplier.

Apparently that analogy stuck, because what happened later was that analogy made real.

Once I had set my kids up with the tools, they did what most people do with them: created some fun games. A couple of months went by and they hadn’t used them much more. In early March, however, the 12-year-old came home and told me there was a math test that Friday and some classmates were doing an online study group. They worked through some problems together in a live voice chat, but afterward my kid stayed at the computer for a while longer before calling me over to take a look.

“I vibe coded a system to help study.”

Advertisement

I was… surprised. Even more interesting, the app had been packaged up (as an HTML file) and shared with the study group. My kid then explained that because AI can’t be trusted to always get things right, they’d gone through and checked the AI’s math themselves — making some (minor) corrections along the way — and that the process had given them a stronger grasp of the material than just passively studying would have.

I never got a full explanation on the “errors” that they found, though the sense I get is that it wasn’t anything major (outright incorrect math or explanations or anything) but more minor mistakes that they used the tools to fix directly within the app.

After acing the test that week, the next obvious thing to do over the weekend was plan out a study tool for the rest of the semester:

Among other things, this version of the app includes an onscreen pop-up calculator — but only for the topics where a calculator is allowed on exams. I have no idea if this was a more literal implementation of the calculator analogy we’d discussed earlier! It also (for fun) lets you adjust the color scheme.

And it has a changelog as updates were made to the app.

There are plenty of reasonable concerns about kids using AI to cheat, and those concerns aren’t wrong. It’s a real issue. But the framing of “AI as cheating tool” has crowded out a more interesting question: what does it actually look like when a kid uses these tools well?

The calculator analogy holds: the LLM tool generated a first draft — a study tool, a set of practice problems, a scaffolded explanation of the material. My kid then had to engage critically with that output: checking the math, finding the gaps, making corrections. That process of verification was part of the studying. The tool actually created the conditions for more active, more engaged learning than just reviewing problems in a book. And it certainly didn’t substitute in for the learning, like most people worry about with these tools in classroom settings. Quite the opposite.

That’s a meaningfully different frame than “AI does your homework.” The homework here was, in part, checking the tool’s work — and it turns out that’s not a bad way to learn math.

Filed Under: ai, ai in schools, cheating, llms, math

Advertisement

Source link

Continue Reading

Tech

Tiny C64 PSU Rejects Tradition, Embraces USB

Published

on

The Commodore 64 has, by modern standards, the interesting power requirement of needing both 5 VDC and 9 VAC. Traditionally, one would use an iron-core transformer to step-down the wall current — be it 220 V or 115 V, 50 Hz or 60 Hz — to produce the low-voltage AC.

That’s how Commodore did it, and that’s how most of the aftermarket replacements do it, too. That iron-core transformer is bulky, though, and [Side Projects Lab] decided that in this day and age of switching supplies and USB-PD he could surely do better. Which he did, with the diminutive PD-64.

As you can see, it just covers the power port of the C64, and not much else. Partly that small size comes from offloading some of the hard work onto a USB-PD wall wart. The PD-64 requests 12 VDC, which it then steps down to 5 VDC with the usual buck converter, and inverts to 9 VAC in a circuit that is the most interesting part of the project.

There are various ways one could do this, after all, and we’re sure some of you will have different ideas than [Side Projects Lab], but his method seems sound. In order to provide galvanic isolation between the two outputs, the 12 VDC line is first chopped into a 500 kHz signal, and run through a tiny 5:6 ferrite transformer. That output gets rectified to 13.6 VDC, a voltage that is used to run a class-D audio amplifier to produce the 9 V peak-to-peak, zero-DC-offset signal the C64 needs.

Advertisement

[Side Projects Lab] has released both FreeCAD files for the case and STLs as BY-CC-ND 4.0, and a circuit diagram is available for the electrical side. If you don’t want to design your own PCB, [sideprojectslab] will be selling finished versions.

If you’re interested in further dragging your C64 into the modern era, check out the HDMI output that [Side Projects Lab] hacked together for the iconic computer last year.

Advertisement

Source link

Continue Reading

Tech

Corsair’s Pro lineup is the company’s answer to the growing demand for AI workstations and servers

Published

on


  • Corsair unveils new Pro lineup, targeting AI firms
  • A variety of configurations will be on offer, but things will get pricey quickly
  • Entry-level varieties can be scale up to Nvidia GB300-bases servers

Corsair is stepping up its business hardware game, signaling its aim to capture a slice of the lucrative AI server and workstation market by launching its new ‘Pro’ lineup to gain share in a growing ‘localized AI’ industry.

The company aims to lock in business by offering a range of configurations tailored to user needs, along with testing, thermal tuning, and a mix of workstations and servers.

Source link

Continue Reading

Tech

IoT Tribe to scale X_Potential innovation with ESB partnership

Published

on

The partnership will focus on ESB’s three strategic pillars – decarbonising the electricity system, building resilient infrastructure and empowering customers.

UK global accelerator and corporate innovation specialist IoT Tribe has announced a three-year partnership with Ireland’s Electricity Supply Board (ESB) that will focus on X_Potential, ESB’s flagship innovation incubator.

IoT Tribe works to accelerate technology growth and adoption for corporations, government agencies, investors, start-ups, SMEs and other ecosystem players. As part of the collaboration, the organisation will strengthen and scale X_Potential, empowering ESB to identify, develop and deploy future‑facing ventures. 

“We’re incredibly excited to be working with ESB on the next phase of X_Potential,” said Tanya Suarez, the CEO and founder of IoT Tribe. “What makes this collaboration so powerful is the combination of ESB’s ambition and IoT Tribe’s experience in building programmes that turn strong ideas into real ventures, leveraging cutting-edge research and external investors.”

Advertisement

X_Potential operates as an internal innovation platform enabling ESB employees to propose new ideas that advance the organisation’s Net Zero 2040 ambition, and early cohorts have already delivered significant progress. The new team will be located at Trinity College Dublin’s innovation hub, which opened in November last year, and the partnership will focus on ESB’s three strategic pillars – decarbonising the electricity system, building resilient infrastructure and empowering customers.

Commenting on the partnership, Derek Hynes, the head of innovation at ESB, said, “The energy sector is changing rapidly and ESB needs to keep creating the space, support and partnerships that help new ideas develop into real solutions.

“X_Potential plays an important role in that, and this collaboration with IoT Tribe and Trinity College Dublin gives us access to the expertise, structure and external perspective needed to help our people turn strong ideas into ventures with real potential.”

In April, IoT Tribe added to its Dublin base of operations with two new hires, a head of and an associate of venture incubation and acceleration. 

Advertisement

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

Source link

Advertisement
Continue Reading

Tech

Case manufacturers are guessing with iPhone Fold accessories

Published

on

Renders and 3D-printed models of the iPhone Fold are enough for some case manufacturers to try and get ahead of the competition, but don’t treat their listings as leaks.

It is tempting to see a case listed for iPhone Fold filled with pictures and design elements and take it at face value. However, chances are these case and accessory makers know less about the upcoming product than you do.

A Czech-based Apple-focused website called Letem Svetem Applem shared what it believes are exclusive photos of the iPhone Fold obtained from accessory seller iFunSmart. The problem is, these photos aren’t exclusive or even new.

While some case distributor likely took some time to attach its cases to the renders, these are images we’ve seen going around for some time. One of the images originates from a January report while another comes from an Instagram account.

Advertisement

That isn’t to say that the publication didn’t get these images from a single source or case manufacturer website. They’re just clearly not real examples of the iPhone Fold outside of reused images from the rumor mill.

A simple search turned up actual listings for iPhone Fold cases, though they’re inconsistent. Like the image I used at the top of this article, it has a camera in the top left of the inner display while the “leaked” photos do not.

There’s nothing that can be learned from this “leak” beyond what a clear case might look like on existing renders. And whatever you do, don’t bother ordering one of these cases, as they likely won’t fit.

For example, the Armor-X website has a very clear return policy. Products can be returned, but only if the box is unopened and returned within 30 days.

Advertisement

Poorly sourced “leaks” like these will only increase as we approach the fall.

It won’t be long before Apple announces the iPhone Fold, if it can get through production issues in time. Expect to hear about the iPhone Fold, if it’s ready, during the September iPhone keynote that will feature iPhone 18 Pro.

Advertisement

Source link

Continue Reading

Tech

Drawing Videos On An Etch-a-Sketch

Published

on

We’ve covered etch-a-sketch robots before, but usually they’re not quite as fast as [Every Flavor of Robot]’s “video” etch-a-sketch, capable of drawing a full portrait in as little as a minute.

The robot, nearly finished drawing a portrait of [William Osman]

The idea comes from the motivation to make something cool for Open Sauce. Of course, most projects with a deadline come very close to missing it, and–like many an Open Sauce project–this one is no exception. Arriving in California, they realize they couldn’t access their code! Fortunately, they get a demo working where your portrait is drawn just in time.

After the event, [EFoR] sought to improve their robot. In doing so, they developer their own motor driver platform, complete with a custom PCB that can double as a Raspberry Pi hat. The software, being control theory, also needed some tweaking. Because the real world isn’t perfect, just a PID controller isn’t always enough and, in this case, they also needed to add code to account for backlash. Finally, as a finishing touch, they added a time-lapse camera so the “etchbot” could play videos by taking a picture after every frame.

Advertisement

Source link

Continue Reading

Tech

Previously unknown security patches detailed by Apple

Published

on

Apple has released new security details about its older OS updates.

Apple’s security releases page has been updated with additional information regarding the security issues resolved in iOS 18, iOS 26, and other OS versions.

The company added new details about the vulnerabilities patched in iOS 26, iPadOS 26, visionOS 26, and watchOS 26. Also updated was the security information concerning iOS 18.7, iPadOS 18.7, macOS 14.8, and macOS 14.8.2.

On Tuesday, Apple added a Siri vulnerability to the list of issues resolved with iOS 26. The now-patched security issue allowed access to Private Tabs without proper authentication, and it was fixed by improving state management.

Advertisement

The security page detailing iOS 18.7 and iPadOS 18.7 security fixes now says that Apple patched a call history issue that let apps fingerprint the user. Improved redactions of sensitive information were used to address this vulnerability.

Multiple macOS 14.8 fixes were added by Apple as well, including those that resolved two CoreServices and FaceTime issues, a Phone vulnerability, and a StorageKit security issue.

One now-resolved CoreServices issue let apps modify protected parts of macOS. It was resolved with additional restrictions. Another CoreServices logic vulnerability that allowed apps to access sensitive user data was addressed through improved validation.

Apple also patched a FaceTime issue that made incoming calls appear on a locked Mac with notifications disabled. Through improved data redaction, the company also fixed a Phone issue that gave apps access to sensitive user data.

Advertisement

The most serious issue patched with macOS 14.8 was a StorageKit vulnerability that let apps gain root privileges. Apple fixed it through improved checks. macOS 14.8.2 security details were updated with an entry detailing a vulnerability in SQLite, an issue resolved by a third party.

Overall, the updates to Apple’s security releases page won’t be of much use to the average user running newer OS versions. The company added information regarding older iOS and macOS releases, and not the latest iOS 26.5, iOS 18.7.9, or macOS 14.8.7.

Source link

Advertisement
Continue Reading

Tech

Honeywell X2S Smart Thermostat Firmware Reverse-Engineering

Published

on

The Honeywell X2S Smart Thermostat is a Wi-Fi-enabled thermostat that is meant to integrate with your typical ‘smart home’ setup, with mobile app control available as well. Of course, just using it as-is would be extremely boring, so fortunately we have [author0] to take it apart and reverse-engineer its encrypted firmware.

Of the two brains in this thermostat the first is a succinctly named Renesas R7FA6M4AF3CFP MCU containing a 200 MHz Cortex-M33 core with TrustZone features to theoretically keep out any firmware hackers. Handling the wireless side is a Realtek RTL8721DM Wi-Fi/BLE 5.0 SoC. There are also two Winbond Flash chips connected to these two main chips, with their contents of course encrypted.

Fortunately there are plenty of test points to connect to, for which a custom pogo-pin equipped breakout board was created. Cracking the encryption for the Realtek turned out to be as simple as using its RSIP decrypt-on-the-fly feature. From there exploring the firmware was the next step, with a TLS issue pertaining to certificates found to make man-in-the-middle attacks easy, along with a seeding bug that makes recovering session keys possible.

Although the Renesas MCU firmware still has to be decrypted and the full wireless handshake reverse-engineered, these do seem to be solid steps towards fully reverse-engineering this thermostat. It also makes it very clear once again that the ‘S’ in IoT absolutely stands for ‘security’. Maybe that’s why the smart home bubble popped.

Advertisement

Source link

Advertisement
Continue Reading

Tech

Meet NASA Low Outgassing Standards With Adhesives for Aerospace and Optical Systems

Published

on

This sponsored article is brought to you by Master Bond.

Outgassing is the release of volatile substances from a cured adhesive over time. These released materials, which may include residual solvents, unreacted monomers, or other chemical species, can deposit on nearby surfaces, causing contamination that interferes with sensitive components.

What Is Outgassing and How Is It Measured?

The industry standard for measuring outgassing is ASTM E595, developed by NASA. This test exposes a cured sample to 125 °C at high vacuum (10⁻⁵ to 10⁻⁶ torr) for 24 hours, measuring Total Mass Loss (TML) and Collected Volatile Condensable Materials (CVCM). To meet NASA low outgassing requirements, materials must exhibit less than 1 percent TML and less than 0.1 percent CVCM.

Optical assemblies need contamination-free bonding and prevention of fogging the optics to maintain clarity. High-vacuum scientific equipment, semiconductor manufacturing tools, and aerospace electronics also demand low outgassing materials.

Advertisement

Key Applications

Low outgassing adhesives are essential wherever contamination could compromise performance and this is particularly relevant for space and satellite systems. Optical assemblies, including cameras, telescopes, and laser systems, need contamination-free bonding and prevention of fogging the optics to maintain clarity.

High-vacuum scientific equipment, semiconductor manufacturing tools, and aerospace electronics also demand low outgassing materials. Even terrestrial optical devices benefit from reduced outgassing to ensure long-term reliability.

Hand brushing adhesive onto a clear optical prism beside three similar glass pieces EP30-2 is a versatile system can be used in a variety of applications in aerospace, electronic, optical and specialty OEM industries, especially when optical clarity and low outgassing are important criteria.Master Bond

Ensuring Low Outgassing Performance Through Proper Handling

Achieving specified outgassing performance requires attention to storage, mixing, and curing. For two-part systems, use the correct mix ratio and mix thoroughly to ensure complete reaction. Follow recommended cure schedules — adding heat, even at modest temperatures of 150-200 °F, significantly improves cross-linking and reduces outgassing. For UV-curable adhesives, ensure complete cure by using the correct lamp wavelength (typically 365 nm), adequate intensity, and proper exposure time with no shadowed areas.

Troubleshooting Outgassing Issues

If contamination appears on optical surfaces or outgassing test results are higher than expected, an incomplete cure might be one of the root causes. The first step is to verify that the adhesive has fully hardened to its specified Shore hardness. The next step is to consider adding or extending heat cure to improve cross-linking.

Advertisement

Master Bond Product Recommendations

Master Bond offers a range of adhesives meeting NASA low outgassing requirements. EP30-2 and EP21TCHT-1 are some examples of two-part epoxy systems that have been successfully deployed in demanding vacuum applications, including ultra-high vacuum environments.

For applications requiring UV cure, Master Bond provides specialty UV formulations such as UV16 meeting ASTM E595, as well as dual-cure systems (UV plus heat) such as UV22DC80-10F for assemblies where shadows prevent complete UV exposure. These dual-cure products initiate with UV light and complete curing with heat as low as 180 °F (80 °C).

Source link

Advertisement
Continue Reading

Tech

American Airlines Signs Up for Starlink Wi-Fi Service on Its Flights

Published

on

American Airlines passengers could begin to connect to in-flight Wi-Fi through SpaceX’s Starlink satellite network next year. The airline announced Tuesday that it signed a deal with Elon Musk’s aerospace company to install Starlink internet across its Airbus fleet in 2027, which includes more than 500 narrowbody aircraft.

Commercial flights drive heavy internet usage, as passengers work on cloud-based documents or stream movies and TV shows, activities that require substantial data and reliable Wi-Fi connectivity.

Starlink is among the fastest in-flight internet options, with reported speeds nearly twice those of the next-closest competitor and comparable to or faster than some terrestrial broadband services. More than 10,000 satellites in low Earth orbit drive the system’s performance. By operating much closer to Earth than traditional satellites, they reduce latency — the time it takes for data to travel.

Advertisement

CNET senior writer Jeff Carlson tested Starlink’s in-flight internet on United Airlines and was impressed by the internet experience. “Honestly, I’d think I was at home on my high-speed fiber internet if not for the cabin noise and the occasional tight banking turn,” he wrote.

Which airlines have Starlink service

American is one of the world’s largest carriers by passenger volume, making it a significant contract win for SpaceX, which previously announced Starlink partnerships with United Airlines, Southwest Airlines and Alaska Airlines. Once American outfits the planes with Starlink technology, SpaceX’s service will be operating on more than 2,300 commercial aircraft. 

Despite partnering with many of the largest international airlines, SpaceX doesn’t have a Starlink deal with airline giant Delta Air Lines, which is instead partnering with Amazon for its in-flight Wi-Fi service, which is expected to go into service later this year. Delta CEO Ed Bastian told Bloomberg that Amazon Leo is cheaper than SpaceX’s Starlink and includes a suite of streaming content. 

The American-Starlink partnership comes just days after SpaceX’s filing for an initial public offering. SpaceX’s scope of operations recently expanded after a merger with another one of Musk’s companies, xAI. Analysts value the company at nearly $2 trillion and expect it could raise as much as $75 billion when it goes public, setting an IPO record and making Musk the world’s first trillionaire.

Advertisement

Representatives for SpaceX and American Airlines did not immediately respond to requests for comment.

Source link

Advertisement
Continue Reading

Trending

Copyright © 2025