While you may not be familiar with the term “busy board”, you’ve almost certainly seen one. It’s the sort of toy with a bunch of buttons, switches, and of course LEDs, that are designed to keep young children entertained. As it so buttons, switches, buttons, and LEDs also keep hardware hackers entertained — doubly so if they are the ones designing said busy board in the first place.

That’s where we find [Andy], or should we say, [Uncle Andrew]. Last Christmas he decided to scratch build an electronic busy board for his nephew, and while it might not be a terribly complex piece of kit from a technical standpoint, it’s a fantastic multidisciplinary project in that it’s really equal parts hardware and software. While it would surely be possible to implement a gadget like this entirely in hardware, [Andy] took the modern hobbyist approach of offloading some of the task to a collection of carefully arranged ones and zeros.

In the write-up, [Andy] goes over the decisions he made while designing and building the device. This ranges from the extra effort put in to keep the PCB down to two layers and the logic behind LED multiplexing. This extends right into the software aspect of the project, with a surprisingly deep explanation of how the code uses timers and interrupts to run the show as efficiently as possible, maximizing the run time of the PIC18F67K40 microcontroller on a trio of AAA batteries.

It’s a fun read about a low-stakes project that’s made all the better by the personal touch. Just like the kids of makers and hardware hackers, [Andy]’s nephew is a lucky to have somebody like this in his life.

Homebrew computers don’t have to be retrocomputers, but [Just4Fun]’s all-through-hole, 68008-based “68k-MBC” certainly qualifies, so it is a worthy entry in our ongoing contest. While there are both “full” and “lite” hardware configurations, the three-IC “lite” configuration is what first caught our eye. Yes, three: the 68008, an SRAM chip, and a PIC microcontroller that acts as the ROM.

Software is provided by the suitably-retro CP/M68K, or standalone executables, which run on both hardware configurations. The “lite” option restricts you to a maximum of 512 KB of RAM and a single serial port, but it looks like you still get I2C and the option to plug in an SD “hard drive” or RTC module however you configure the machine. Through the serial port, you can of course connect a terminal of you choice, or even use a thermal printer. The “full” version has two serial ports, if you want to do both. [Just4Fun] also has a parallel adapter lets you plug in printers with that interface as well. The demo video is below, but be warned that the text-to-speech narration won’t be to everyone’s liking.

We’ve featured other single-board-computers using the 68k before, but this one is a worthy contender in our contest, not least for the impressively low chip count. This contest has gotten oodles of entries, but there’s still time for yours: entries close October 27th.

Another all-European podcast for you this week, as Elliot Williams is joined by Jenny List for an evening looking at the past week in Hackaday. And this week there is a particularly good selection to look at.

A while back we showed you a project that put synthetic aperture radar on a drone, generating extremely detailed imaging of the terrain beneath it. This week we had an update, in which an ingenious positioning accuracy fix gave it an astonishing increase in resolution. On top of that project we have 3D lightfield image display with the unexpected help of a Nipkow mechanical TV scanning drum. Geting your own microprocessor manufactured, DOOM in a database server, and a comprehensive array of unusual sensors in a tricorder project complete the picture.

Finally we have a couple of space stories and Jenny describing the preserved industrial delights of the Ruhr valley in Germany. You’ll want to go there, but first you’ll want to listen to the podcast.

Download it yourself in MP3. It’s wafer thin.

Episode 389 Show Notes:

News:

• No More Windows For The Dutch Government, Ze Kiezen Nu Linux

Mailbag:

• Thanks [Jason] for your Mailbag theme music submission. The beatings will continue until morale improves.

Interesting Hacks of the Week:

• Synthetic Aperture Radar Drone Gets Interferometric Imaging
• You Can Make A Microprocessor That’s All Your Own
• Electromechanical TV Goes 3D With This Light-field Display
  • Mechanical Image Acquisition With A Nipkow Disc
  • GitHub – Jenny’s Nipkow disk and mirror drum code
• Abusing SQL To Play DOOM
• Open Source Tricorder Is In It For The Science
  • High Speed Imaging Of Magnetic Fields
  • Gamma Ray Spectroscopy The Pomelo Way

• The Whole Computer Is Vim
• Cheap Yellow Display Dreams Of PDA
• A JavaScript OS For The ESP32

Quick Hacks:

• Elliot’s Picks:
  • Sheety Turns Spreadsheets Into Binaries, For Some Reason
  • Pogo-Bot Goes All Terrain With Compliant Foot
  • Testing Coulomb’s Law And Similar Fundamentals Yourself Remains Tricky
• Jenny’s Picks:
  • colibri: CERN VHDL Common Library released for Everyone to Use – Newsletter of the EP department
  • Improved Double-Sided Toner Transfer Method
  • Apple Finally Made AirPods Repairable… Sort Of

Can’t-Miss Articles:

• Roman Telescope Saves Fuel, Doubles Mission
• Lagrange Points And Why You Want To Get Stuck At Them
• Places To Visit: Landschaftspark Duisburg-Nord

Generally making stuff stick to something like a ceiling requires resorting to suction cups, glue or something much more permanent, but [Steve Mould] starts his video featuring a playing card that is clearly defying gravity with no such measures. All that it seems to take is the small vibration motor placed on said playing card, with its vibrations making the card stick like a kind of magic trick.

Although the easy explanation would be that it creates a kind of Bernoulli grip – a common pneumatic, contactless gripping device – [Steve] explains how it’s more complex than that. This vibration adhesion effect doesn’t rely on the same constant pressure drop that a Bernoulli grip experiences within the small gap between the surface and the object. Although a gap is present, it’s much smaller in this case.

Of note is that this effect only occurs when the object is made of a flexible enough material that can vibrate along with the vibration source, in the form of a motor or transducer. As demonstrated in the video, this creates standing waves that affect the surrounding air. When pushed against a rigid surface, these standing waves change into travelling waves, which result in the air that enters this small gap constantly being pushed out and thus lowering the air pressure.

The air pressure between the rigid and flexible surfaces thus becomes lower than that of the surrounding air, creating the resulting suction effect without touching the surface as something like a suction cup would.

One can imagine practical uses for this effect much like with Bernoulli grips. These are especially common in the semiconductor industry for handling delicate items like silicon wafers with zero risk of contamination. In the video it’s shown how you can use the effect to even hold the weight of a person, though they failed to get past a few dozen kilograms with the used setup involving a 400 Watt transducer, possibly due to their ‘ceiling’ not being rigid enough, leading to energy loss.

There are also papers such as this 2025 one by [Siquan Li] et al. who suggest a ‘Micro-Vibration Adhesion’  (VBA) system to help small robots climb up walls for use in repairs and inspection. In their experimental setup they found an adhesion-to-weight ratio exceeding 51 times, making it an interesting way to have small robots defy gravitational pull without a complicated mechanism.

404 Media reports that the ShinyHunters group who stole multiple terabytes of FBI employee data say they do not plan to release the data.

Known for ransomware and extortion of innumerable companies and government agencies, ShinyHunters used a zero-day vulnerability in Oracle PeopleSoft to compromise the employment site of the FBI and pivot into scraping the content of FBI AWS instances, claiming to have the full employment and health data of all FBI agents, employees, and spouses.

The hacker group took exception to an FBI press release that claimed that the group over-stated stolen data and that they directly harass victims and victim’s families.  The group publicized the FBI data breach, demanding a retraction of the statements, and it was generally assumed that the group would follow their typical methods of releasing the data publicly if the demands were not met.

The group has told 404 media that they had always agreed internally to not release the stolen data, saying “This was all a marketing campaign to protect our business and actively combat disinformation”.  Meanwhile the FBI continues the investigation, and Shiny Hunters may be hoping to defer some of the ire.

Pentagon Data Breach

A data breach at the Defense Manpower Data Center lasted for nine months before it was discovered, and allowed unknown attackers to exfiltrate information on military personnel.

The information stolen includes social security numbers and “operational specialty” data about where a service member is employed within the armed forces.  The DMDC handles data on 60 million current and former service members, but the report does not specify the number impacted.

Currently the source of the attack is unknown; the attackers may be a typical data ransom or theft group, but information about service members could easily be used by foreign intelligence groups.

This is, of course, a different attack and leak of US government employee data, independent of the attack on the FBI.

OpenAI Hacked Australian Government Databases

The Australian Prime Minister, Anthony Albanase, has released a statement that OpenAI was involved in a hacking incident against the Australian government health services site.

This is independent of other incidents involving OpenAI agents hacking live Internet sites during testing; OpenAI says the hack was discovered on September 10, 2026, but the incident occurred in June of 2026, prior to the hack of the HuggingFace site.

In the Hugging Face attack, AI agents were asked to complete a cyber security challenge and responded by finding and utilizing vulnerabilities to steal the solutions.  A report by Translucence (an AI research lab) finds however that in this instance, the agents were tasked with non-cyber related research and opted to exploit not only the Australian health services site but also the University of New Mexico digital library and Data USA, a platform for collecting and visualizing US government data.

OpenAI says the review of the incident remains ongoing, and that no private patient data was compromised.  The Australian government, obviously, has stronger opinions about how the incident occurred and the length of time before they were notified.  If agents are defaulting to exploiting live Internet sites for normal queries, we’re likely to keep finding more stories like this.

Physical Attack Against MacOS Lockdown Mode

Researcher Kevin Kessler at glyph.sh discloses a new vulnerability in macOS that can allow keyboard attacks even when lockdown mode is enabled.

MacOS has built-in protection measures against malicious USB devices.  Readers using macOS may have seen prompts to allow a USB device to connect the first time it is plugged in; additionally, new USB devices are ignored if a Mac has been locked for more than an hour.

In the extra-paranoid “Lockdown Mode”, macOS will also prevent connections to USB devices entirely while the device is locked.  Lockdown mode also disables other operating system features that are suspected of being less secure, like custom web fonts, just-in-time compilation of JavaScript to native code, and direct messaging from unknown contacts. This attack defeats all of these protections.

Due to the architecture of USB, if a USB hub is connected to macOS and trusted, all devices plugged into that hub are automatically trusted. A composite USB device — a device that presents as multiple types of USB interfaces on a single connection — can identify as both a serial port and a keyboard in a single device.

Typically macOS would prompt the user that a new keyboard has been connected, but does not prompt the user when a new USB serial port device is connected to a trusted hub.  Presenting as both a serial device and a keyboard, key presses are accepted automatically, with no user prompt.

Kessler demonstrates copying sensitive user data like SSH keys and cloud provider authentication tokens directly over the USB serial device, a trick which may bypass endpoint protection tools looking for copied files.

Apple told the researcher that the behavior is expected when a USB hub has been trusted, and that composite USB devices are outside the scope of the protection mechanisms.  If so, perhaps it needs to be more clearly communicated to users the risk of trusting any USB hub or dock if an attacker could conceivably get physical access.

Spying with File Update Notifications

New attacks against the file notification systems of all major operating systems — Windows, macOS, Linux, and Android — will be shown at the November 2026 ACM security conference.

File notification systems are a crucial part of almost all modern operating systems, letting the UI and background services receive alerts that file content has changed, instead of constantly querying file modification times.  Unfortunately, it seems like all of them have major issues and allow bypassing permissions and access restrictions.

The researchers call out Windows as the worst offender:  it allows a notification to be set for any file modification, system wide, regardless of access permission or what user owns it.  To be fair, it seems like Linux, macOS, and Android aren’t too far behind however.

On Linux, the inoti.fyi researchers discovered that while notifications can’t be set on files the user isn’t allowed to access, notifications can still be set on readable parent directories, and will still report changes to the files.  Leveraging this oversight against the /dev/input directory, events are raised for every keystroke, and they reference decades of research on using keystroke timing to guess what was typed.

For Android, permission oversights allow one application to set notifications for the private storage of other applications.  Normally, each application runs in a separate sandbox and has no insight into the behavior of other apps, using the Android file notification API, they demonstrate monitoring WhatsApp to log the exact time messages and photos are received.

The Windows vulnerability may be the most immediately severe, where the inoti.fyi team is able to monitor the cache and local storage directories of browsers.  Browsers like Firefox create files with the name of the website; by monitoring the cache directories, it’s possible to monitor the websites loaded by any user on the system.

The team has been working with vendors to address the issues, however in most cases there are no fixes available yet.

OBS Streaming Platform Vulnerable

OBS is a popular tool for streamers, compositing multiple cameras, screen and video capture, and more. A large percentage of streamers on the Internet use OBS.

Orange Cyberdefense Switzerland reports vulnerabilities in OBS due to the embedded Chromium browser source.  Chromium is the open-source engine behind Chrome, Opera, Microsoft Edge, Vivaldi, and many other browsers; OBS embeds the browser engine to allow embedded web content and web-based applications inside a stream.

Streamers often have an embedded display of the chat associated with their stream, encouraging audience participation.  These embeds usually use a browser window to stylize the chats and embed images, which exposes them to whatever the content of the chat message is. Astute readers may already guess how this is a problem.

In a typical browser, each tab is isolated in an independent sandbox, preventing it from interacting with other tabs or the browser itself, but in the OBS embedded browsers, sandboxes are disabled.  OBS also used a two-year-old Chromium engine that contained a publicly known and patched bug in the V8 JavaScript engine.  The bug had already been exploited in the wild by North Korean hackers, but the impact was limited thanks to the sandbox mechanism isolating each tab. With no sandbox, malicious HTML and JavaScript rendered by a web view could directly execute code on the system, taking over the OBS instance or the whole system.

The researchers at Orange have worked with OBS to update the embedded Chromium version, but also offer the advice that untrusted HTML should be avoided whenever possible:  No OBS widget should ever render user or chat content as HTML.

DIVD Hacked

DIVD, the Dutch Institute for Vulnerability Disclosure, announced that they were the victims of a recent hack themselves.

DIVD says that the attackers got in through two previously unknown bugs in the Zammad help desk software, and that the attackers appear to be AI agents. Within seconds, attackers hijacked Zammad sessions, gained code execution, and then gained root access to the system. DIVD says the attackers immediately began to exfiltrate data from the impacted systems, but were blocked from accessing other government systems.

The Institute is using this as a teaching moment, not only releasing an advisory for the Zammad system, but making a candid LinkedIn post discussing the incident and the responses: “So what do hackers do when they get hacked? Handle it the way we think it should be handled. That is open, transparent and honest, even if it sucks.”

Enterprise Networking Vulnerabilities

Major vulnerabilities have been found exploited in the wild for both Cisco Catalyst SD-WAN and Citrix Netscaler enterprise devices. A relatively bland Cisco announcement discloses that all versions of the Cisco Catalyst SD-WAN Manager allow unauthenticated, remote, admin access. (!)

The Citrix Netscaler article, on the other hand, comes from the team at watchTowr.  Anyone who has been reading for the past months should know that a post from watchTowr is a guaranteed good read.  Not only are the vulnerabilities in Netscaler plentiful and severe, but they were widely known and exploited before Citrix finally released a vulnerability statement.

The Netscaler vulnerabilities include arbitrary commands from unauthenticated users, remote code execution and denial of service attacks against the VPN server, multiple memory overflows, and predictable random generation in some situations.

WatchTower digs into the firmware changes for more details, so if seeing how Perl is still used in 2026 enterprise equipment tickles your fancy, be sure to give them a read.

The past years we have been seeing screens pop up in many new places, but seeing them in USB-C cables is still a bit of a novel thing. Out of sheer curiosity [Aaron Christophel] recently took apart one of these, to see what’s inside and what else you can do with them beyond fondling its single touch control and watch reported voltages and current.

Naturally, these devices aren’t exactly meant to be serviced by anyone, so the biggest challenge is to get into them without too much violence. Risking a blood sacrifice to the Hardware Gods, [Aaron] first attacks the display cover of this €15, 240 Watt-rated UGreen cable with sharp utensils before just taking apart the aluminium case, which ultimately gets him inside.

After this it’s clear that attacking the display cover was the right way, just requiring knowing where to apply pressure in order to invert the assembly process. Following that it’s less clear how it was assembled, though it may have involved liberal amounts of glue after sliding in the components. Rather than bothering with applying heat, instead some side-cutters quickly take care of that pesky aluminium shell.

The tiny IPS LC display is attached via a flat flex cable to the PCB with a connector, with the PCB featuring multiple voltage regulators, a MOSFET for the backlight and other parts in addition to the EN32LF056 marked MCU. After some prodding on the exposed SWD interface, it was confirmed to be a Cortex-M0+-based MCU with 64 kB of Flash and 4 kB of SRAM, which made it easy enough to use the little display to display some video frames of everyone’s favorite artist.

Since this MCU is only wired up to measure currents and voltages it cannot use the USB interface, but with some knowledge of how to non-destructively disassemble one of these connectors at least to the point of accessing the SWD pads underneath the display it could be a fun party trick to reflash the firmware with something custom.

Most of the time when you see a repair video of a Game Boy it’ll be demonstrated with a cartridge inserted and booting up into the game, but does this actually mean that the system is truely fully functional? There can still be more intermittent faults, dodgy buttons, or even something like a defective link port — all of which can be much harder to detect than firing up a copy of Tetris. This is where the GB Test Lab cartridge by [Marcel Pflug] of the Game Boy Museum comes into play.

With the freely available ROM put on an EverDrive or similar flash cartridge, you can test a whole range of functions of the original Game Boy (DMG-01), most of them autonomously and some with some user input.

This is similar to the test cartridge that Nintendo themselves used in the form of the DMG-AGING-01, which validated the basic functionality of the handheld. Since then a myriad of test cartridges have been created by the homebrew community, but not all try to test quite literally everything possible. In the case of the GB Test Lab this includes the typical like CPU, RAM, interrupts, etc., but also key bounce time, intermittent connectivity and playing a game of Pong between two GBs connected by link cable as well as using the GB Printer.

Results are saved per GB and persisted if the flash cartridge has battery backup or similar. Overall it seems quite comprehensive and something that’s worth giving a shot if you’re the kind of person who owns one or more GBs. Perhaps the neatest part of this ROM is that it also contains a built-in reference for all the components and other useful details, including how to interpret results and symptoms.