Waveshare UNO-Q-DSI-TOUCH-10.1A is a 10.1-inch touchscreen display designed for the Arduino UNO Q single board computer. The Arduino UNO Q exposes its MIPI DSI interface through the 60-pin JMEDIA and JMISC headers, and for all practical purposes, you normally need a board like the Arduino UNO Media Carrier to make use of it. The UNO-Q-DSI-TOUCH-10.1A display solves that by integrating the headers so users can simply insert the Arduino UNO Q into it without an additional adapter board or special wiring. Waveshare UNO-Q-DSI-TOUCH-10.1A specifications: Screen Size – 10.1-inch Panel type – IPS panel Native Resolution – 1280 x 800 Refresh Rate – 60 Hz Colors – 16.7 millions Viewing Angle – 178° Brightness – 300 cd/m² Contrast Ratio – 800:1 Response Time – 35 ms Multi-touch support Capacitive multi-touch (we’re told the actual number of touch points  somehow depends on the software system) Interface I2C Tempered glass, optical bonding Camera […]

The post Arduino UNO Q gets a 10.1-inch touch display with integrated speakers, audio jacks, camera connectors appeared first on CNX Software – Embedded Systems News.

Read more here: https://www.cnx-software.com/2026/10/31/arduino-uno-q-gets-a-10-1-inch-touch-display-with-integrated-speakers-audio-jacks-camera-connectors/

The post Arduino UNO Q gets a 10.1-inch touch display with integrated speakers, audio jacks, camera connectors appeared first on IPv6.net.

On October 19, 2026, we learned about eMudhra’s eight shockingly weak keys: where eMudhra was trusted to pick a 115-digit number for their virtual combination lock protecting the Internet, they picked the number 4. Not even four digits, just the number 4. The other seven keys were similarly weak: 56, 66, 115, 155, 156, 230 and 237.

The next day, we wrote a blog post on the immediate action we took to mitigate this leak, and what customers needed to do on their end to stay secure. Now, we are sharing a more in-depth follow up on the evidence we’ve seen of exploitation, and the progress seen on visitors patching their systems.

Let’s start with the scale of the problem. A certificate authority (CA) with weak keys this serious is unprecedented, and the potential consequences are significant. While there have been plenty of compromised certification authorities in the past (such as DigiNotar, TÜRKTRUST, and TrustWave), access to their keys has always been contained to a degree; these incidents gave a limited set of attackers or organizations the ability to issue fraudulent certificates. The eMudhra incident is fundamentally different; the affected intermediate private keys could be recovered almost instantly by anyone from the public certificates themselves. Anyone can independently recover these same signing keys and create certificates for any domain that an unpatched client not enforcing Certificate Transparency would accept.

eMudhra announced they’re exiting the public CA business and have claimed a mistake in a key generation script, but have not yet shared the script. They signed a certificate revocation list (CRL) with what might’ve been a correctly generated key, and subsequently corrected it to be signed with the weak key.

How did that come to be and why didn’t that set off alarms? Much has to be cleared up, including the role of the auditors and cross signers. This blog proposes the fixes and next steps for organizations to ensure they are secure.

Patching Cloudflare

Our primary concern remains the security impact on Cloudflare, our customers, and the Internet as a whole. At the time of writing, all high priority Cloudflare systems have been patched. A small number of confirmed low impact tickets is being worked on.

We started patching high-impact systems immediately on October 19. These included customer origin-facing proxies using Pingora, responsible for most of our outbound connections. These were patched in hours to reject the vulnerable eMudhra keys. At the same time, we started an AI-assisted analysis of our source code to find all other systems that trust these weak keys. Within four hours we had a full analysis. We assigned a ticket with preliminary analysis for each system, and asked the team to confirm and/or adjust the analysis before the end of the day. Where high impact was identified, we asked to patch immediately, and for the lower impact, remediation was due at the end of last week.

Has Cloudflare seen exploitation across its network?

To track whenever a customer’s server (or attacker) presents a certificate signed by eMudhra’s weak keys, we added logging to Pingora. As this outbound service accounts for the vast majority of outgoing TLS connections from a Cloudflare machine, any attacker attempting to snoop using the eMudhra keys would trigger this logging. The logging finished rolling out October 21.

At the time of writing, a week later, we’ve seen about 22,000 attempted handshakes with the weak eMudhra keys. Two-thirds of the attempts were fetches of test sites such as emudhra.we-have-a-problem.com (which we mentioned in the developer guidance in our earlier post). Almost all of the remaining third went to origins who appeared to set up a certificate for themselves using the weak intermediate. Every handshake configured to verify the certificate was refused, as we already patched.

About 160 of these handshakes stood out: the certificates’ Subject Alternative Names (SANs) were naming other organizations’ domains, unrelated to the Server Name Indication (SNI) requested in the handshake. Some of those names were domains related to consumer IoT devices. We noticed as well that those forged certificates were made after the keys leaked and some were valid for over two years, longer than any public CA may issue. However, these certificates looked like the servers’ own default certificates rather than part of an attempt to intercept our connections. They named domains other than the ones being connected to, so they would have failed hostname verification anyway. And in several cases, a server presented the same certificate to connections from many of our locations, which means it came from the server itself rather than from something on a single network path.

Thus while there is no evidence of the weak keys being used to intercept Cloudflare’s connections so far, these keys appear to have been used to forge certificates within hours of the weakness becoming public: one of the forged certificates we saw was dated October 20 at 18:19 UTC, less than an hour after Mozilla’s bug report was made public. This does not exclude carefully targeted interception. For that we have to rely on the usual indirect signals of system compromise — and so far, we have not seen any such signals.

How many visitors are still vulnerable?

So much about patching Cloudflare, but what about our visitors? We cannot directly test whether a visitor still trusts the weak keys without breaking connections, so we have to do something more indirect. For that we used our challenge pages:

We rolled out an update to send out two probe connections on a fraction of challenge pages: one probe to ca1.cloudflarecaptcha.com and one to ca2.cloudflarecaptcha.com. Initially we installed an eMudhra signed certificate on ca1.cloudflarecaptcha.com and a regularly signed certificate on ca2.cloudflarecaptcha.com as control. Then we record whether these probes succeeded. This allows us to see if visitors that are served a challenge page still trust the weak eMudhra keys.

What did we find? With 50 million probes over the last week, we see this:

Big caveat upfront: by design the traffic to these challenge pages is highly skewed. There are many (unconfirmed) bots in there. Also, only clients that execute JavaScript (like browsers) will send probes.

The jump in the data is due to the following changes—all times are UTC:

• October 23 15:30, we changed our control endpoint to also serve an eMudhra certificate, but this time without signed certificate timestamps (SCTs). There were some differences in acceptance, but not large. We could’ve added a new endpoint, but that would’ve required a slow release of our challenge platform. Changing the endpoint was easier.
• October 23 16:30, our challenge platform rolled back to a previous version because of an unrelated issue. The probes returned October 27 at 10:00.
• October 27 16:37, we noticed we did not send the G3 cross-sign, which not all clients knew about, and added it to both endpoints. We removed SCTs from both.
• October 27 16:49, we switched ca2 to chain up to the AAA Certificate Services root.
• October 27 18:18, we ramped up probes to be included from 1% to 10% of all challenge pages served on non-paying customer zones.

With those caveats out of the way: what do we notice? Up-to-date modern browsers are mostly patched, but bots and old browsers are not. Also embedded browsers, like Android WebView, lag behind patching with 30–40% still accepting. Over the first weekend (with the monitoring gap), we see clear evidence of patching, but afterwards we see little movement.

On October 29 around 18:00 UTC, we released a detection that caught a large influx of bot traffic identifying as Chrome 150-154 on macOS. This can look like patching in the top graph, but it is actually a change in traffic classification: the same user agents show a corresponding increase in acceptance among traffic with bot signals detected in the bottom graph.

Chrome 150-154 on Linux is the notable exception: its acceptance continues to decline, consistent with further patching in that cohort. Given the bot-heavy and changing traffic mix, that evidence is suggestive rather than conclusive. Otherwise, we still see little movement.

Breaking down by network (ASN) we see:

Across the large networks, more than half of probes still accept the compromised chain, both among traffic with no bot signals detected (top graph) and traffic with bot signals detected (bottom graph). Over the weekend we saw some patching, but afterwards the trend has been flat.

The big caveat still holds: traffic is skewed by (unconfirmed) bots. But bots are also just software that need security updates. And if they’re in any way representative of overall software updates, then the picture is quite dire indeed.

What can you do?

Patch! Dennis Jackson has a great crowdsourced website with instructions. Especially if you’re a developer on macOS, you want to follow these instructions. If you’re a Cloudflare customer, check out last week’s blog post on what needs to be done on your end when using certain products like WARP or Tunnel.

Looking ahead

At Cloudflare, we have a quick-revocation mechanism in place in some products. To bring it to more systems at Cloudflare and industry, we’re excited about projects like upki that understand a trust store can’t be a static list of root certificate authorities, but needs the ability to be quickly updated with information like revocation and certificate transparency keys. As vulnerabilities are discovered at a faster pace than ever, it is vital that they can be addressed quickly and effectively.

Read more here: https://blog.cloudflare.com/emudhra-patching/

The post 4 real? Tracking exploitation and patching of eMudhra’s weak keys appeared first on IPv6.net.

Today, Cloudflare services for private origins is generally available. Point a proxied DNS record at a private IP, and Cloudflare reaches the origin over your existing Cloudflare One connection. Your origin stays private, while web application firewall (WAF), caching, bot management, and Workers work just as they do for public origins.

In June, we launched this capability in closed beta to address a problem we kept hearing from customers: Their internal APIs, AI agent backends, MCP servers, and operational tools weren’t built to face the Internet, but those services still need to accept requests from partners, customers, or agents over the Internet. Before the beta, putting Cloudflare in front of these services meant exposing a public IP, opening a firewall port, or running cloudflared alongside the origin.

Those requirements often left private applications without the same protections and controls they used for public applications, including WAF, bot management, rate limiting, caching, traffic acceleration, rewrites, and Workers.

What is generally available today

During the closed beta, eligible customers requested access through their account team. Today, we’re opening access beyond that beta group.

Point a proxied A or AAAA record at a private IP, and Cloudflare’s application services work as they do for public origins:

• WAF and managed rules
• Bot management
• Rate limiting
• Caching
• Transform and rewrite rules
• Workers

Some limitations remain. Argo Smart Routing and Aegis aren’t supported, and origin health checks require Load Balancing. See the developer documentation for the full list of current limitations.

Your origin keeps its private IP, with no inbound firewall exception required. With Cloudflare WAN or Cloudflare Mesh, there’s no connector software to run on the origin either.

How it works

Create a proxied A or AAAA record pointing to your origin. For supported private IP ranges, Use private network routing is enabled automatically. If your origin uses a public IP that’s reachable only through your private network, you can enable the setting manually.

The rest of the request flow stays the same: TLS termination, WAF, rules, and caching continue to run on Cloudflare’s network.

The setting turns on automatically for RFC 1918 private IPv4 addresses, RFC 6598 CGNAT addresses (100.64.0.0/10), and RFC 4193 unique local IPv6 addresses (fc00::/7). It can’t be turned off for these ranges; attempts to disable it through the API return an error.

What the API looks like

For customers automating deployments through the API, private routing is simply an additional attribute on a standard DNS record.

POST /zones/{zone_id}/dns_records
{
 "type": "A",
 "name": "app.example.com",
 "content": "10.0.0.50",
 "ttl": 300,
 "proxied": true,
 "private_routing": true
}

Behind the scenes, Cloudflare’s proxy platform determines where to send traffic for app.example.com by querying Cloudflare’s Origin API. The response includes metadata indicating that the destination should be reached through a private network path:

{
 "zone_name": "example.com",
 "ipv4_addresses": ["10.0.0.50"],
 "private_routing": true
}

The private_routing flag is the key signal. When our proxy sees it, instead of attempting to connect directly to the private IP address over the public Internet, it hands the request to our private networking layer, which then routes the connection across the customer’s existing private network connectivity, whether that’s IPsec, GRE, Cloudflare Tunnel, CNI, or Cloudflare Mesh.

The beta post covers the routing layer in more detail.

Get started

Before you begin, you’ll need:

1. The Private Origins entitlement on your account. Ask your account team to turn it on.
2. Cloudflare One connectivity using IPsec, GRE, CNI, Cloudflare Tunnel, or Cloudflare Mesh.
3. Unified Routing enabled on your account. New and existing accounts can upgrade through their account team.
4. If you connect over Cloudflare WAN or Cloudflare Mesh, you need Unified Routing enabled on your account and a return route for Cloudflare’s source ranges (100.64.0.0/12 for IPv4 and 2606:4700:cf1:5000::/64 for IPv6). New and existing accounts can upgrade to Unified Routing through their account team.

Then, create a proxied A or AAAA record for the private IP and confirm that Use private network routing is enabled. Your existing WAF, cache, and bot management configuration applies to that hostname without further changes.

One note from the beta: if requests time out and nothing arrives at the origin, check the return route first. A missing route for Cloudflare’s source range was the most common setup failure we saw.

Once enabled, follow our developer documentation, which walks through the full setup.

What comes next

Today’s release covers public traffic reaching private origins. Next, we’re working on private-to-private traffic: users, services, and AI agents on private networks reaching applications on other private networks through Cloudflare’s application services.

Engineering work is underway, and we’re targeting a closed beta in early 2027. If you’d like to participate, talk to your account team.

The goal is to give private applications the same protections and controls as public applications. An employee opening wiki.company.internal, for example, could benefit from WAF, rate limiting, and bot management. Service-to-service traffic between clouds and data centers could use those controls too, even when neither side touches the public Internet.

For now, today’s release brings the WAF, caching, bot management, and Workers you use for public applications to private origins over connectivity you already operate.

Questions or feedback? Join the conversation in our community forums or reach out to your account team.

Read more here: https://blog.cloudflare.com/private-origins-public-to-private/

The post Cloudflare services for private origins is now generally available appeared first on IPv6.net.

When you’re developing systems that support air navigation services, the margin for compromise is essentially zero. Reliability isn’t a “nice to have,” it’s the baseline. That’s the world in which Techno Sky operates, and it’s what makes their decision to build around the Arduino® Opta RS485 microPLC responsive to the project’s identified requirements.

Techno Sky is an ENAV Group company that manages and maintains hardware and software systems supporting air navigation services, and develops innovative technologies for the Air Traffic Management (ATM) sector. Their R&D department works on solutions for air navigation service providers (ANSPs), airports, aviation authorities, and organizations worldwide – systems designed for use under demanding operational conditions.

The challenge: a compact, reliable visual emergency signaling system

The project that brought Techno Sky to Arduino was the development of a visual emergency signaling system for integration within ENAV’s Digital Tower environment. The requirements were unambiguous: industrial-grade reliability, compact form factor, continuous operating capability, Ethernet and industrial communication interfaces, integrated I/O, and the ability to develop and maintain the system without building dedicated custom electronics from scratch.

A fully custom hardware design was on the table, but it would have added significant time and complexity – hardware design, integration, and validation cycles that would delay the project without necessarily improving the outcome. The team needed a platform that would let them focus on application logic and system integration, not on reinventing the controller underneath it.

Opta: a non-conventional, but versatile and effective path to innovation

The R&D team evaluated conventional PLCs, custom embedded electronics, and single-board computers before landing on Opta. It selected Opta based on its combination of industrial characteristics and software flexibility in a single package. The team determined that the conventional PLCs it evaluated offered less development agility for this project. Custom electronics would have added hardware design overhead. The single-board computers evaluated by the team did not meet the project’s identified specifications.

The Opta RS485 offered integrated Ethernet and RS485 communications, relay outputs, and the flexibility of the Arduino programming environment and library ecosystem – all in a compact, DIN rail-mountable form factor designed for industrial applications. Critically, it allowed new functionality to be implemented through software without adding dedicated hardware, a quality that would prove important as the system evolved.

An architecture for in-house deployment within the year

In the deployed system, Opta acts as the main embedded controller, managing signaling outputs, Ethernet communication, RS485 communication with external equipment, operating modes and timing, supervision functions, and communication integrity and security. The system currently implements eight signaling modes on a single controller – functions that the Techno Sky team determined could otherwise have required additional hardware or a more complex architecture.

The main engineering challenge during development was coordinating communications, physical outputs, signaling sequences, and supervision in parallel. The team addressed this through a modular software architecture and the use of watchdog and communication-validation mechanisms – approaches intended to support a manageable codebase and consistent system behavior. Development was carried out internally by Techno Sky’s R&D team using Arduino documentation, libraries, and development resources.

According to Techno Sky, the project started in October and reached operational deployment in under 12 months. One Opta controller integrating more than ten main control functions, designed for continuous operation, with the same architecture carried through from R&D prototype to operational system.

From prototype to production on the same platform

That last point deserves emphasis. R&D teams may prototype on one platform and later transition hardware when moving toward deployment. Techno Sky didn’t need to make that transition. The architecture based on Opta developed during R&D was the architecture retained for operational use – a decision that they report was based on its assessment of the platform for this application.

Techno Sky summarized their experience: “Opta enabled us to move rapidly from an R&D concept to an operational solution. Its industrial hardware, combined with the Arduino programming environment and library ecosystem, allowed us to integrate and expand multiple functions without increasing hardware complexity. The fact that we are retaining Opta in the operational system reflects our positive assessment of its effectiveness and reliability for this application.”

More ideas, more innovation

The Techno Sky team has been working with Arduino platforms across their R&D activities for several years, and this project showcases their reinforced confidence in their chosen Arduino product line. Future applications under consideration include monitoring systems, remote control, sensor integration, robotics, automated test equipment, and ATM infrastructure – a range of potential uses that Techno Sky is evaluating.

For teams facing similar integration challenges – multiple control and communication functions, demanding reliability requirements, and pressure to move quickly from concept to deployment – Techno Sky’s assessment is direct: Opta is well suited, in Techno Sky’s assessment, when those functions need to come together in a compact system, without the overhead of custom hardware design.

Ready to explore options for your industrial application? Find out more about the Opta family and Arduino’s industrial-grade range at arduino.cc/pro.

Arduino, Opta, and the Arduino logo are trademarks or registered trademarks of Arduino S.r.l.

The post How Techno Sky and Arduino Opta brought an industrial visual emergency signaling solution to air traffic management appeared first on Arduino Blog.

Read more here: https://blog.arduino.cc/2026/10/30/how-techno-sky-and-arduino-opta-brought-an-industrial-visual-emergency-signaling-solution-to-air-traffic-management/

The post How Techno Sky and Arduino Opta brought an industrial visual emergency signaling solution to air traffic management appeared first on IPv6.net.

Het aantal korte DDoS-aanvallen onder 1 Gbps nam in het derde kwartaal van 2026 met 208 procent toe. Aanvallen boven 1 Tbps daalden in dezelfde periode met bijna 69 procent. Dat blijkt uit het kwartaalrapport van Cloudflare, dat ook een verschuiving ziet in gebruikte protocollen en doelwitten.

Cloudflare baseert de cijfers in zijn DDoS-dreigingsrapport over het derde kwartaal van 2026 op data uit het eigen netwerk. Volgens het bedrijf weerde dat netwerk in die periode autonoom 18,2 miljoen DDoS-aanvallen op de netwerklaag af, naast 14,4 biljoen HTTP-DDoS-verzoeken. Dat komt neer op gemiddeld 8.226 aanvallen op de netwerklaag per uur, ofwel ongeveer 197.400 per dag. Gemiddeld vond er elke 0,44 seconde een aanval plaats.

Het totale volume aan afgeweerd verkeer bedroeg volgens Cloudflare 272,6 petabyte op de netwerklaag en 95,1 petabyte op de HTTP-laag.

Meer kleine, minder grote aanvallen

Het rapport laat een verschuiving in de omvang van aanvallen zien. Aanvallen die korter dan tien minuten duurden en kleiner waren dan 1 Gbps, namen met 208 procent toe. Hypervolumetrische aanvallen van meer dan 1 Tbps daalden ten opzichte van het tweede kwartaal met bijna 69 procent.

Cloudflare legt een mogelijk verband tussen die daling en het optreden van handhavingsinstanties tegen vier grote IoT-botnets eerder dit jaar. Het bedrijf meldt daarbij dat er nieuwe varianten blijven opduiken. IoT-botnets blijven volgens Cloudflare daardoor een aanhoudende bedreiging voor netwerkinfrastructuur.

Verschuiving in aanvalsprotocollen

Ook bij reflectie- en versterkingsaanvallen signaleert Cloudflare een verandering. Het aantal CLDAP-floods daalde met 99,5 procent ten opzichte van het vorige kwartaal. Aanvallers stapten volgens het rapport over op andere verbindingsloze protocollen. Het aantal aanvallen met DNS-versterking steeg met 215 procent, algemene UDP-floods namen met 122 procent toe.

Verenigde Staten weer meest aangevallen land

De doelwitten van aanvallen waren in het derde kwartaal geografisch meer verspreid. De Verenigde Staten namen de positie van meest aangevallen land weer over van China. Canada steeg tien plaatsen op de ranglijst van meest aangevallen landen, Israël zeven. Cloudflare brengt die stijging in verband met geopolitieke spanningen, handelsgeschillen en controversiële binnenlandse gebeurtenissen in beide landen.

Ook de sectoren waarop aanvallers zich richtten, veranderden. Waar mediaorganisaties in eerdere kwartalen vaak doelwit waren, verschoof de focus volgens het rapport naar een breder scala aan sectoren. Daaronder vallen consumentendiensten, internetinfrastructuur en de entertainmentmarkt voor volwassenen.

Kleine aanvallen in de praktijk

De toename van korte aanvallen met een beperkte bandbreedte heeft gevolgen voor de manier waarop je verkeer monitort. Zulke aanvallen kunnen onder drempelwaarden van detectiesystemen blijven die zijn ingesteld op grote volumes. Omdat een aanval vaak binnen tien minuten voorbij is, blijft er weinig tijd over voor handmatig ingrijpen.

De verschuiving van CLDAP naar DNS-versterking en UDP-floods maakt het daarnaast relevant om na te gaan hoe open resolvers en UDP-diensten in klantomgevingen zijn geconfigureerd. Slecht afgeschermde DNS-servers kunnen bij versterkingsaanvallen als doelwit dienen of zelf misbruikt worden om verkeer te versterken.

Het volledige rapport is te lezen via DDoS-dreigingsrapport over het derde kwartaal van 2026.

Het bericht Aantal kleine DDoS-aanvallen stijgt, grote aanvallen nemen af verscheen eerst op MSP Business.

Read more here: https://mspbusiness.com/security-en-privacy/aantal-kleine-ddos-aanvallen-stijgt-grote-aanvallen-nemen-af/

The post Aantal kleine DDoS-aanvallen stijgt, grote aanvallen nemen af appeared first on IPv6.net.

Deze editie draait om firewalls, bedrijfssoftware en servers. Cisco bevestigt dat aanvallers ASA- en FTD-firewalls via de SSL-VPN laten herstarten, aanvallers verkennen een kritiek lek in Oracle E-Business Suite, een kernelfout in de TCP-stack van Linux wacht bij Ubuntu en Red Hat nog op een patch en het GitLab-lek met CVSS 10,0 staat nu in de CISA-catalogus nadat Alpine Linux werd aangevallen.

• Cisco ASA en FTD: aanvallers laten firewalls herstarten via de SSL-VPN
• Oracle E-Business Suite: kritiek SQL-injectielek wordt verkend, Horizon3 publiceert indicatoren
• Linux-kernel: TCP-fout geeft mogelijk root, Ubuntu en Red Hat hebben nog geen patch
• GitLab-lek met CVSS 10,0: nu actief misbruikt en toegevoegd aan de CISA-catalogus

Cisco ASA en FTD: aanvallers laten firewalls herstarten via de SSL-VPN

Hoe kan de kwetsbaarheid misbruikt worden?

Volgens het Cisco-advisory van 28 oktober volstaat een speciaal opgestelde aanvraag bij het verbinden met de SSL remote access VPN. Een geslaagde VPN-login is daarbij niet nodig. Kwetsbaar is een firewall waarop de VPN-loginservice bereikbaar is en waarop secundaire authenticatie is ingesteld op een tunnelgroep. Dat geldt ook voor de standaardgroep DefaultWEBVPNGroup. The Hacker News schrijft dat Cisco geen details geeft over het begin van de aanvallen, de daders of de omvang. Het is al de tweede keer sinds augustus dat Cisco een misbruikte zero-day in de VPN-dienst van deze firewalls repareert.

Wat kan het gevolg zijn?

Voor zover bekend levert dit geen gegevensdiefstal of code-uitvoering op. De aanvaller kan de firewall wel herhaaldelijk laten herstarten, waardoor de remote-toegang van alle gebruikers achter dat apparaat uitvalt. Voor een MSP die voor veel MKB-klanten de VPN beheert, betekent dat uitval op meerdere plekken tegelijk.

Wat moeten IT-beheerders nu doen?

Update naar een van de gefixte releases. Kun je dat niet meteen, controleer dan in de configuratie of secundaire authenticatie op een tunnelgroep staat. Is dat zo, dan kun je die tijdelijk uitschakelen. Cisco ziet dat als noodoplossing die de beveiliging van de VPN verlaagt, en voor de standaardgroep geldt dat uitschakelen van de tunnelgroeplijst alleen helpt als die groep zelf geen secundaire authenticatie gebruikt. Zoek daarnaast in de logboeken naar onverwachte herstarts van ASA- en FTD-apparaten sinds begin oktober.

top ^

Oracle E-Business Suite: kritiek SQL-injectielek wordt verkend, Horizon3 publiceert indicatoren

Hoe kan de kwetsbaarheid misbruikt worden?

Volgens Help Net Security ontdekten de Horizon3.ai-onderzoekers Brandon Peterson, Jimi Sebree en Noah King de fout en meldden ze die op 24 juli aan Oracle. Oracle noemt het een eenvoudig te misbruiken lek dat via HTTP bereikbaar is. Een aanvaller die de servlet bereikt, voert SQL uit als de databasegebruiker APPS. Horizon3.ai publiceerde indicatoren van compromittering en Censys telde 2.246 webproperties met E-Business Suite. Dat zijn hostnamen en poorten, dus het aantal unieke systemen ligt lager.

Wat kan het gevolg zijn?

Afhankelijk van de installatie liggen financiële gegevens, salaris, HR en inkoop open voor lezen en wijzigen. Daarna kan de aanvaller commando’s uitvoeren op de applicatiehost. De Critical Patch Update is al elf dagen uit, dus omgevingen die die nog niet hebben ingespeeld, zijn nu het doelwit.

Wat moeten IT-beheerders nu doen?

Controleer bij klanten met Oracle E-Business Suite of de oktober-update is geïnstalleerd. Haal tot die tijd de AppsTCFServer-servlet uit de allowlist en sluit de webtier af voor het internet. Loop de indicatoren van Horizon3.ai na in de logboeken van webtier en database, met name op verdachte aanroepen van /OA_HTML/AppsTCFServer sinds 27 oktober.

top ^

Linux-kernel: TCP-fout geeft mogelijk root, Ubuntu en Red Hat hebben nog geen patch

Hoe kan de kwetsbaarheid misbruikt worden?

Bij het afronden van een verbinding geeft de kernel de IP-opties van het wachtende verzoek door aan de nieuwe socket zonder ze te kopiëren. Wordt die socket vernietigd terwijl een andere processorkern de opties nog gebruikt, dan leest de kernel vrijgegeven geheugen. Volgens The Hacker News meldde Xinyang Ge van Anthropic de fout. Anthropic schrijft dat zijn AI-model Claude een exploit maakte die in twee fasen eerst de kerneladressen (KASLR) omzeilt en daarna een commando als root uitvoert, in de test na ongeveer 48 minuten plus 5 minuten. Het doelwit was een server met een MPTCP-listener. Of MPTCP uitschakelen helpt, is niet bevestigd, want de CVE-beschrijving en de kernelfix noemen MPTCP niet.

Wat kan het gevolg zijn?

Bijna elke Linux-server met IPv4 valt onder de getroffen reeksen. Red Hat verwacht vooral een kernelcrash, maar geheugencorruptie en daarmee rootrechten zijn in theorie mogelijk. Per 29 oktober is Ubuntu 22.04 tot en met 26.10 in behandeling en hebben Ubuntu 16.04, 18.04 en 20.04 geen fix. Bij RHEL 8, 9 en 10 en OpenShift 4 is de fix uitgesteld. RHEL 7 is niet getroffen. Red Hat noemt geen mitigatie die aan de eigen eisen voldoet.

Wat moeten IT-beheerders nu doen?

Installeer waar mogelijk de gefixte kernel en herstart het systeem. Maak een lijst van servers met Ubuntu, RHEL en Amazon Linux 2, want daar is nog geen patch, en volg de CVE-pagina’s van Ubuntu en Red Hat. Blokkeer tot die tijd waar dat kan inkomend verkeer van onbetrouwbare netwerken naar niet-publieke diensten, en zet servers met MPTCP bovenaan de lijst.

top ^

GitLab-lek met CVSS 10,0: nu actief misbruikt en toegevoegd aan de CISA-catalogus

In de Patchwork van maandag 26 oktober stond een ander GitLab-lek met CVSS 10,0 in dezelfde regex-motor. Het nieuws van vandaag is dat het eerdere lek van 12 oktober nu in het wild wordt misbruikt en dat de GitLab-update alleen niet altijd volstaat.

Hoe is dit misbruikt?

Volgens het incidentbericht van Alpine Linux installeerde het project op 13 oktober per vergissing GitLab 19.3.4 in plaats van 19.3.5, dat de fix bevatte. Op 20 en 21 oktober stuurde een nieuw geregistreerd account gemanipuleerde CI-configuraties naar de server. De GitLab-werkprocessen crashten acht keer en in vier gevallen kwam de aanvaller een stap verder, maar de volgende stap mislukte. De aanvaller downloadde ook de GitLab-containerimage, waarschijnlijk om de exploit op de exacte build af te stemmen. Alpine vond geen bewijs van code-uitvoering, kan die niet uitsluiten en bouwde de server daarom opnieuw op, met nieuwe wachtwoorden en nieuwe geheime sleutels. Een geslaagde aanval laat volgens Alpine geen crash en geen spoor in de weblogs achter. Security.nl beschrijft het incident ook.

Wat kan het gevolg zijn?

Met een geslaagde aanval komt een aanvaller bij wachtwoordhashes, 2FA-geheimen, CI/CD-variabelen, runner-tokens, persoonlijke toegangstokens en privérepositories. Voor een MSP of ontwikkelteam zijn juist die CI/CD-geheimen waardevol, want ze geven toegang tot klantomgevingen. In de KEV-opmerking staat dat ook andere producten dezelfde onderliggende Ruby-fout kunnen hebben.

Wat moeten IT-beheerders nu doen?

Controleer bij zelf gehoste GitLab zowel de GitLab-versie als de Ruby-versie. In officiële GitLab-pakketten en -images zit de Ruby-fix al, maar bij een zelfgebouwde installatie of een image met eigen Ruby is die nodig, zoals beschreven in de Ruby-aankondiging. Is de server van buiten bereikbaar en stond hij in de dagen na 12 oktober nog op een kwetsbare versie, behandel hem dan als mogelijk gecompromitteerd: vervang tokens, geheimen en wachtwoorden en zoek in de logboeken naar workercrashes en nieuwe accounts.

top ^

Het bericht Patchwork – vrijdag 30 oktober verscheen eerst op MSP Business.

Read more here: https://mspbusiness.com/security-en-privacy/patchwork-vrijdag-30-oktober/

The post Patchwork – vrijdag 30 oktober appeared first on IPv6.net.

A brand mascot only works if people recognize it. With image and video generators, that is harder than it sounds. Ask a model for “a friendly orange fox in a blue hoodie” twice and you get two different foxes: the ears change, the eyes grow, the hoodie shifts shade. In one post nobody notices. Across a year of social content, ads and explainer videos, the mascot stops looking like a brand asset.

The fix does not depend on any single product. It depends on a method: approve one master image, turn it into a small reference kit, and carry that kit into every new image and video. Tools differ mainly in how they carry identity from one generation to the next, through reference images, a model trained on your own artwork, or a saved character asset.

This guide explains the method step by step, then compares how Higgsfield, Midjourney, Adobe Firefly, Runway and Leonardo handle mascot consistency. Features and prices were checked against vendors’ public pages on October 28, 2026. Plans and promotional offers change often, so confirm details before you buy.

Why AI Mascots Drift From Post to Post

Every generation starts from scratch. A text prompt describes thousands of possible characters, and the model picks a slightly different one each time. Three habits make the drift worse. Teams prompt from text only, and words rarely pin down proportions or exact colors. They reference the latest output instead of the original, so each copy of a copy moves further away. And they change pose, outfit and setting in one prompt, which gives the model too much freedom at once.

The remedy is to give the model the same visual source every time and to change one thing per generation.

What Goes Into a Mascot Kit

Build the kit once, store it where the whole team can find it, and treat it like a logo file.

How to Create a Consistent AI Brand Mascot, Step by Step

Step 1: Design and Approve One Master Image

Write a short brief: species or object, personality in three words, brand colors and the channels where the mascot will appear. Generate a range of options as a single character, front-facing and full body, on a plain background with even light. Busy scenes hide the details you need to keep fixed. Pick one master and stop changing it. Every later asset references this file, not a later output.

Step 2: Turn the Master Into a Reference Set

Use the master to create the turnaround, expressions and poses from the kit table. Change one thing per prompt, for example “same character, smiling”, then “same character, surprised”, and keep background and lighting the same. Review each result next to the master and reject anything with a different eye shape, an extra finger or a shifted color. Rejecting now is faster than fixing fifty posts later.

Step 3: Choose How the Tool Carries Identity

There are three common approaches. Reference images are attached to each prompt and work in most tools. A custom model, often a LoRA, is trained on your approved artwork and selected at generation time. A saved character asset stores the mascot inside a project so that images and video draw on the same source. Many teams combine them: references for quick posts, a trained model or saved asset for volume.

Step 4: Carry the Mascot Into Video

Start every clip from an approved image, not from text. Use a clean pose from the kit as the first frame, attach the turnaround as references where the tool allows it, and keep clips short until the character holds steady. Mascots tend to drift most in fast motion and extreme angles, so review those shots first.

Step 5: Give the Mascot a Voice

Pick one voice and keep it. Use a synthetic voice, or clone a voice only with the clear permission of the person who owns it. For talking clips, a close-up of the master on a clean background makes the best input. The same consent rule applies whenever a real person’s face appears in a reference.

Step 6: Make It Work Across a Team

Consistency breaks when five people prompt in five different ways. Share the kit, the style block and any trained model or saved asset, and agree on one review checklist covering silhouette, colors, eyes, outfit details and voice.

Which Tools Can Keep a Mascot Consistent?

The tools below were evaluated on documented features and public pricing, not hands-on testing. The criteria were how identity is carried, support for illustrated characters, the path from stills to video, team sharing, and how billing works.

Public monthly pricing as of October 28, 2026, billed monthly. Annual billing is cheaper on most plans.

1. Higgsfield: Best for One Mascot Across Stills, Video and Talking Clips

Pricing: free plan available; paid plans start at $15/month (Starter), with current plans on the Higgsfield pricing page.

Higgsfield is a generative platform for creative production. For a mascot, Shots turns one image into a nine-frame storyboard of camera angles, a quick start for a turnaround. Elements in Cinema Studio store characters, locations and props as reusable assets shared across a project. Lipsync Studio turns an image and an audio track into a talking clip, and dubbing into 30+ languages keeps the voice profile. Team and Scale plans add a shared workspace with owner, admin and member roles.

Limitations: Soul ID is trained on 10 to 25 photos of a real person, so a drawn mascot relies on references and Elements instead. Generations spend credits, and some video options are locked on the entry Starter plan.

2. Midjourney: Best for Exploring the First Design

Pricing: Basic from $10/month; Standard $30/month.

Midjourney is strong at the first stage, when the team is still choosing what the mascot looks like. On versions 8.1 and 8.2, its Edit model accepts up to four reference images, replacing the older Omni Reference and Character Reference, and can show a character from different views. Moodboards, Personalization and Style References help hold the look. Any image can be animated into a five-second video and extended up to 21 seconds, at 480p on Basic and 720p on higher plans.

Limitations: there are no built-in voice or lip-sync tools for a talking mascot. Midjourney’s documentation notes that fine details such as logos on clothing may not match the reference exactly. Companies earning more than $1 million a year need the Pro or Mega plan.

3. Adobe Firefly: Best for Creative Cloud Teams

Pricing: Firefly Standard from $9.99/month with 2,000 generative credits.

Firefly’s Custom Models, in public beta for Creative Cloud customers, let you train a model on your own illustration artwork and then generate the same character across scenes, expressions and poses. Adobe positions this for stylized work, which suits illustrated mascots. Trained models appear in the model picker for Firefly image generation and Firefly Boards. Generative credits are shared across Firefly, Photoshop, Illustrator, Premiere and Adobe Express, so the mascot can move into existing design files without changing tools.

Limitations: Custom Models are still in beta. Paid plans include unlimited standard image generations, but video, audio and partner models draw on monthly credits that do not roll over. Teams outside Creative Cloud gain less from the integration.

4. Runway: Best for Cinematic Clips From a Saved Character

Pricing: Standard $15/month, or $12/month billed annually, with 625 monthly credits.

Runway’s References let you save a character image under a name, call it in prompts with @, and share it with workspace members. Up to three references can be active in one image generation, and Runway’s help center notes that references can work well with stylized inputs, not only photos. For video, Gen-4 builds 5 or 10 second clips from an input image that acts as the first frame. The Pro plan adds a Brand Kit and one custom voice clone.

Limitations: identity reaches video mainly through the starting image, so longer sequences need careful frame planning. Video is billed by the second in credits, and the Standard plan is limited to three projects. Brand Kit and voice cloning start on the Pro plan.

5. Leonardo: Best for Training a Dedicated Mascot Model

Pricing: free tier with 150 daily tokens; Essential from $12/month with 8,500 monthly tokens.

Leonardo’s Elements are its implementation of LoRA training. You upload a curated set of images, and the trained Element locks in a character, style or product so later generations stay aligned. Leonardo says most Elements train in minutes and can be shared across a team to keep campaigns consistent. That makes it a practical choice once the master and turnaround exist and the mascot is needed in volume. Leonardo also offers a video generator and an image and video editor.

Limitations: Elements are presented as a tool for consistent image generation, so video needs an approval still as a starting point. Training quality depends on a clean, consistent image set, and billing in tokens makes monthly costs harder to estimate in advance.

What a Consistent Mascot Costs, Including Retakes

Plan for rejects. Building the kit usually takes several attempts per approved asset, and routine posts take fewer once the kit exists. Video costs more than stills on every platform here, and billing units differ: credits per generation on Higgsfield, GPU time on Midjourney, generative credits on Firefly, credits per second of video on Runway and tokens on Leonardo.

A simple budget formula works across all of them: monthly cost ≈ (images × cost per image + seconds of video × cost per second) × attempts. On Higgsfield, the exact credit cost is shown on the Generate button before a job runs, failed generations return their credits automatically, and credits refresh each billing cycle without rolling over.

Frequently Asked Questions

Can an AI tool keep a mascot’s design exactly the same?

Not exactly, but close enough for brand use if you anchor every generation with references or a trained model instead of text alone. A person should still review each asset against the master.

Does Higgsfield’s Soul ID work for an illustrated mascot?

Soul ID is trained on 10 to 25 photos of a real person and is built for photographic characters. For a drawn or 3D-style mascot, use a reference set and Elements instead.

How many reference images does a mascot need?

Start with six to ten: the master, four turnaround views and a few expressions. Tools that train a custom model may need a larger, consistent set, so check the vendor’s guidance.

Can a mascot speak several languages?

Yes. Several tools support voice generation, cloning or dubbing. Use a synthetic voice, or clone a voice only with the owner’s permission, and keep one voice across all languages.

Can AI mascot images be used commercially?

Usually yes on paid plans, under each vendor’s terms of use. Check trademark and originality yourself before registering the mascot as a brand asset.

Bottom Line

A consistent AI mascot comes from process more than from any single tool: one approved master, a small reference kit, one change per prompt and a person reviewing every output. Choose the tool by how it carries identity. Reference images suit fast iteration, trained models suit high volume, and saved character assets suit teams that move the same mascot from stills into video and talking clips. Whatever you choose, keep the kit as the source of truth so you can switch tools without redrawing the character.

The post How to Create a Consistent AI Brand Mascot for Images and Video (2026) appeared first on IntelligentHQ.

Read more here: https://www.intelligenthq.com/how-to-create-a-consistent-ai-brand-mascot-for-images-and-video-2026/

The post How to Create a Consistent AI Brand Mascot for Images and Video (2026) appeared first on IPv6.net.

It’s almost that time of year again! No chance to 3D print your Arduino®-powered pumpkin project? Didn’t get around to animating the LEDs on your costume? There’s still time, and here’s a half-dozen Hallowuino-themed builds to get you inspired.

Spooky, Sassy Pumpkin

You’ve heard of Spooky, Scary Skeletons, well here’s a Spooky, Sassy Pumpkin that is built to use a USB webcam to identify visitors as they approach, then answer their questions about what it sees using the Arduino App Lab Vision-Language Model (VLM) Brick. This jack-o’-lantern packs a whole lot more smarts than your average fruit thanks to the dual-brain VENTUNO Q concealed underneath it. All processing is designed to be handled offline, on-device without sending users’ faces and voices  across networks or to the cloud.

Arduino-Powered Animatronic Supergroup

Bands break up for all kinds of reasons, so we were pleased to see Arduino Project Hub member nerdabilly figure out a way to sync the Costco Skeleton Punk Rocker animatronic with the Lowe’s Reaper Band. The band members are centered around a Bluetooth speaker, while the rocker is triggered by a timer or motion sensor. Not wanting to permanently alter these expensive displays, nerdabilly used the existing analog signal from the band leader to trigger the pink in place of its motion-sensing trigger, so the whole crew can rock out with their skulls out. Nerdabilly, we salute you for keeping this spooky symphony in sync!

Simple Spookiness with Modulinos and MP3s

Here’s some simple steps to sprinkle some spookiness into your season from our own team. Using the UNO R4-based Plug and Make Kit, plus a DFRobot DFPlayer MP3 player module, we show you how to trigger spooky lights and sounds when the Modulino® Distance sensor detects a presence. You can even connect to the Arduino Cloud to activate, customize, and monitor your project remotely. And that’s just the start – the seven included modules and built-in Wi-Fi give you plenty of options for creating your own frightful projects!

Ultrasonic Spider

Everyone has to start their Arduino journey somewhere, and for Project Hub member ParzivalUK, that place was a half-decade old project video demonstrating a fake spider dropping on unsuspecting passers-by. Unfortunately, ParzivalUK found that the accompanying code no longer worked for their project, and there weren’t detailed steps on how to recreate it. Driven by a desire to delight their son with a fun Halloween prank, ParzivalUK pushed on, combining a servo with an ultrasonic sensor to drop a toy spider on anyone who comes within approximately 40cm of the trap, with a continuous rotation servo to wind it back up, ready for the next victim!

Portal Sentry Turret

We love seeing projects shared on the unofficial Arduino Discord server. User jaysicks’ Aperture Science Sentry Turret costume really caught our eye, and we asked for a little more detail. The resulting Instructable is a detailed step-by-step guide for recreating the iconic tripod robot from one of the most beloved puzzle platformers of all time. With no 3D printer at hand, the costume relies on cardboard construction but comes out looking great. A red LED in the eye responds to the audio output from the incorporated GD380D-M audio playback module when a button is pressed, and the whole thing is controlled by an ATtiny85V microcontroller, programmed using the Arduino IDE. We think jaysicks’ son will be the envy of the neighborhood this Halloween, or at least among those with a solid appreciation of classic video games!

Cyber Research Systems T-1-7 Warrior Robot

The T-800 and T-1000 may get most of the screen time, but Redditor u/parsupo recreated the more niche T-1-7 Warrior Robot for their annual Halloween project. Built around an electric wheelchair base, the bot uses an Arduino Mega 2560 to receive and process commands from a remote control, and the same ATmega328 chips found in the UNO to control lights, gun movement, and the head. It may not be made of mimetic polyalloy, but we wouldn’t want to run into it in a dark alley!

What will you make?

Got a spooky Arduino-based project to share? Or need help realizing your creation? Head over to the Arduino subreddit and let us know!

The post How about a Hallowuino half-dozen? appeared first on Arduino Blog.

Read more here: https://blog.arduino.cc/2026/10/29/how-about-a-hallowuino-half-dozen/

The post How about a Hallowuino half-dozen? appeared first on IPv6.net.

Welcome to the 26th edition of Cloudflare’s DDoS Threat Report. This edition covers the third quarter of 2026 — July, August, and September — and returns the series to its quarterly cadence following the combined H1 2026 volume. The analysis is produced by Cloudforce One, Cloudflare’s Threat Intelligence organization, providing a comprehensive analysis of the evolving threat landscape of Distributed Denial of Service (DDoS) attacks based on data from the Cloudflare network.

Key insights

1. Short-burst, low-bandwidth attacks lasting under 10 minutes and 1 Gbps surged by 208%. Conversely, hyper-volumetric attacks exceeding 1 Tbps plummeted by nearly 69% from Q2, possibly a reflection of law enforcement actions against four major Internet of Things (IoT) botnets earlier in the year. However, variants continue to emerge, proving that IoT botnets remain a durable, high-volume threat to network infrastructure.
2. Threat actors dramatically shifted their reflection and amplification tactics, abruptly abandoning CLDAP floods, which collapsed by 99.5% quarter-over-quarter. Instead, attackers pivoted heavily toward other connectionless protocols, driving a 215% surge in DNS amplification and a 122% increase in general UDP floods.
3. Attack targets broadened significantly across both industries and geographies, with the United States reclaiming the most-attacked position from China. Canada and Israel experienced sharp spikes in targeted attacks — jumping 10 and 7 spots respectively — while juggling geopolitical tensions, trade disputes, and contentious domestic events. At the same time, the operational focus shifted away from media organizations toward a wider array of industry targets, including consumer services, Internet infrastructure, and adult entertainment.

Q3 by the numbers: 8,200 DDoS attacks every hour

Across its network in the third quarter of 2026, Cloudflare autonomously mitigated 18.2 million network-layer DDoS attacks and 14.4 trillion HTTP DDoS requests. That works out to approximately 8,226 network-layer DDoS attacks per hour, or about 197,400 per day — one attack every 0.44 seconds. The quarter’s mitigated traffic totaled 272.6 PB at the network layer and 95.1 PB at the HTTP layer.

More swarms, fewer giants

Short-burst, mid-range, high-count attacks — the operational signature of DDoS-for-hire “booter” services — accelerated this quarter. These attacks primarily targeted computer software, gambling and casinos, and information technology industries. Cloudflare autonomously mitigated 18.2 million network-layer DDoS attacks in Q3 2026, a +208% increase from the same quarter in 2025:

• 96% ended in under 10 minutes
• 98% stayed under 1 Gbps, more than enough to overwhelm a server or website

On the other hand, network-level hyper-volumetric attacks (those exceeding 1 Tbps) reversed course, dropping to 251 attacks in Q3 from 805 in Q2 — coinciding with law enforcement action in early 2026 that dismantled four of the largest IoT DDoS botnets: Aisuru, KimWolf, JackSkid, and Mossad.

Still, IoT-based botnets remain a durable high-volume threat as the ecosystem churns through new variants such as Dysphoria and Evooo1Bot. Mirai-classified mitigation peaked in August at 57.23 PB, representing 46.5% of all mitigated network-layer bytes in Q3, including four days — August 16, 19, 23, and 25 — that each cleared three petabytes. The quarter’s longest sustained Mirai attack ran 49.7 hours between August 19 and August 21.

Vector shifts: the collapse of CLDAP and rise of UDP

The most dramatic vector shift of the quarter was downward. CLDAP (Connectionless Lightweight Directory Access Protocol) attacks — where small queries with a forged victim IP address trick public domain controllers (UDP 389) into reflecting massive, amplified responses back at the target — experienced a dramatic +580% quarter-over-quarter surge in the first half of the year before collapsing to just 0.05% of attacks in Q3.

Meanwhile, DNS amplification surged 215% to account for 3.43% of all network-layer attacks, exploiting open DNS resolvers in a similar reflection-and-amplification pattern to CLDAP: small spoofed queries, large replies directed at the victim. Other UDP floods climbed from 14.06% to 31.31% of network-layer attacks. UDP is a connectionless transport protocol, which makes it a convenient vehicle for raw volumetric attacks: attackers send large numbers of UDP packets to random or specific ports on the target, forcing the target to check for a listening application and respond, consuming its network and compute resources.

Most-attacked industry

While Media, Production & Publishing remained the most-attacked industry in Q3 2026, its overall share is roughly a quarter of its Q2 level, and the focus has moved across a wider set of industries. Internet rose from outside the top 10 to #6; Consumer Services and Adult Entertainment also climbed in, reaching #8 and #9 respectively.

Most-attacked locations

Geographic surges: Canada and Israel climb the ranks

Adding to an already turbulent period of bilateral trade disputes, Canada jumped from #16 to #6, driven by attacks against its Retail, Telecommunications, Service providers & carriers, and Marketing & advertising industries.

Israel moved 7 spots to take #10 as a result of sustained DDoS activity in mid-September. While this period was marked by contentious decisions ahead of parliamentary elections and the Rosh Hashanah holiday, there was also a massive, documented surge in hostile cyber warfare targeting Israel this year.

Top 10

The United States was the most-attacked location in Q3 2026, while China was number #2 and Indonesia rose into the top three at 2.93% of total attacks. The U.S.-China pairing at the top is consistent with the first half of 2026, when China finished #1 and the U.S. #2; the countries have traded positions as attention and attacker preferences shift.

Strengthening global defenses and helping to defend the Internet

Cloudflare’s network is designed to absorb this kind of growth in DDoS threats. Every service on our network is protected by free, unmetered DDoS protection that runs at every one of our 330+ cities globally, backed by 500 Tbps of network capacity. Autonomy is the point: our systems detect and mitigate attacks without human intervention. And they need to, because as this quarter’s distributions make clear, most attacks end long before a human analyst could see the alert, and the largest attacks still regularly exceed 1 Tbps at a cadence measured in hundreds per quarter.

To help hosting providers, cloud computing platforms, and Internet service providers identify and take down the abusive IP addresses and accounts that launch these attacks, we leverage Cloudflare’s unique vantage point on DDoS attacks to provide a free DDoS Botnet Threat Feed for Service Providers.

Over 800 networks worldwide have signed up for this feed, and we’ve already seen great collaboration across the community to take down botnet nodes. For a continuously-updated view of attack trends across the Internet, visit Cloudflare Radar.

About Cloudforce One

Driven by a mission to help defend the Internet, Cloudforce One draws on telemetry from Cloudflare’s global network — which protects more than 20% of the web — to drive threat research and operational response, protecting critical systems for millions of organizations worldwide.

Read more here: https://blog.cloudflare.com/ddos-threat-report-2026-q3/

The post Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants appeared first on IPv6.net.

Arduino, Qualcomm Technologies, and Edge Impulse recently teamed up with Hackster to host the Invent the Future competition. The competition attracted 4,028 registrants and 1,202 hardware applications, culminating in 153 final project submissions across a wide range of real-world applications.

There were several categories in the competition, all unified by the UNO Q board and Arduino® App Lab. The judging is officially complete and the winners have been announced, which means we get to show you the top projects that most impressed the judges and took home the awards!

These winning creations illustrate a range of uses for the UNO Q – and stay tuned, because we’ll also be shining the spotlight on many other fantastic contest submissions in the coming days.

Best Social Impact

While sustainability was a consideration for every category, the Best Social Impact award went to a project built explicitly to make the world a better place. The winning project was the Smart Water Guardian AI, built by KOCHONI Biaou David Barthélémy.

This project puts the edge AI capabilities demonstrated by UNO Q to good use, by monitoring water-quality indicators in real time. Through a host of sensors, it is designed to measure everything from temperature and pH to turbidity and dissolved solids content, allowing for detection of anomalies that correlate with poor water quality – detection that could save lives.

Best in Home Automation

Home automation is a thriving industry, and there are all kinds of tech products you can use to build the smart house of your dreams. But what about your chickens’ house? That’s what Coders Cafe’s Smart Coop 2.0 is for.

Smart Coop 2.0 is a system design, driven by an UNO Q, for intended to support routine chicken care. It is built to handle the basics, like dispensing feed on a schedule and heating the space, using local AI models designed to detect eggs and potential predators. The creator designed Smart Coop 2.0 to make certain chicken-care tasks more convenient and to detect potential predators, including coyotes and foxes.

Best in Gaming

RollerCoaster Tycoon was a popular video game generally among two types of people: those who enjoy creative building and those who like maximizing metrics. Kevin Loeffler is the latter type, and he wondered how real-life roller coasters might stack up. The result is RCT IRL, which is a wearable sensor system for classifying and quantifying roller coaster rides.

“Wearable” here means an UNO Q, a SparkFun 9DoF IMU (inertial measurement unit), and a battery stuffed into a fanny pack. During a coaster ride, the dual-brain board from Arduino is structured to collect movement data through the IMU. Afterwards, three Edge Impulse models are designed to process the data and generate model-based scores labeled Excitement, Intensity, and Nausea. Together with interesting stats like ride time and maximum g-forces, those values populate a report card for the roller coaster, just like in the game.

Best in Industrial IoT

HaloSense V1 is pasquale887’s attempt to give humans new senses via neuroplasticity. In short, neuroplasticity is your brain’s ability to accommodate new functions. Of course, there isn’t anything supernatural or superhuman about that, and your brain can only work with the sensory input it receives. HaloSense V1 provides new information through the senses you already have.

Or, to put it another way, HaloSense V1 is a haptic feedback headset. Through an array of 13 haptic feedback motors, it pulses and buzzes to convey information gathered through sensors connected to an UNO Q. The project is intended to explore whether, over time, a wearer can learn to interpret the haptic patterns as information.

Best in Robotics

We’re in the midst of a shift in robotics towards human-friendly designs. Mohammed Akramuddin’s Curie is engineered to be as friendly as it gets. This little desktop robot is cute, with facial expressions displayed on an OLED screen. The creator designed it to help users, including those with ADHD, manage tasks. 

Like all of the other projects in this competition, Curie contains an UNO Q board. It connects to various APIs, including Groq (a cloud interface that is built to let developers run open-source artificial intelligence models at high speeds), to help its owner manage their workload. It is designed to do that in the usual digital assistant ways, by taking notes and setting reminders, but also by providing more tailored assistance. It can, for example, break a complex task up into small pieces that are more approachable. It is also designed to identify potential distraction and provide a nudge to help users return to their task.

Best in Show

The Best in Show award went to the overall competition winner, regardless of category. The winner was Jorge Eldis González for his work on the Edge-AI Spectrophotometer, which is, as its name indicates, a spectrophotometer that integrates AI on the edge.

A spectrophotometer measures the wavelength of light, in order to detect the properties of sampled materials. That is a non-destructive analysis and can, for instance, tell you if a sample contains contaminants.

The Edge-AI Spectrophotometer is built using commercially available components, using an UNO Q and a SparkFun Electronics AS7343 Triad Spectroscopy Sensor. It then runs a machine learning inference model on the edge, which detects deviations from known baselines. The creator designed the project to make its testing workflow more accessible to less-experienced operators and to explore additional spectrophotometry applications.

Congratulations to all the winners! 

Qualcomm branded products are products of Qualcomm Technologies, Inc. and/or its subsidiaries. Arduino, UNO, and the Arduino logo are trademarks or registered trademarks of Arduino S.r.l.

The post Inside the winning Arduino® UNO™ Q projects from Hackster’s Invent the Future competition appeared first on Arduino Blog.

Read more here: https://blog.arduino.cc/2026/10/29/inside-the-winning-arduino-uno-q-projects-from-hacksters-invent-the-future-competition/

The post Inside the winning Arduino® UNO™ Q projects from Hackster’s Invent the Future competition appeared first on IPv6.net.