iot

Google and industry partners dismantled the XCPE botnet, which turned 1.3 million Android TV boxes into residential proxy nodes and could sever access to 10 million more compromised IoT devices. The takedown targeted Chinese manufacturer Videostrong Technology, which shipped malware on its set-top boxes.

Google revealed that one of its Android manufacturing partners, Shenzhen-based Videostrong Technology, secretly built a backdoor into 1.3 million set-top boxes and other Android devices, turning them into a botnet used for ad fraud and malware distribution. Google has dismantled the backdoor, cut ties with the manufacturer, and updated its device review process.

Alex Funk unveils SparkHome, a local AI-powered smart home harness that runs voice agents, IoT control, and AAA game optimizations (via GameSpark for GB10) on a personal device instead of the cloud.

Supermarkets in Belgium, Sweden, Luxembourg and Ireland were hit by a suspected cyber-attack that sabotaged refrigerators and freezers, forcing stores to discard millions of euros worth of food.

Toit v2.0.0 is finally released after over four years of alpha development, marking a stable milestone for the open-source embedded language with broader hardware support, a rewritten package manager, and compiler/runtime improvements.

EMQX reports on a benchmark showing GreptimeDB v1.2.0 achieving 31% higher ingestion throughput than InfluxDB 3.11.1 Enterprise, along with query and storage comparisons relevant to IoT telemetry on EMQX Tables.

FoxIO披露了GoAhead嵌入式Web服务器中三个独立的TLS漏洞：OpenSSL后端未强制执行CRL吊销检查（CVSS 9.1）、LibreSSL旧版验证器可绕过证书链深度限制（CVSS 7.4），以及Mbed TLS后端的DH参数缓冲区错误导致TLS 1.2会话可被解密（CVSS 5.9），影响数亿台IoT、防火墙和工业控制设备，建议升级至6.1.1或更高版本。

"Knock On Wood" is an internet-connected device that lets users trigger a physical knock on a tree remotely via a web app, part of the art series Machines Responding to Superstitions by designers Shashwath Santosh and Nithin Eluvathingal.

Wired reviews the Lykyn, a $300 automated mushroom fruiting chamber with app-controlled humidity, airflow, and lighting, praising its performance as a legitimate grow box while questioning whether a one-to-two week spectacle justifies the price.

WIRED 评测了 Hyve 智能包裹保管箱，认为它能为节日快递提供安全存放点并支持手机通知，但在组装、电池寿命和快递员使用率方面仍存在明显短板。

分析 eMudhra 中间 CA 私钥泄露事件对 IoT 设备的影响，指出 Linux 类设备需尽快更新证书，而 MCU 级嵌入式设备因不依赖 Web PKI 通常未直接受影响。

A beginner-friendly, step-by-step Chinese tutorial showing readers how to use Claude Code or Codex to flash the open-source xiaozhi-esp32 firmware onto an ESP32-S3 development board, then set it up via phone Wi-Fi configuration, bind it to a backend dashboard, authenticate with GitHub, and upgrade the language model for free — turning the board into a desktop AI voice assistant.

With zero commands and zero model costs, the author used DSH (DeepSeek Harness) along with the free DeepSeek V4.1 Flash model to flash a ¥128 Lichuang ESP32-S3 dev board into a XiaoZhi AI speaker. The entire process — looking up the docs, verifying, and flashing the firmware — was handled automatically by the Agent.

Vacuula 是一个开源自托管服务器项目，用于复活并控制已停服的 Neato 扫地机器人（D3-D10 等），支持 Docker、Home Assistant 部署及地图、计划任务等功能。

盘点 GitHub 上 ESP32 生态中最具代表性的 5 个开源项目，包括爆火的 AI 语音项目 xiaozhi-esp32（30.8k 星）、LVGL、Tasmota、WLED 和 ESPHome，覆盖 AI 语音、嵌入式 UI、智能家居改装与灯光控制等场景。

Anthropic reportedly confirmed that small 9B AI models may soon be capable enough to self-replicate on commercial IoT devices, with a 9B model achieving inference on 8 of 9 tested hardware types, marking a milestone for local AI.

Anthropic研究博客探讨小型AI模型是否能在商业IoT设备（如智能烤箱、安卓电视盒）上自主复制运行，实验显示9B模型已在9种硬件中8种上跑通推理，GLM-5.2级别模型可完成端到端复制，预示小型权重复制器可能年内实现。

一场被形容为'前所未有'的网络攻击瘫痪了欧洲多家大型超市的冷藏控制系统，黑客将冰箱温度强制升至50摄氏度并触发自动除霜，同时影响了电子货架标签和配送系统。

深入的安全研究文章，详细讲解了对 Eufy Security 视频门铃及 Homebase 2 基站的逆向工程过程，涵盖远程信号干扰、声音同步协议逆向，以及从闪存转储中提取并解密门铃连接隐藏网络所用凭据的方法。

用户表达了对 ESP32 微控制器即将成为游戏规则改变者的期待与看法。