Article URL: https://www.telegraph.co.uk/news/2026/08/22/iranian-hackers-shut-down-uk-power-plant/ Comments URL: https://news.ycombinator.com/item?id=49407509 Points: 13 # Comments: 2
This is an AI-generated summary. ShortSingh links to the original source for the complete article.
A web challenge from BrunnerCTF 2026 demonstrated a classic CL.TE HTTP request smuggling vulnerability in a simulated internal wiki application. The target page, /wiki/internal/flag, was hinted at via robots.txt but returned a 403 Forbidden response to direct access. The exploit worked because the front-end proxy honored the Content-Length header while the backend Kestrel server prioritized Transfer-Encoding: chunked, causing the two layers to disagree on where one request ended and another began. By crafting a single POST request containing a smuggled GET for the restricted path, the attacker bypassed path-based authorization middleware that only applied to externally routed requests. The smuggled request reached Kestrel directly on the same keep-alive connection, returning the internal article and the hidden flag.
An independent developer is building CUBELANDS, an early-alpha third-person open-world action-adventure game planned for release on Steam. The game's core design principle is full procedural generation, where a single seed determines terrain, settlements, cultures, characters, equipment, and even boss designs. Gameplay combines exploration, combo-based combat, and traversal mechanics such as gliding, grappling, swimming, and slope-surfing. Combat features charged and aerial attacks, parries, perfect-dodge counters, and multi-phase procedural bosses. No release date has been announced, with the developer focused on refining the world, combat, and presentation before sharing further progress updates.
A developer built a minesweeper probability solver, validated it with 22 unit tests and cross-checked it against a brute-force implementation across 8,000 random boards, finding only floating-point-level differences. After integrating the solver into a playable website, roughly 300 games in, the solver flagged six squares as certain mines when only two actually were. The flaw was exposed by a telling anomaly: the per-cell mine probabilities summed to 13.96 on a board that had only 10 mines remaining, violating the mathematical requirement that those probabilities sum exactly to the mine count. The root cause was a mean-field approximation fallback used when a board component grew too large for exhaustive enumeration, producing estimates that were not true probabilities but were still being treated as certain by the finalize function. The case illustrates how a thorough test suite can miss critical bugs if the specific edge-case inputs that trigger a flawed code path are never exercised.
A developer has released SlackCLI, an open-source command-line binary that allows AI agents to interact with Slack workspaces without requiring a dedicated Slack app or OAuth approval process. The tool enables agents to read messages, search channels, reply to threads, and access Canvas documents by running simple shell commands with structured JSON output. Authentication is handled via a browser-based login that stores session tokens locally on the user's machine, with no data sent externally. SlackCLI is designed to integrate easily with most AI agent frameworks, which typically work best with plain commands and clean, parseable output. The project is unofficial and has no affiliation with Slack Technologies.
Discussion (0)
Log in to join the discussion and vote.
Log in