Aggregator

Физики доказали невозможность технологии, которую ещё недавно считали перспективной.

Спасти данные не помогут даже изолированные резервные копии.

很长一段时间没有写博客了，难得工作上不忙了，周末也不用加班了，终于有时间来整点活写点东西了。

上周我去洛阳看了许嵩的演唱会，时隔 15 年终于在线下见到真人了，也算是圆梦了。这次掐点在大麦刷了十多分钟，成功抢到了内场 ￥1618 的 VIP 票。

演唱会现场我一开始还是比较拘谨地坐着的，直到演出开始灯一关，第一首新歌《皮下》直接爆了，我都没想到自己会这么激动，全程大声跟唱+挥荧光棒，不知道有没有影响到两边坐着的小姐姐，至少我觉得自己是完全赚回票价了。😄

现场演出的舞台和灯光都很棒，许嵩现场的唱功也很好。但由于花车巡游是在舞台两侧的，反而看台的座位更有性价比些。

跟前几年在上海看邓紫棋演唱会，荧光棒拴在椅子上不同的是，这次许嵩演唱会的荧光棒是可以带走的。后来还发现有人在闲鱼上批量卖现场的荧光棒，一根就卖 20 来块。

忒修斯之荧光棒

我在演唱会结束回到酒店时，手里的荧光棒就已经不亮了。在小红书上看到有很多教人重新点亮荧光棒的笔记，大致思路都是拆开后给里面焊上一个开关或者其他的板子。我寻思这不就是个“忒修斯之船”嘛，把荧光棒里面的东西都换了，就保留个灯泡和外面的演唱会贴纸，实际上已经不是原来的荧光棒了。

我并不喜欢这种拆解改造的办法（实际是因为我没有电烙铁这些工具），想着有没有更优雅的办法来解决，一顿搜索后找到了 「✨ 荧光棒复活计划」 https://github.com/HansZ8/EncoreLightSticks 这个项目，该项目通过控制射频发射模块，发射出与演唱会现场相同的信号，直接点亮荧光棒。

作者还十分贴心地亲自写了介绍文档，提到演唱会荧光棒场控使用 433MHz 射频 (RF) 控制，编码方式为曼彻斯特编码 Manchester Encoding，我上次看到这个编码还是在 HGAME 2018 的 Misc 题里。数据包的控制数据里带有 R、G、B 三种颜色通道的值，每个通道支持 4 档亮度调节，通过调节 RGB 的档位数值来控制荧光棒的颜色。

作者举例的数据包编码是采样自陶喆 Soul Power II 2024 演唱会，当时的硬件版本是 LED17_V5.6.3 2024.05.17，而我拆开许嵩演唱会的荧光棒，里面板子印着的版本号是 LED17_V5.6.31 2025.04.02。我还挺担心版本不一致导致数据包格式不同。

华强北的力量

我想着要不买来硬件试试复用下陶喆演唱会的荧光棒信号，要是成功了就是血赚，不成功的话我准备后面以此为理由买个 Flipper Zero 去现场录信号哈哈哈。

作者仓库里是使用 Arduino 来实现的，问了下 Grok，说是也可以用树莓派的 GPIO 接口来做，刚好可以把我家里吃灰的树莓派给用上。Grok 提到需要额外准备的硬件如下：

1. 母对母杜邦线若干根
2. 433 MHz 发射模块
3. 433 MHz 弹簧天线

上淘宝搜了下，不得不佩服华强北这么多年的努力，把这些电子元器件的价格给搞得这么低。

40 根杜邦线只要 2 块钱，还包邮！我都不知道商家怎么赚钱。实际上我们只需要用到 3 根就够了。

433 MHz 发射模块如下图所示，分为单发射、单接收、发射和接收三种，我们买单发射的即可。买 2 个只需要 ￥3.8，也是跟不要钱一样。

然后我们需要给发射模块插上天线，Grok 说拆一根杜邦线剥去外皮就能当天线，但我寻思反正天线也不值钱，豪掷 ￥1.6 包邮买了 10 个弹簧天线。🤣

综上，我们最终的成本不到 8 块钱。（树莓派除外哈，本来就是家里有的东西

动手试试

荧光棒拿回家后，电量基本都耗尽了。电量不足的荧光棒无法正常响应接收到的发光信号，我们需要先换电池。

拆开荧光棒发现里面自带的电池是不知道什么杂牌的“旭牛电池”，尺寸像是 7 号电池。但这里有个坑，你会发现市面上正常的 7 号电池都尺寸偏大，放不进去，强行硬塞的话会被两侧的弹簧弹出来。 最后我是保留了一个原装的电池，两边各塞了一个自己新买的 7 号电池，勉强将盖子盖上了，荧光棒也有电了。

如果你在后续测试过程中，发现荧光棒在指定颜色与蓝色之间闪烁，那可能就是快没电了，得尽快换电池。

然后开始准备硬件。

首先将树莓派关机并断电。（这一步很重要！我的上一个树莓派就是我带电接线然后给烧坏了）

拆出三根杜邦线，将发射模块与树莓派 GPIO 相连，我这里使用的是树莓派 3B+：

模块 树莓派 DATA 物理针脚 11（GPIO17） VCC 物理针脚 2 或 4（5V） GND 物理针脚 6（GND）

然后将我们的弹簧天线拿出来，插入发射模块左边中间的孔中，稍微弯折一下固定住即可。如果有条件的话，最好用电烙铁焊上去。

万事俱备，树莓派接电开机！

SSH 登录后，执行如下命令：

sudo apt update sudo apt install -y python3-pigpio pigpio sudo pigpiod

然后将荧光棒放到发射模块旁边，就可以在树莓派上跑 GPT 写的神秘小 Python 脚本了。

脚本链接：https://github.com/wuhan005/LightStick/blob/master/lightstick.py

python3 lightstick.py --r 255 --g 0 --b 0 # 红色 python3 lightstick.py --r 0 --g 255 --b 0 # 绿色 python3 lightstick.py --r 0 --g 0 --b 255 # 蓝色 python3 lightstick.py --r 255 --g 255 --b 0 # 黄色 python3 lightstick.py --r 0 --g 0 --b 0 # 关灯

如果步骤都正确的话，你会发现荧光棒真的亮起来了！

我后面又 Vibe 了一个网页，可以更加方便的控制调节颜色，真是太帅了！

以上所有微小的工作，均已开源至 wuhan005/LightStick

最后说几句

说实话，一开始我是没抱希望能点亮的，没想到最后居然成功了。我也给上面的荧光棒复活计划仓库提了 PR，贡献了本次许嵩安泊猜想演唱会的荧光棒信息。（注意上传图片要去除 EXIF 信息哦，GitHub 默认显示原图，另外一个 issue 里的老哥定位信息就这样在上传图片的 EXIF 中泄露了）

现如今 AI 越来越强大，我已经很难找到可以拿来写博客的题材了。基本上都是一句话，AI 就实现完了，没有跌宕起伏，没有了以前自己踩坑的过程与心得，也就没办法沉淀出一篇文章了。虽然本文的所有代码都是由 AI 编写，但硬件都是我自己下单购买，自己组装的，这些涉及到与物理世界交互的流程，AI 目前还无法干预。我也就能从中有所感悟或体会。

最近在工作中有不少 AI-Friendly 或者 AI Native 相关的建设，我个人倒是偏向于 AI 躺平派 —— 现阶段啥额外的优化都不用做，反正过几个月模型能力提上来了，问题自然就解决了。那些所谓的 Skills、MCP、Harness，反倒成为了更强大的模型的累赘。

说回演唱会，洛阳当地的消费确实比上海低多了！每天在市区里到处打车，一次只要 3-4 块钱。不过洛阳的很多景点建筑其实都是十多年前重建的，并不是啥历史文物，仅适合拍照出片。但洛阳好吃的确实太多了，小街天府的担担面，牛肉汤，大盘鸡，还有我最喜欢的洛阳烤鲶鱼。我至今还怀念洛阳烤鲶鱼的味道，回来发现上海这边的烤鲶鱼都是重庆风味的，并不是洛阳那种烤完会撒上糖粉提鲜，口感微甜的风味。真的真的太好吃了。下次如果还有机会，一定得再去一趟洛阳吃一次烤鲶鱼。

Zero Trust Network Access (ZTNA) anchors 2026 cybersecurity amid remote, cloud, and hybrid booms. ZTNA solutions aren’t hype—they’re vital for data locks, compliance wins, and borderless teams. “Never trust, always verify”: ZTNA okays only vetted users/devices, location-blind. Shrink attack planes, block lateral creeps, master app gates. Market clutter and threat flux complicate picks. We rank […]

The post 10 Best ZTNA Solutions (Zero Trust Network Access) In 2026 appeared first on Cyber Security News.

A vulnerability, which was classified as problematic, was found in JeecgBoot up to 3.9.3. This vulnerability affects the function exportXls of the file jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/llm/controller/AiragModelController.java. Such manipulation of the argument credential leads to improper access controls. This vulnerability is referenced as CVE-2026-86228. It is possible to launch the attack remotely. Furthermore, an exploit is available. You should upgrade the affected component.

Currently trending CVE - Hype Score: 1 - In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound ...

Currently trending CVE - Hype Score: 8 - Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to ...

Currently trending CVE - Hype Score: 8 - Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to ...

Submit #898368 / VDB-399381

A vulnerability, which was classified as problematic, has been found in valkey-io valkey up to 9.0.5/9.1.1. This affects the function kvstoreGetHashtable of the file src/kvstore.c. This manipulation of the argument didx causes out-of-bounds read. The identification of this vulnerability is CVE-2026-86227. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. To fix this issue, it is recommended to deploy a patch. Exploitation requires cluster mode plus attacker-controlled dump.rdb at startup (data-dir write access, replication feed, or a stored crafted RDB) - an attacker-position DoS at boot, not network pre-auth. The issue report was closed stating it "is worth fixing for the sake of memory safety… but I don't think it meets our bar for a security disclosure."

A vulnerability classified as problematic was found in Projectwolds Online Attendance System 1.0. Affected by this issue is some unknown functionality of the file profile.php. The manipulation of the argument email results in cross site scripting. This vulnerability was named CVE-2026-86226. The attack may be performed from remote. In addition, an exploit is available.

Реальные масштабы вторжения оказались значительно шире официальных отчётов.

Submit #897659 / VDB-399380

AI 正在把所有硬件重新做一遍，这周轮到了一把牙刷。

Submit #898328 / VDB-399379

A vulnerability classified as critical has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is the function mysqli_query of the file /admin/modal_add_room.php. The manipulation of the argument room_name leads to sql injection. This vulnerability is uniquely identified as CVE-2026-86225. The attack is possible to be carried out remotely. Moreover, an exploit is present.

A vulnerability described as critical has been identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is the function mysqli_query of the file /admin/modal_add_product.php. Executing a manipulation of the argument fname can lead to sql injection. This vulnerability is handled as CVE-2026-86224. The attack can be executed remotely. Additionally, an exploit exists.

A vulnerability marked as critical has been reported in SourceCodester Class and Exam Timetabling System 1.0. This impacts the function mysqli_query of the file /admin/modal_add_coursea.php. Performing a manipulation of the argument course results in sql injection. This vulnerability is known as CVE-2026-86223. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

A vulnerability labeled as critical has been found in SourceCodester Class and Exam Timetabling System 1.0. This affects the function mysqli_query of the file /admin/modal_add_course2.php. Such manipulation of the argument course leads to sql injection. This vulnerability is traded as CVE-2026-86222. The attack may be launched remotely. Furthermore, there is an exploit available.

A vulnerability identified as critical has been detected in SourceCodester Class and Exam Timetabling System 1.0. The impacted element is the function mysqli_query of the file /admin/modal_add_course1.php. This manipulation of the argument course causes sql injection. This vulnerability appears as CVE-2026-86221. The attack may be initiated remotely. In addition, an exploit is available.