News from KW42.2025

New week, old tactics: Nine interesting contributions from week 13.10 - 20.10 (KW42-2025) my personal summary as compilation, again two Viewed in detail and provided with more details, across my ‘wews’ world.

Arduino+Qualcomm | LineageOS 23 | IE not dead | BTC vs USA | Chat control | PYUSD 300B Oops | 7-ZIP ZeroDay | Taxi DeadEnd | CleanRoom-RE

---

Article 1

From ‘Blink’ to ‘Think’: Qualcomm takes over Arduino – what's behind the mega deal

Hey Maker, developer and anyone who has ever made an LED light up!

The news has made waves in the open source and maker community: The chip giant Qualcomm Takes over the popular open source electronics platform Arduino. This deal, announced in October 2025, marks a turning point for the world of single-board computers and edge computing.

Here are all the details you need to know about the acquisition, the plans and the future of the craft icon!

The deal at a glance: Who buys whom?

The American chip giant Qualcomm Technologies Inc. intends to take over Arduino S.r.l. Italian company famous for its easily accessible open source hardware and software.

• Receiving company: Qualcomm Technologies Inc.
• Acquired company: Arduino S.r.l.
• Date: The agreement was announced in October 2025. The closing is subject to regulatory approval.
• Purchase price: The exact financial terms of the deal were Not publicly announced.
• Motivation: Qualcomm aims to strengthen its position in the rapidly growing field of Edge computing and Internet of Things (IoT) Strengthening. The acquisition gives Qualcomm direct access to Arduino's vast Developer community from over 33 million active users worldwide. The goal is to provide developers with easier access to Qualcomm's technology portfolio and accelerate the development of intelligent, AI-driven solutions.

What does Qualcomm promise? Is Arduino open source?

Of course, the biggest concern in the community was: What happens to the Open source philosophy by Arduino? Will the Italian company disappear into Qualcomm's corporate structure?

The official line is reassuring, although some in the community remain skeptical:

1. Self-reliance: Arduino as independent subsidiary Qualcomm will continue.
2. Brand preservation: The brand Arduino shall be preserved.
3. Openness commitment: Qualcomm has confirmed that Arduino will continue to free will be in the choice of components for future boards. Also the Arduino IDE and the extensive Program libraries They should remain in place and continue not to exclude the use of chips from other manufacturers.

They try, therefore, to technological expertise from Qualcomm with the The Open Ecosystem by Arduino.

The first product: The Arduino Uno Q – The AI focus

Simultaneously with the acquisition, the partners announced the first joint product demonstrating Arduino's new thrust direction under Qualcomm's umbrella: the Arduino Uno Q.

The highlight: The board combines a powerful Linux-enabled processor (MPU) for more complex tasks (such as AI and graphics acceleration) with a classic microcontroller (MCU) for real-time control – hence dual-brain.

The AI strategy: The Uno Q is directly on Edge AI Applications aligned. A new integrated development environment called Arduino App Lab The goal is to make it easier for developers to access AI models. Close integration with the platform Edge impulses (which also belongs to Qualcomm) is used for training and optimizing AI models.

The community is divided

The tenor in the maker community is mixed. On the one hand, many see an chance By integrating Qualcomm's powerful chips and AI tools that simplify the creation of more complex projects (robotics, machine vision). Connecting to the millions of developers in the Arduino ecosystem is a huge advantage for Qualcomm.

On the other hand, there is skepticism The promise of openness. The focus on the proprietary Qualcomm chip in the first new board and the integration of AI tools built on Qualcomm's ecosystem is causing many to fear that Arduino will be able to open character It could lose over time. The concern is that the simple, cost-effective approach in favor of a Commercialized AI developer tools Move into the background.

It remains exciting how this new chapter will develop for Arduino. The "Blink to Think" era has officially begun!

---

Article 2

LineageOS 23 is here: Do you want your phone back? Here is the solution!

It is official: LineageOS 23 is launched! And not that you get yourself wrong, this is not just a side note for Android nerds in the dark basement.

This is really exciting if you want to do what you want with your phone without Google constantly looking over your shoulder.

What is LineageOS Anyway?

Okay, short explanation for those who have never heard of it: LineageOS is basically Android, but without all the little Google stuff. It is a Custom ROM, a modified version of Android developed and maintained by a large community of volunteers. Free of charge, of course.

Imagine Android wouldn't constantly collect your data, track your apps secretly, and bombard you with annoying ads. This is exactly what LineageOS – Android should have been like.

This brings the new version

After a long wait, the LineageOS team has now officially released LineageOS 23 for download. And yes, the number stands for one thing: It is now based on Android 16. This means that you get all the new features and security updates - just without Google in the neck.

What's new?

The camera app Aperture has been completely rewritten

That was overdue. The new Aperture app is not only faster and more beautiful, but now also supports Ultra HDR and RAW photos. For all the photography nerds among you: This is serious.

The music player Twelve has been refurbished

A new Play Random Songs button, better Jellyfin integration, playback statistics – in short: The player doesn't feel like it did in 2015.

Catapult - the new Android TV launcher

For those who still use their old Android TVs or streaming boxes, there is now a new ad-free launcher. Nice.

Virtualization for Techies

With improved QEMU support, developers and ambitious users can now drive Linux-based virtual machines directly on their mobile phones. Does it sound nerdy? It is also – but damn cool.

Security, security, security

LineageOS 23 integrates security patches from September 2024 to August 2025. A full year of security updates out of the box. Most stock Android devices can't even claim that.

The reality: Google is making it hard for you.

Here I have to be honest: The LineageOS team is struggling with issues that Google is causing them. Google is delaying the release of the source code for Android 16 QPR1 (this is the latest version), which is why LineageOS 23 is based on Android 16 QPR0, the initial version.

It's like coming to a party, and the best features are still missing. But don't worry, once Google releases the source code (and they will), an update rolls out that makes the thing even better.

There is also another problem: Google no longer releases the pixel kernel code. This means that the best support for Google's own phones is currently no better than for other devices. You wouldn't have thought that two years ago, but that's how the world is.

For which mobile phones is LineageOS 23 available?

This is the horny: Officially supported LineageOS 23 builds are available for over 100 devices. This ranges from current Samsung Galaxy models to OnePlus and older Xiaomi devices. In plain language, this means: You can bring your old 2019 phone back to life. The exact list can be found on the official LineageOS website. Your device is there? Congratulations: You can now throw Android 16 at it.

Installation? Not easy, but feasible

Honestly, This requires a bit of courage and a few technical basics. You need to unlock your bootloader, install a custom recovery and flash the ROM. This sounds complicated, and for beginners it's also a bit of a hurdle.

But hey – if you're reading this article, you're probably ready for it. On the web you will find instructions for your specific devices.

Why should I switch to LineageOS?

Do you want your privacy? LineageOS can run completely without Google services. No sync to Google, no Gmail, no Google Drive – nix.

Do you want your old phone to run longer? The community's support network is legendary. Old devices that no longer get updates get love again with LineageOS.

You like Android, but not the bloat? No Samsung crap, no additional apps from Telekom, none of them. Clean, clean Android.

You want full control? The entire source code is open source. You can compile it yourself if you want. You are not dependent on manufacturers or Google.

The dark side

To be fair, I must also say: LineageOS is not for everyone. The installation requires technical know-how. Support is community-based, not guaranteed. And some security features like Project Sandbox or the new privacy restrictions in the latest Android versions may not come with the same depth as Stock Android.

Also: When you rely on Google Play, it gets complicated. You need to install microG or take other detours.

Conclusion: Linux for your phone

LineageOS 23 has become a truly mature adult. It is no longer something that only geeks do – it is a full-fledged alternative to Stock Android, especially if you care about your privacy.

Over 100 supported devices, fresh apps, up-to-date security patches and the freedom to truly call your phone your phone - that's a strong statement.

So: Try it if you dare. The way back is not far if necessary. But I bet many of you won't regret trying.

---

Article 3

Internet Explorer is dead, isn't it? And now it's getting dangerous

Actually, everything should be over by now. Internet Explorer retired in June 2022 after shaping the web for decades. But now it turns out: The old Gaul can be driven out of the browser, but not out of Windows. This becomes a real security problem.

Attackers discover a piece of nostalgia - and exploit it

Since August 2025, cybercriminals have discovered a nasty chain of attacks that is abusing IE compatibility mode in Microsoft Edge. The nice thing about it (from the point of view of the attackers): They use unpatched zero-day vulnerabilities in the ancient Chakra JavaScript engine. And it works damn well.

Wait, IE compatibility mode? Yes, there really is. Edge users can use it to load legacy applications that rely on outdated technologies such as ActiveX or Flash. Originally a practical bridge solution for companies and authorities. It's more of a digital time bomb.

The chain of attack: Social Engineering meets Zero-Day

This is how the stitch works in three steps:

Step 1: The wrong website. Attackers create fake pages that mimic legitimate services. A flyout element will then prompt you to reload the page in IE mode. Sounds suspicious? Yes, yes. But if it looks like a real warning, click on it quickly.

Step 2: Code injection. In IE mode, the attackers use an unpatched vulnerability in Chakra. Remote Code Execution – the malicious code is running.

Step 3: Systemi hijacked. A second exploit then allows the breakout from the browser. The whole system is compromised, the attackers have complete control.

Not exactly elegant, but effective. ⁇

Microsoft's solution: Just don't make it so easy anymore

Microsoft has made an interesting decision. Instead of releasing a dedicated security patch (the company didn't give out CVE numbers for that either), IE mode was simply made inconvenient:

The toolbar button? Away. The entry in the context menu? Away. The quick option in the hamburger menu? Also gone.

If you want to use the IE mode now, you have to activate it manually in the Edge settings (edge://settings/defaultBrowser), explicitly set each individual website to a Allowlist and then restart the browser. Only then does the mode work. Microsoft insists that this detour slows down people so that there is more time to reconsider the decision and phishing attempts are detected.

For large companies, nothing really changes – they can manage IE mode centrally via Group Policy as usual.

The real problem: It just can't be repaired

Honestly, this is an impressive admission: Apparently, even Microsoft considers Internet Explorer to be no longer maintainable. And the risk of more zero-days? Too high. You just seal off the IE instead of patching it.

This illustrates a larger dilemma: What was intended as a temporary solution, namely as a bridge for the switch to modern browsers, has become a real security trap. Companies that rely on ActiveX controls as late as 2025 should take this current warning seriously. The IE is not only dead; It is also a ticking digital time bomb.

---

Article 4

Bitcoin Jesus pays $50 million in taxes and then everything crashes. What's going on?

It sounds like a crypto-soap: While the government is finally touching bitcoin millionaires with velvet gloves, the same government is throwing the market into the basement with a short message. Welcome to the contradictory world of Trump's crypto policy.

The first act: Bitcoin Jesus to capitulate

A week ago it was time: Roger Ver, the early Bitcoin evangelist charged with tax evasion, agreed a deal with the U.S. Department of Justice. Instead of going to court, Ver paid nearly $50 million in fines, compensation, and interest.

Ver was charged with tax evasion in April 2024 and arrested in Spain. The allegation: He had freed himself from US citizenship in 2014, concealing his Bitcoin holdings from the tax authorities. In renunciating his citizenship, Ver would actually have had to pay an exit tax on his Bitcoin. He didn't. Result: A loss to the U.S. treasury of over $16 million in lost taxes alone.

At first glance, this is a classic judicial history: Someone tries to mole, gets caught, pays the bill. But the devil is in the details.

The soft hand of a crypto-friendly government

Here's what's exciting: The agreement with Ver is interpreted as a sign of a more pragmatic and crypto-friendly approach under the current US government. This is in stark contrast to previous administrations that imposed massive sentences and long prison sentences.

Trump has promised this and is apparently delivering. Since January 2025, well-known crypto figures such as Silk Road founder Ross Ulbricht have been pardoned, BitMEX co-founders have been released, and the SEC has dropped lawsuits against major exchanges such as Coinbase. The tone between Washington and Wall Street, uh, between Washington and blockchain, has become much friendlier.

That should make the cryptos happy, right? Wrong thinking.

The second act: The plot twist

Let's rewind before October 10th. Bitcoin had just hit an all-time high of over $126,000. All the lights were green. Trump then posts on Truth Social that the U.S. will impose a 100 percent additional tariff on Chinese goods. Starting November 1st.

This is a bombastic announcement from a global perspective. From a crypto perspective, it was a nuclear strike. Within 24 hours, about $19 billion of positions in cryptos were liquidated, which is arguably the largest liquidation wave in the history of the market to date. Bitcoin fell from over 117,000 to under $110,000 within hours, a crash of over 10 percent in just a few hours.

Bitcoin, which just seemed like the star of a bull run series, was depressed by a single short message by thousands of dollars. Other cryptos had it worse: Ethereum, XRP and Solana crashed by 15-30 percent.

This is not just market volatility. This is suspiciously targeted.

The uncomfortable suspicion: Market manipulation by announcement?

It's getting tricky here. The question that many market observers ask: Was it a mistake or strategic?

On the one hand, Trump himself has crypto friends in his inner circle. People who hold Bitcoin and also trade in other crypto-assets. Would he deliberately let the market collapse, which he wants to promote? That makes little sense.

On the other hand: The liquidations were so huge that exchanges automatically closed profitable positions just to reduce uncertainty. This phenomenon is called auto-deleveraging. Such a shock mainly affects those with leveraged positions, i.e.: Traders who have speculated on credit.

For large institutional investors, it was more of a buying opportunity.

So what happened? Theories:

Theory 1: Accidental market manipulation. Trump tweeted something at an unfavorable time, without understanding that the crypto market is so sparsely populated, that such a shock causes extreme distortions.

Theory 2: Tactical manipulation. Someone in the environment would have known exactly when the tariff announcement was coming and had built up corresponding short positions. Then you could make a nice profit.

Theory 3: Geopolitical distraction. Lighting fog candles is a program in the orange house. The Tariff announcement should signal to China that the U.S. is serious and the side effect on cryptos was simply friendly-fire.

Whatever the case is: A market that hits so wildly by an announcement is not a healthy market.

The bigger dilemma: Friendly and risky at the same time

The whole thing reveals a fundamental problem for the crypto industry. They are being courted by a government that is crypto-friendly – fantastic for long-term legitimacy. But the same government also shows how sparsely populated cryptos are and how easily externally generated shocks can throw the whole market into chaos.

The irony: While Roger Ver gets away with a grace period and the SEC drops its lawsuits against exchanges, it turns out that cryptos are far from ready for the big game. A few Tariff tweets and $19 billion evaporate. This is not the robustness needed for real financial stability.

What's left?

The case of Bitcoin Jesus shows a new twist: The government signals pragmatism and less confrontation. This is positive for industry in the medium term – if rules become clearer and not constantly changed.

But the tariff crash also shows: With this kindness comes the risk of manipulation. A market hit so hard by political announcements is still a risky playing field for fintechs and institutional investors.

Conclusion: Crypto just got a government girlfriend. But that doesn’t automatically make cryptos safer – it sometimes only makes them... more mature at recognising their own vulnerabilities.

---

Article 5

Update on planned eventless mass monitoring of all chats

State of play on the EU decision With regard to the so-called Chat control (Regulation on preventing and combating child sexual abuse, the CSA Regulation) is that the plans Stopped for the time being But the debate continues:

State of play (15 October 2025)

1. Voting postponed/stopped: The vote in the EU Council on the draft regulation scheduled for mid-October 2025 (14 October) has been cancelled or postponed. A qualified majority among EU Member States for the current proposal could not be achieved.
   
2. Role of Germany: Germany's "no" was decisive. The SPD-led Federal Ministry of Justice (BMJV) publicly opposed the draft on 8 October 2025, declaring that Germany would not agree at EU level because the plans violate fundamental rights.
   
3. Next steps: However, the danger to the critics is not definitively banished. A new vote or discussion on a possible compromise proposal is already in place for: Early December 2025 (Partially the 6th/7th. December) is planned.

The core issues of the controversy

• Purpose: The draft aims to combat sexual violence against children (CSA material) more effectively.
  
• Proposed actions: The proposal envisages requiring communication service providers (such as WhatsApp, Signal, etc.) to include all private messages, photos and videos of their users. automated and uninitiated search for suspicious content (so-called Client side scanning), often before the messages are end-to-end encrypted.
  
• Criticisms: Data protectionists, civil rights organisations (such as GFF, CCC) and companies (such as Signal) see the planned chat control as a massive and disproportionate interference with fundamental rights (privacy, letter and telecommunications secrecy) and the end of secure, end-to-end encrypted communication. In addition, the scanning technology used is criticized as prone to errors. The messenger service Signal has announced that it will leave the European market should chat control come in this form.

In summary, one can say: Mass surveillance without cause has been averted by resistance from Germany and other states for the time being, but legislative procedures in the EU will continue in December 2025.

---

Article 6

Crypto Oops! $300 trillion, and then they were gone again...

Imagine: You're sitting by the coffee, and suddenly there's 3x as much extra money on the market as the entire global economy gives. None of this is real. And in 22 minutes it'll be quiet again. This is the story that shows how fragile the crypto infrastructure really is.

The perfect ‘fat finger’ disaster

It was Wednesday, October 15, 2025, shortly after 19:12 UTC. Paxos, PayPal's blockchain partner, made an entry in the creation of new PYUSD stablecoins. It should be 300 million. It was $300 trillion.

We're talking about $300,000,000. For comparison: The total world GDP is about $117 trillion. There are about $2.4 trillion in physical US dollar cash worldwide.

Paxos had accidentally added six extra zeros. It's not just a number turner. This is a "turn-by-turn-the-total-wealth-of-humanity-by-tenfold" error. Oops!

How can this happen? Seriously?

That's the question everyone asks. A stablecoin is a promise: For every PYUSD we spend, we have a real dollar somewhere in the bank. That's the whole idea.

Paxos advertises with the slogan ‘fully covered by US dollar deposits, US Treasury bonds and similar cash equivalents’. A big promise. A promise that just went spectacularly wrong.

The problem: There are no control mechanisms that prevent a lot of tokens from being issued that are not covered. Minting (the creation of new tokens) is not tied to actual reserves. That's the deeper problem.

Other blockchains and token systems have long since developed solutions for this: Decentralized audit mechanisms, multi-stage approval processes, automatic limits. Paxos is not. Or not effective enough.

An intern who missed a decimal point? A database error? This is not yet clear. Paxos just said: ‘Internal technical error’.

What does this mean for credibility?

That is the core problem. When such a disaster happens to a large stablecoin issuer, even if it has been quickly remedied, it raises serious questions:

How can we trust these systems?

A stablecoin should be the opposite of Bitcoin or Ethereum – precise, trustworthy, not volatile. It's basically the promise: "This is as safe as bank money." And then Paxos accidentally uploads $300 trillion.

Martin Köppelmann, founder of wallet company Gnosis, said it aptly: "That's really not good if you do the decimals wrong when minting stablecoins and haven't established processes to detect that early on."

This is a diplomatic understatement. This is a disaster for trust.

The 22-minute solution: Token burning

Now the good news (relatively speaking): Paxos recognized the error and fixed it. After about 22 minutes, all 300 trillion PYUSD tokens were gone again.

How? By token burning.

This is how it works: Paxos sent all 300 trillion tokens to a wallet address that no one controls -> so they are technically ‘inaccessible’. These tokens are permanently withdrawn from circulation, deleted, destroyed. Away.

This is the opposite of minting. And it is why Paxos, as a stablecoin issuer, has the ability to do that in the first place – as opposed to decentralised coins like Bitcoin, where such a thing would be impossible.

This is why burning is so important: Stablecoin issuers have centralized control. This is usually a bad thing when it comes to decentralization. But in this case, it was the rescue: You could just undo the mistake.

The entire transaction? Cost just $2.66 in Ethereum fees. $300 trillion burned for less than one espresso.

The DEX Aave also froze PYUSD trading for a moment until it was clear that everything was back to normal.

A precedent

This is not the first time such a thing has happened. In 2019, Tether accidentally spent about USD 5 billion – and later burned the surpluses. Also there: Fat finger error, quickly fixed.

But the frequency should make you think. These are not isolated individual cases. These are patterns that show: These systems are sparsely populated.

The bigger picture: Why This Is Dangerous

This is where it gets serious: Paxos is trying to get a national trust charter from the U.S. regulator OCC. That would mean: legal permission to do business nationwide.

And this company appears to be able to perform external transfer mining, inadvertently incurring $300 trillion without any automatic backups.

This is the problem that is emerging: Crypto infrastructure is regulated and normalized faster than it is actually ripe for it.

Stablecoins should be one thing: stable, safe, reliable. Like bank money. And instead, we regularly see technical flaws that undermine all trust.

What's left?

Technically, it was a non-history – everything was done in 22 minutes. No hackers, no manipulation, no lost customer money.

But for credibility? That was a big hit. Paxos and PayPal must now explain how they will prevent such errors in the future. Automatic limits? Multi-layer approval processes? Decentralized proof-of-reserve mechanisms?

So far: Radio silence. A short statement on X, then calm down.

Conclusion: $300 trillion, visible on the blockchain for an hour, then gone. It is a perfect metaphor for the contradictions of cryptos: On the one hand transparent and visible to all, on the other hand fragile enough to make such mistakes. And this in an industry that is built on trust.

That should make us all think.

---

Article 7

BSI warns of 7-Zip gap It is actively exploited. Be sure to update!

The problem: 7-Zip had two high-level vulnerabilities (CVE-2025-11001 and CVE-2025-11002) that allowed attackers to execute malicious code via manipulated ZIP archives.

What happened: The gaps were 2 May 2025 reported, but only on 7 October Over five months, millions of users were unknowingly vulnerable.

The solution: Version 25.00 from July 2025 fixes the bug, current stable version is 25.01.

The problem with this: 7-Zip does not have an auto-update mechanism. Many users use outdated versions and will never update, although it would only require a simple reinstallation.

For you: Update immediately to version 25.01 from the official website. And be careful with ZIP files from unknown sources until you've updated.

CVSS score: 7.0 (High) Exploitation only requires you to open a malicious archive.

This 7-Zip vulnerability means: Time to update! Let's go!

---

Article 8

Robotaxi prank in San Francisco: 50 Waymos ordered in dead end. Is AI mastering chaos?

Funny article for the weekend which I read on Golem.de:

San Francisco, 16 October 2025 An unusual incident caused a stir in San Francisco when a ‘prankster’ named Riley Walz and his supporters played a prank on 50 Waymo robotaxis. They specifically ordered the autonomous vehicles into a dead end at the Coit Tower in order to provoke a traffic chaos.

The plan to gather as many robotaxis as possible in one place led to a traffic jam in the narrow street, but Waymo's reaction apparently prevented worse. Walz himself stated that Waymo “responses well in the situation” I have. The company quickly noticed the mass order and stopped service in an area of two lanes around the dead end until the next morning to defuse the situation.

Waymo later explained that the company is continuously optimizing its distribution system and automatically introducing limits on many orders within a given area to prevent even greater chaos. Mass orders are not uncommon near attractions or venues.

For the unused rides, Waymo charged the fun birds a fee of five US dollars per robotaxi. Walz emphasized that during the action, care should be taken not to disturb uninvolved parties as much as possible.

---

Article 9

Reverse engineering: This is how fans bring old games like BioForge and Diablo to life

Great reading fun for Sunday on heise.de, but in the heise+subscription: The loss of the original source code of many computer games from the 80s and 90s poses a major challenge for enthusiasts. Since the developers at the time rarely attached importance to archiving, many games for modern operating systems are lost.

Reverse engineering as a solution:

• Principle: By analyzing the existing program files (often using assembler) and studying documentation or even old journal articles, the functionality of the software is decrypted and the game is rebuilt from scratch.
  
• Benefits: The replica makes it possible to play the games in higher resolutions, with Improved graphics and modern control system to make it playable on current systems (Windows, Linux, macOS, consoles). In contrast to emulators, basic errors of the original can also be fixed.

Examples of success:

• „OpenBioForge„: Australian developer Tim Comport built the floppy but technically groundbreaking action adventure BioForge (1995) completely. He had to decrypt proprietary file formats and replaced the original renderer with OpenGL, which makes the game more fluid and detailed today.
  
• „Devilution“ (Diablo): The action role-playing game Diablo (1997) could be completely reconstructed by reverse engineering thanks to a combination of lucky coincidences such as debug information in the Japanese PlayStation version and an older debug executable of the PC version. The open source engine Devilution This enabled porting to modern platforms such as the Nintendo Switch.

Legal challenge:

In order to avoid copyright infringement, these projects work according to the so-called Clean room procedure. It only analyzes how it works and rewrites the code; Copyrighted content (such as graphics and sound files) must continue to be provided from the original game.

You want to imitate this? Legal advice is highly recommended to developers.

---

This week Sun-Tsu is on vacation, so unfortunately we have to give up his wisdom, but don't worry, he will come back, no question!

‘Who turned the clock? Is it really that late? That is to say, yes, you lieutenant’, the article is over for today’.’