Dev Breakfast · 2026-09-09
Today's headline: Stuxnet source code reconstructed on GitHub: 14 commits reconstruct the cyber weapon. Plus 7 more: PostgreSQL 19 enters beta: attribute graph queries finally come; 10 models running the same Three.js task: the gap is bigger than you think; and more.
The Stuxnet source code has been reconstructed and placed on GitHub by Sadpainy, with 14 commits breaking down the complete chain from the LNK vulnerability to the PLC payload, and it has garnered 111 stars. My first reaction is: this isn't teaching; it's clearly handing a visible knife to script kiddies worldwide.
Stuxnet source code reconstructed on GitHub: 14 commits reconstruct the cyber weapon
The Stuxnet that set back Iran's nuclear program by several years in 2010, its source code has recently been reconstructed and placed on GitHub by a developer named Sadpainy under the guise of "educational research." The repository has 111 stars and 13 forks, with the code split into 14 commits by module, from the USB-spread LNK vulnerability to the final payload that tampered with PLC frequencies, all laid out neatly.
First, clarify: this is not the original leaked source code, but a "reconstructed version" based on reverse analysis by the security community back then. The author repeatedly emphasizes in the README that the code is for academic research, malware analysis, and defensive research only, not deployable weapons. But the GitHub copyright notice can't hide one thing—for the first time, ordinary people can read line by line in a browser the core logic of the first digital weapon.
The repository breaks down Stuxnet into modules you can understand: winsta.exe is the entry dropper, responsible for initial infection and privilege escalation; ~WTR4132.tmp exploits the Win32k.sys vulnerability to gain system privileges; s7otbxdx.dll replaces Siemens Step 7's original DLL, intercepting communication between the engineering software and the PLC; mrxcls.sys and mrxnet.sys are two kernel drivers responsible for hiding files and P2P propagation; finally, s7plcmain does the dirty work—tampering with OB1/OB35 blocks to make the frequency converter rotate at abnormal frequencies, physically destroying the centrifuge rotors.
The entire execution flow is clearly illustrated in the README: first, it scouts the environment, confirming that Siemens WinCC and Step 7 are installed on the target machine, and the PLC model is S7-315 or S7-417, before proceeding; if it's not a target, it self-destructs immediately. Once a target is found, it injects the DLL, intercepting the s7blk_write function, and when the engineer downloads the project to the PLC, the malicious code quietly attaches to the OB1/OB35 blocks. This is how the centrifuge rotors got broken—not hackers showing off, but precise physical destruction.
For those who want to analyze it themselves, the repository provides build instructions: on Windows, use Visual Studio 2019/2022 or mingw-w64, with the target system being Windows XP/7 (due to driver compatibility requirements), and kernel drivers need WDK 7600. It's recommended to use a VM with Host-Only networking, disconnected from the internet, and load the DLL and sys files with IDA Pro, Ghidra, or x64dbg, using ProcMon to monitor behavior. The prerequisite is that you really know what you're doing—running this code isn't just about a blue screen, but whether you can cleanly extract yourself from the internal network.
Comparing Stuxnet to today's attack techniques, the most striking thing isn't the technology, but the restraint. In 2010, Stuxnet used four zero-day vulnerabilities, but its propagation mechanism was restrained to only target specific PLC models; today's ransomware wishes it could use one vulnerability to hit the entire network. Stuxnet was a precision-guided missile; today's attackers use shotguns—this is the most ironic evolution direction in cybersecurity over the past fifteen years. Back then, security teams worldwide stayed up all night reverse-engineering Stuxnet to understand how it bypassed air-gapped networks, but now the public source code gives blue teams the most complete detection sample library.
For those who write code, after reviewing this source code, the most important thing to remember isn't how a specific DLL hooks, but how it destroys the "engineering software trust chain": malicious DLLs replace Siemens' official DLLs, and when engineers click "download to PLC" on their own computers, they're actually downloading the attacker's altered logic. Today, if you've used any package manager like npm, pip, or Maven, you should understand how close this trust chain attack is—except Stuxnet's target was centrifuges, and yours is the production environment.
Sources:
PostgreSQL 19 enters beta: attribute graph queries finally come
PostgreSQL 19 has entered beta, with an expected release in September or October 2026. The headline feature is SQL/PGQ—the attribute graph query part of the SQL:2023 standard. Previously, to query friends of friends, you had to write self-joins manually; now you can declare an attribute graph on existing tables and use patterns like GRAPH_TABLE and -[...]-> to write queries directly. The key point is that it hasn't introduced a new execution engine; GRAPH_TABLE will be rewritten to ordinary relational queries, so the planner, statistics, and index choices are still the familiar ones. One limitation to note upfront: this first version doesn't support variable-length paths; syntax like -[IS follows]->{1,3} will be rejected, and each hop must be written explicitly.
Two other features worth trying: the FOR PORTION OF clause allows UPDATE and DELETE to operate on only a slice of a range column—a price record valid for the entire year, you only change the July segment, and it will automatically split it into three, keeping the unchanged periods at the original price. There's also INSERT ... ON CONFLICT DO SELECT, which solves an old problem with DO NOTHING: conflicting rows wouldn't appear in the results, making it hard to distinguish "already exists" from "not inserted." Now DO SELECT can return the existing rows as-is, and with techniques like FOR UPDATE and xmax = 0, you can distinguish which are truly inserted and which conflicted. If you maintain tables with historical versions or have been burned by upsert semantics, these are worth trying on beta 3.
The article is based on official release notes and source code, with each example running on beta 3 released on 2026-08-13, and outputs are real results, not theoretical projections. If you want to try it out early, you can pull an instance now—after all, waiting for the official release to discover that variable-length paths aren't supported would mean going back to writing self-joins, which would be awkward.
Sources:
10 models running the same Three.js task: the gap is bigger than you think
Someone tested 10 model and tool chain combinations on the same Three.js task, and the results are all posted. This directly relates to your code writing: with AI-assisted coding, choosing the wrong combination might cost you several times more time in debugging. Don't just look at the model's fame; the influence of the harness (calling method) is often underestimated. Before switching tools, take a look at this comparison to avoid pitfalls.
Sources:
Engrim: Add local SQLite memory to AI CLI, data stays on the machine
Anyone who writes code knows how frustrating it is when AI assistants can't remember the last conversation. Engrim, a new project, aims to solve this: it adds a local-first SQLite memory engine to AI CLI tools, storing data on your own machine without sending it to the cloud. For those who care about privacy and are tired of re-explaining context every time, this direction is worth a glance. The project just appeared on Hacker News and is still in early stages; to use it, you'll need to tinker yourself.
Sources:
Qwen3.8 27B quantization benchmark: 4-bit is stable, 1-bit collapses
Someone ran benchmarks on various quantizations of Qwen3.8 27B, and the conclusion is clear: 4-bit precision is basically preserved, fine for daily use; but don't expect anything from 1-bit, as the model's performance completely collapses. For those looking to save VRAM to run large models, this is a practical reference—4-bit is the sweet spot for cost-performance, and squeezing further requires weighing the losses. Anyone who has experimented with quantization deployment knows that the VRAM saved and quality lost at each level are never linearly related; this benchmark at least provides a clear lower limit reference.
Sources:
1990s CA's RSA key successfully factored
A researcher announced factoring the RSA key of a certificate authority from the 1990s. Key lengths back then were generally short, 512 bits or even lower, which can now be brute-forced with ordinary computing power. Does this affect you? It depends on whether you still trust those old certificates—if your system still has root certificates or old key pairs from the 1990s, it's recommended to check the revocation list promptly. The good news is that modern CAs no longer use keys of this length; this is more like a verification of historical cryptographic boundaries than a direct threat to current security. However, it reminds us: key length isn't a one-time thing, and Moore's Law will settle the score.
Sources:
D2 author posts two updates: TALA open-sources, project goes non-profit
Two messages from the same author are connected. The TALA open-source post received 220 upvotes on Hacker News, and the D2 going non-profit post got 51 upvotes. TALA is the layout analysis tool the author made for D2, and now the code is out; D2 itself has announced it will be operated as a non-profit organization. For you, if you're using D2 for diagrams, going non-profit means the project governance will change, but no need to panic in the short term; if you're interested in analysis tools like TALA, the source code is now available. Both are worth clicking through to the original post, especially the open-source one, where the author explains the choice of direction in the comments.
Sources:
Kimi K3 2.8T runs on MacBook: four SSDs for 1 token/s
Kimi K3, a model with 2.8T parameters, has been stuffed into a MacBook Pro—using four SSDs for streaming inference, with the trade-off being a speed of only 1 token/s. You read that right, one token per second; typing "hello" takes several seconds. This project is called DeltaFin, from Argonautlabs, and has already accumulated over 170 points on Hacker News. For programmers, the value of this isn't practical, but in verifying a concept: can ultra-large models that don't fit in VRAM be handled by relying on NVMe bandwidth? 1 token/s is obviously too slow for work, but if you happen to have idle SSDs and want to experiment with the limits of "model paging," this is an experiment to watch. Don't expect it to replace cloud APIs; as a toy for research, it's quite interesting.
Sources:
Do you dare use this reconstructed source code in your own industrial control defense exercises? Dare to use it as a target range, or only dare to treat it as a story? See you at 8 AM tomorrow.
This issue selects 8 out of 64 pieces of information from X / Hacker News / GitHub Trending in the past 24 hours (written hourly throughout the day, fact-checked and compiled in the morning). Content is generated with LLM assistance, each with original source links, please cross-verify for important decisions.
Like this brief? Get tomorrow's by email
Each morning at 8:00, 5-10 hand-picked AI items in plain language, with full context.
This page is auto-generated by LLM aggregation; please cross-check with original sources.