Skip to main content

Posts

NeuroCW On-Air Test: Reading Weak, Fading CW Off a KiwiSDR (Test Build)

TEST BUILD. This is an early, in-development model (test build), not a finished product. Everything below is a real experiment with honest mistakes shown as they happened. Results are a snapshot, not a benchmark. Watch the ~5:36 test. The interesting part starts around 4:18 on the right-hand track. 1. The test, in one line I pointed NeuroCW at a live web receiver and fed it weak, fading signals on 40m. The question was simple: when a signal nearly disappears into the noise, can the model still read the callsign a human ear struggles to hear? Figure 1. KiwiSDR in Chichester, UK, tuned to the 40m CW band. The audio was routed into NeuroCW through a PC loopback. 2. Setup Item Detail Receiver KiwiSDR, Chichester, UK (public web SDR) Band / mode 40m, CW mode selected Audio path Browser audio → PC loopback → NeuroCW Model Test build / early model (not a released version) Signal level App showed SNR fluctuating roughly from the mid-teens to high-20s dB, with d...
Recent posts

NeuroCW (Part 2): Call for Real On-Air CW Recordings — Help Build the First Real-Air Benchmark

Call for data: real received CW recordings (WAV/FLAC) + a 100% verified transcript . Email kd8cec@gmail.com , subject "NeuroCW data" . Figure 1. Everything NeuroCW learned came from the bottom panel: a simulated channel. Now it needs real signals. 1. Why real data In Part 1 , NeuroCW scored 5.07% CER on synthetic tests, but its accuracy on real on-air signals hasn't been measured. Just two real recordings were enough to expose a blind spot: Figure 2. On a synthetic heavy-weight keying test, one targeted fine-tune cut the error from 13.4% to 0.1%. Verified real recordings would turn findings like this into a benchmark. 2. What we need Figure 3. Checklist for one submission. 3. How to contribute Figure 4. Four steps. Several recordings per email is fine, and share links work for large files. Transcript rules: write exactly what was sent, including the sender's mistakes. Put prosigns in angle brackets (<AR> <SK>). For Korean or Japanese,...

NeuroCW (Part 1): A Deep-Learning CW Decoder Built for −12 dB — Data, Model and DGX Spark Training

New: Part 2 is live. Help train NeuroCW with your real on-air CW recordings → NeuroCW (Part 2): Call for Real On-Air CW Figure 1. NeuroCW at a glance. All CER numbers are from synthetic test sets. ▶ New: watch the first on-air test of the NeuroCW test build NeuroCW is an end-to-end neural CW decoder: audio in, text out. One Conformer-CTC model copies English, Korean (Hangul) and Japanese (Wabun). It was trained for about two weeks on an NVIDIA DGX Spark, exported to ONNX, and a Windows release is planned for early November . This post walks through how it was built, mostly in pictures. 1. The problem Classic decoders do fine on clean signals. They struggle once QSB, QRM and a human fist get involved. NeuroCW was trained on the bottom case. Figure 2. The same transmission, clean (top) and after the synthetic HF channel (bottom). Figure 3. End-to-end pipeline: generator → spectrogram → Conformer → CTC text. 2. Synthetic data, generated on the fly No dataset...

Open WebUI Path Traversal → /etc/passwd (CVE-2026-44566)

TL;DR: Open WebUI builds below v0.1.124 carry CVE-2026-44566 ( GHSA-9pgh-j74g-qj6m ) — an arbitrary file upload / path traversal weakness. In a controlled lab demo against a disposable v0.1.120 container, a traversal write reached outside the uploads directory and overwrote /etc/passwd inside the Docker container, injecting a visible hacked account marker. This is not a reverse shell — it is a file-write-to-anywhere impact. Patch now — upgrade to a fixed release, rebuild images, and lock down upload endpoints. ⚠ Security notice: This post is for defensive awareness only . The demo was run in an isolated lab against a disposable target I own and control. This article contains no payloads, no exploit code, and no tooling for download , and no step-by-step reproduction. Do not test systems you do not own or lack explicit permission to assess. Demo intro — Open WebUI CVE-2026-44566 lab thumbnail Watch the lab demo I recorded a short proof-of-concept walkthrough (English ...

Node2Shell (CVE-2026-111497): Express Brotli RCE to Reverse Shell — Patch Now

TL;DR: Node2Shell ( CVE-2026-111497 ) is a critical unauthenticated remote code execution weakness in the Express Brotli handling path. In a controlled lab demo, the impact progresses from a simple probe all the way to an interactive reverse shell in the application process context. Patch now — upgrade the Node.js / Express stack, rebuild images, and restart every worker so no vulnerable process keeps serving traffic. ⚠ Security notice: This post is for defensive awareness only . All demos were run in an isolated lab against a disposable target I own and control. This article contains no payloads, no exploit code, and no tooling for download . Do not probe systems you do not own or lack explicit permission to test. Watch the lab demo I recorded a short proof-of-concept walkthrough (English captions, role cards for Probe → RCE → Reverse Shell → Post-exploit, lab-only): ▶ Node2Shell (CVE-2026-111497): Express Brotli RCE to a Reverse Shell https://www.youtube.com/watch?v=...

PHP2Shell (CVE-2026-109618 / CVE-2026-109619): Patch Now — From Fatal Error to Reverse Shell

TL;DR: PHP2Shell ( CVE-2026-109618 , CVE-2026-109619 ) is a pair of critical remote code execution flaws in the PHP core (CVSS 9.2). In lab testing, the issue is not a narrow “one-off bug” — under the right conditions it can be driven from a simple code-execution check all the way to a reverse shell. Patch now. There is no complete mitigation other than updating. Watch on YouTube — PHP2Shell RCE lab demo ⚠ Security notice: This post is for defensive awareness only. All demos were run in an isolated lab against a local containerized target. Do not probe systems you do not own. Watch the lab demo I recorded a short proof-of-concept walkthrough (English captions, lab-only): ▶ PHP2Shell RCE PoC — From Fatal Error to Reverse Shell https://www.youtube.com/watch?v=1D9i6-tUxaI Demo intro: patch immediately · isolated lab only What is PHP2Shell? On 21 October 2026 , the PHP project published a security advisory for two...

NeuroSDR User Manual (3) — Sub VFO, Satellite, Digital Voice, Smart Record, Web Remote

NeuroSDR User Manual (1) Main Window & Everyday RX · (2) NeuroCaption & AF Plugins · (3) Sub VFO, Satellite, Digital Voice Also: NeuroSDR · What it is · Download & Install NeuroSDR user manual (3) — Sub VFO, satellite, digital voice, Smart Record, web remote Advanced workflows. The Sub VFO / multi-FT8 story assumes hardware with enough instantaneous bandwidth. Author: KD8CEC . 1. Sub VFOs on wide hardware (founding goal) A Sub VFO is an independent virtual receiver inside the RF capture window. On an RSP (or other wide source), you can: Listen to shortwave or CW on MAIN Run FT8 plugins on SUB1 / SUB2 / SUB3 at 14.074, 7.074, 7.040 MHz, … See decoded callsigns on the main waterfall when MAIN WF overlay is enabled If a Sub VFO leaves the capture, the UI shows OUT OF RANGE — raise sample rate / recenter, or accept that the decoder pauses. YouTube: RSP1 bandwidth + Sub VFOs + multi FT8 — full episode YouTube: Create Sub VFOs...

NeuroSDR User Manual (2) — NeuroCaption and AF Plugins

NeuroCaption & AF plugin overview (KD8CEC) NeuroSDR User Manual (1) Main Window & Everyday RX · (2) NeuroCaption & AF Plugins · (3) Sub VFO, Satellite, Digital Voice Also: NeuroSDR · What it is · Download & Install NeuroSDR user manual (2) — NeuroCaption and AF plugins Plugins attach to demodulated audio (or IQ) from your receiver. They are most powerful on local hardware with a stable sample stream; they also work on Virtual Kiwi/WebSDR when you use that secondary path. Author: KD8CEC . 1. Mental model SET → AF Plugins → add a row → choose type → assign VFO ( main or a Sub VFO) → APPLY. Each SCENE owns its plugin instance list. Decoder UIs appear as tabs on the right (FT8, CW, Caption, …). YouTube: AF plugins & captions intro — 03:36 2. NeuroCaption engines Engine Use when Notes ONNX / Sherpa Whisper (Tiny/Base/Small) Offline PC Download INT8 model files; Base/Small cost more CPU than Tiny Groq API Fast cloud STT ...

NeuroSDR User Manual (1) — Main Window and Everyday RX

NeuroSDR User Manual (1) Main Window & Everyday RX · (2) NeuroCaption & AF Plugins · (3) Sub VFO, Satellite, Digital Voice Also: NeuroSDR · What it is · Download & Install NeuroSDR user manual (1) — Main window and everyday RX Everyday operation with a local SDR (or a remote source if that is all you have). Author: KD8CEC . Main window — RX CONTROL, AF plugin tabs, RF spectrum/waterfall. YouTube: Device selection & display — 00:11 YouTube: Tuning shortcuts — 00:40 1. Choose SOURCE, then RX START In SOURCE , pick your hardware (SDRplay, RTL-SDR, HackRF, Airspy, …). Virtual Kiwi/WebSDR/OpenWebRX only if you are using the secondary Internet path. Press RX START . The button becomes RX STOP while running. Watch RF/AF meters and the status line for drops / underruns on hardware. 2. RX CONTROL Frequency digits — Click a digit, wheel to change that decade; or enter a frequency and commit. RF GAIN — Hardware gain where ...

NeuroSDR — Download & Install (RTL-SDR, SDRplay, RSD1…)

NeuroSDR User Manual (1) Main Window & Everyday RX · (2) NeuroCaption & AF Plugins · (3) Sub VFO, Satellite, Digital Voice Also: NeuroSDR · What it is · Download & Install NeuroSDR — Download and install for real SDR hardware This guide is for people who download a release and run NeuroSDR on Windows with a dongle or RSP. Author: KD8CEC . Repo install text (English + KO/JA/ZH): INSTALL.md . 1. Get the software Open GitHub Releases (not the green Code zip on the repo home page). Download the newest Windows x64 asset (example: NeuroSDR-v0.2-win-x64.zip ). Extract everything to a writable folder (e.g. C:\NeuroSDR ). Run NeuroSDR.exe . Old Zadig builds break RTL-SDR on modern Windows. Always use the latest Zadig when you need WinUSB. 2. What the zip already contains NeuroSDR.exe and supporting runtime files for that package Bundled native helpers for common USB SDRs (RTL-SDR, HackRF, Airspy, …) under paths such as native\ Built-in ...

NeuroSDR — What it is (Hardware SDR First, AI Where It Helps)

NeuroSDR — What it is (hardware SDR first, AI where it helps) Hello. This is KD8CEC . Start here Download & Install → User Manual (1) → All NeuroSDR posts NeuroSDR is a Windows software-defined radio receiver . The primary job is simple to state and hard to do well: take IQ from a real SDR, show a usable spectrum/waterfall, demodulate cleanly, and keep decoding plugins running while you still listen. I publish release zips so most people never compile anything: NeuroSDR Releases . NeuroSDR main window — local or discovered hardware appears under SOURCE; RX START runs the receiver. How to read this series: NeuroSDR is a hardware SDR application . SDRplay, RTL-SDR, HackRF, Airspy / Airspy HF+, SoapySDR devices, and rtl_tcp are the main path. Virtual WebSDR / KiwiSDR / OpenWebRX sources exist as a convenience when you have no dongle or want a public remote site — they are secondary , not the product definition. 1. Why I built it this way There are alre...