Live
Breaking
3h ago Gaming Xemu Setup: 80% Xbox Compatibility, 12 Steps [2026] 7h ago Gaming Steam vs Epic Games Store: 30% vs 12% Cut [2026] 11h ago Gaming Xbox Down 15 Hours: Second Outage in a Week [2026] 15h ago Gaming Valve Admits Steam Machine Price Ran $300 Over Plan [2026] 23h ago Gaming OBS Studio vs Streamlabs: Free vs $27/Mo, 2-3x RAM [2026] 1d ago Gaming melonDS Setup: BIOS Required, 13 Steps, 30 Min [2026] 1d ago Gaming MSI Claw 8 EX AI+ vs ROG Xbox Ally X: 41% Faster [2026] 1d ago Gaming Tencent Gaming Stock Sinks 7%, Worst Drop Since 2025 [2026] 1d ago Gaming Sony’s Disc Exit Threatens $7.2B Used-Game Market [2026] 1d ago Gaming Xbox Cloud Gaming Goes Free: $0, 1-Hour Sessions [2026] 2d ago Gaming Unreal Engine vs Unity vs Godot: Free, 5%, or $2,310 [2026] 2d ago Gaming Switch 2 Price Jumps to $499.99, Smallest Hike [2026] 2d ago Gaming US Game Spending Falls 21% as Switch 2 Laps Launch [2026] 2d ago Gaming Eden Setup: Switch Emulation After Yuzu, 12 Steps [2026] 3h ago Gaming Xemu Setup: 80% Xbox Compatibility, 12 Steps [2026] 7h ago Gaming Steam vs Epic Games Store: 30% vs 12% Cut [2026] 11h ago Gaming Xbox Down 15 Hours: Second Outage in a Week [2026] 15h ago Gaming Valve Admits Steam Machine Price Ran $300 Over Plan [2026] 23h ago Gaming OBS Studio vs Streamlabs: Free vs $27/Mo, 2-3x RAM [2026] 1d ago Gaming melonDS Setup: BIOS Required, 13 Steps, 30 Min [2026] 1d ago Gaming MSI Claw 8 EX AI+ vs ROG Xbox Ally X: 41% Faster [2026] 1d ago Gaming Tencent Gaming Stock Sinks 7%, Worst Drop Since 2025 [2026] 1d ago Gaming Sony’s Disc Exit Threatens $7.2B Used-Game Market [2026] 1d ago Gaming Xbox Cloud Gaming Goes Free: $0, 1-Hour Sessions [2026] 2d ago Gaming Unreal Engine vs Unity vs Godot: Free, 5%, or $2,310 [2026] 2d ago Gaming Switch 2 Price Jumps to $499.99, Smallest Hike [2026] 2d ago Gaming US Game Spending Falls 21% as Switch 2 Laps Launch [2026] 2d ago Gaming Eden Setup: Switch Emulation After Yuzu, 12 Steps [2026]
NewsroomLive
Today5 new
Archive199 stories
Last filed3h ago
Languages10
UTC19:44:05
Top Story Gaming

Xemu Setup: 80% Xbox Compatibility, 12 Steps [2026]

The original Xbox launched in November 2001 and Microsoft stopped making it in 2005, but the console's library is more playable today than at almost any point since. Xemu, the open-source original-Xbox emulator, now handles roughly…

3h ago  ·  Jul 29, 2026 Read the brief

The Desks

// editorial departments

Latest

// fresh from the editors

More from the desks

// keep digging
// about

About Shattered.io

This domain has been home to the SHAttered SHA-1 collision project since 2017, and is now a hub for cryptography, security and privacy reporting. The full origin story of the project, the two proof PDFs and the research credits live below.

The SHAttered project — origin, proof files and research credits

On 23 February 2017, researchers at CWI Amsterdam and Google showed the world the first real collision for the SHA-1 hash function. The project was called SHAttered, and this domain has been its home ever since. The two files that prove the break are still here to download.

What a collision actually is

A cryptographic hash takes any file and returns a short fixed-length fingerprint. The promise is simple: change a single bit of the file and the fingerprint changes too, and no two different files should ever share one. A collision breaks that promise. It is a pair of distinct inputs that produce the exact same hash. For a function used to sign software, certificates and documents, a collision is not a curiosity. It is a crack in the foundation.

What SHAttered produced

The team did not just argue that SHA-1 was weak on paper. They built the evidence. Two PDF files, visibly different and carrying different content, share one identical SHA-1 value: 38762cf7f55934b34d179ae6a4c80cadccbb7f0a. Run either file through SHA-1 and the answer matches. Run them through SHA-256 and the answer differs, which is how anyone can confirm they are genuinely two separate files.

What the attack cost

The break was expensive, and that was part of the point. Producing the collision took roughly nine quintillion SHA-1 computations, the work of about 6,500 CPU-years and 110 GPU-years run in parallel. That scale kept the attack out of reach for a casual attacker in 2017, yet it ran thousands of times faster than trying every possibility by brute force. The direction of travel was clear: the cost would only fall.

Why SHA-1 had to retire

Once a working collision exists, trust in a hash erodes quickly. Within months the result pushed browsers, certificate authorities and version-control systems to drop SHA-1 for anything security-sensitive. Git added collision detection. TLS certificates signed with SHA-1 were phased out. The lesson reached far past one algorithm: a function can look safe for years and still fall the moment the maths and the hardware line up.

The research and the people behind it

SHAttered was the work of Marc Stevens and Pierre Karpman at CWI Amsterdam, together with Elie Bursztein, Ange Albertini and Yarik Markov at Google. It built on years of earlier cryptanalysis of the SHA-1 design. The full technical paper that documents the method is preserved here.

Beyond the collision

The same questions that drove SHAttered run through everything we cover here: how hashing works, where it is used, and how systems prove they have not cheated. These guides pick up where the research leaves off.

What you'll find on shattered.io today