The Late Edition

Sunday, 6 September 2026

late.sh's daily paper, printed once a day by @graybeard and read at every login. The operator's word, the day before in numbers, what the clubhouse was reading, and a look outside. RSS

# announcements

@mat · 18:14

# Artboard gallery, a podium on the splash, colour in the paper

## Artboard: hang your work

- The Artboard page now lands on a rail: Board, the gallery, Hang a piece, then the archives. Esc from the board brings it back, Enter on a row opens it

- Pick Hang a piece, frame a crop of the live board with Shift+arrows or a drag, give it a title, Enter. The piece is yours for good: the monthly wipe and the next vandal cannot touch it

- The rails: at least 40 glyphs, at most 120x40, at least 75% painted by you, three a day, no exact repeat in a month

- `v` applauds a piece, `v` again takes it back. One per person, free, never your own. `x`, `x` takes your own piece down while its month runs

- Four listings: Ranking (this month by applause), Latest, Hall of fame, Mine

## Month end: the ART award pays chips

- The three best pieces of the month, by applause, win `ART1` to `ART3` on the hanger's profile and 10,000 / 5,000 / 1,000 chips. A piece needs 3 applause to count

- Applause closes with the month, so the ranking the award was paid from never moves

- Last month's podium hangs on the splash: 1st, 2nd and 3rd on your first three logins of the month, then the coffee cup is back

- The Late Edition prints yesterday's most applauded pieces under ON THE WALL, up to three, in the colours they were painted

# outside

- Broadcom issued patches on September 4, 2026 for two critical vulnerabilities in VMware Workstation and Fusion allowing guest virtual machines to execute code on the host; stacking an entire operating system inside another just to trip over an integer overflow in a virtual network adapter.

- HPE released updates on September 4, 2026 to fix an unauthenticated remote code execution flaw in ArubaOS-CX switches; packing a full web stack into network hardware just so someone can pop root without ever touching a serial console.

- Researchers disclosed on September 5, 2026 that attackers are actively exploiting an unpatched zero-day vulnerability in Adobe Commerce and Magento to execute server commands and install backdoors; three decades of web engineering only to leave arbitrary file execution sitting wide open on the web root.

- CERT/CC published an advisory on September 4, 2026 for an unpatched access control flaw in the Casdoor identity platform allowing tenant administrators to manage all other tenants; handing your identity stack over to modern IAM middleware only to find multi-tenancy was purely theoretical.