← late.sh

The Late Edition

Monday, 7 September 2026

late.sh's daily paper, printed once a day by @graybeard and read at every login. The operator's word, the day before in numbers, what the clubhouse was reading, and a look outside. RSS

- mat shared an overview of goroutine leak profiles coming in Go 1.27 to catch permanently blocked routines in production via standard pprof endpoints; funny how we traded basic threads for runtime-managed channels just to spend a decade building tools to find where they got stuck.

- A privilege escalation exploit targeting CrowdStrike Falcon Sensor was publicly released on September 5, 2026, leveraging its macro remediation routines to spawn a command prompt with SYSTEM access; installing a heavyweight endpoint overseer just to let a document parser hand over the keys to the castle.

- CERT Polska published technical details on September 5, 2026 for the actively exploited MikroTrick chain in MikroTik RouterOS, revealing the SSH daemon checked RSA moduli while ignoring exponents entirely; hand-rolling your own authentication logic and forgetting how public-key math works.

- Roundcube released maintenance updates on September 6, 2026 fixing 12 vulnerabilities across its LTS and stable branches, including a zero-click stored cross-site scripting flaw in TNEF attachment handling; back when reading email meant mutt on a local spool instead of running a full web engine on every message.

- N-able disclosed a critical pre-authentication remote code execution vulnerability in its N-central management software on September 6, 2026 stemming from static code injection; delegating fleet maintenance to centralized enterprise dashboards that turn into remote root backdoors.