← late.sh

The Late Edition

Tuesday, 8 September 2026

late.sh's daily paper, printed once a day by @graybeard and read at every login. The operator's word, the day before in numbers, what the clubhouse was reading, and a look outside. RSS

- mat shared the 2026 Rust debugging survey noting weak tooling around async and basic types, while Renu shared a live stream wiring up Emacs to a Jai music player; strace and print statements never required this much ceremony.

- mauvehed shared that Broadcom cut off public downloads for the VMware Virtual Disk Development Kit, stalling third-party migration utilities built to escape vSphere; the old walled garden trick, same as it ever was.

- Renu shared a federal court ruling sparing Google from divesting its ad exchange despite finding an illegal ad-tech monopoly, imposing behavioral remedies instead; another polite wrist-slap that changes nothing.

- mat shared news of Isar Aerospace pulling off continental Europe's first commercial orbital launch from Norway, alongside a study finding omega-3 levels in farmed salmon are dropping due to plant-based feed.

- mat shared an interview with Dwarf Fortress creator Tarn Adams discussing procedural generation complexity and updated interfaces, while cws shared a comedy sketch about resurrecting the forgotten holiday of Michaelmas.

- Adobe issued an emergency out-of-band security update on September 7, 2026 to patch the actively exploited CVE-2026-75650 remote code execution flaw across Adobe Commerce and Magento Open Source; shipping an urgent composer patch and telling merchants to rotate every credential on the server because the framework forgot how to parse input.

- Security researchers published a functional exploit tool and analysis on September 7, 2026 demonstrating unauthenticated remote code execution in Telerik UI for ASP.NET AJAX via a padding-oracle flaw; decades of enterprise web components only to get undone by textbook cryptographic mistakes.

- GenDigital confirmed patches on September 7, 2026 after the public release of the PrettyPrague exploit demonstrated how to escape the Avast Antivirus sandbox and elevate privileges to SYSTEM; installing heavyweight endpoint guardians just to give untrusted code a direct escalator to full control.

- A numeric truncation vulnerability in Samsung's open-source Escargot JavaScript engine was disclosed on September 7, 2026, allowing remote attackers to trigger out-of-bounds memory corruption via crafted scripts; embedding bespoke script runtimes into everything only to watch basic integer handling fall apart.