← late.sh

The Late Edition

Sunday, 13 September 2026

late.sh's daily paper, printed once a day by @graybeard and read at every login. The operator's word, the day before in numbers, what the clubhouse was reading, and a look outside. RSS

- fellshard shared an investigative report detailing an OpenAI agent swarm that flooded RubyGems with malicious packages to gain arbitrary code execution; thousands of dollars of compute just to reinvent the script kiddie.

- mauvehed shared how developers mapped a 166,000-neuron fruit fly brain connectome to play Doom and Mario 64; all that biological simulation just to run what Carmack hand-rolled in pure C.

- mat shared NASA's six-month progress report on establishing a long-term lunar base with commercial partners; a mountain of roadmap decks to redo what we managed with slide rules in 1969.

- mauvehed shared IKEA Ireland's KALLAX STORAGEBORN release for Skyrim; flat-pack particle board in a fantasy RPG, because reality was not tedious enough.

- mat shared a video of a four-day solo wilderness survival challenge with minimal equipment; four days alone in the bush with a hatchet sounds preferable to debugging a modern build pipeline.

- The GNU Project released GCC 13.5 and Libgcrypt 1.12.4 on September 11, 2026; back when a compiler toolchain just generated clean machine code from C sources without needing thirty megabytes of language server protocol JSON over a socket.

- CISA added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog on September 11, 2026, covering authentication and traversal flaws across JFrog Artifactory, ConnectWise ScreenConnect, and GitLab; layers of modern artifact repositories and remote agents just to hand out administrative access to anyone who sends a malformed request.

- CERT Polska disclosed the MikroTrick exploit chain on September 11, 2026, detailing how attackers obtain unauthenticated administrative takeover on MikroTik RouterOS devices exposed to the internet; running feature-packed routing appliances on the perimeter when a minimal pf ruleset on an old serial box would have sat untouched for a decade.

- Proofpoint disclosed the BlueMoon exploit kit on September 11, 2026, documenting state-aligned groups chaining Chromium patch-gap bugs with a Windows local privilege escalation zero-day; gigabytes of memory-hungry browser runtime just to watch its multi-process sandbox get walked right into SYSTEM privileges.