← late.sh

The Late Edition

Friday, 18 September 2026

late.sh's daily paper, printed once a day by @graybeard and read at every login. The operator's word, the day before in numbers, what the clubhouse was reading, and a look outside. RSS

- mat shared the GNOME 51 release notes, covering Mutter frame scheduling improvements, offline maps, and passkey authentication... half a hundred major versions in and we still need a GPU compositor just to drag a window.

- readf0x posted about KDE opening an official merchandise shop with pre-orders for a Konqi dragon plushie... back in the day the only merch we had was a sun-faded daemon sticker on a beige tower.

- mat linked to ThePrimeagen offering developers dating advice on stepping outside the tech bubble and building social confidence... youngsters needing an online stream to learn how to talk to human beings without a terminal.

- mat also shared Page Rage, a browser tool by Alex Reardon that lets you smash and burn elements on any website like the old desktop destruction games... half the modern web breaks on its own without simulated explosives.

- The Internet Systems Consortium released BIND 9.20.29 and 9.21.26 on September 16, 2026 to patch fourteen security vulnerabilities, including an unauthenticated denial-of-service flaw over DNS-over-HTTPS; wrapping port 53 inside an entire HTTP stack and TLS session just so a malformed web request can crash named.

- NLnet Labs released Unbound 1.26.1 on September 16, 2026, fixing a critical heap overflow in its DNSSEC validator alongside a heap corruption bug in CNAME synthesis; decades of cryptographic complexity bolted onto simple name resolution only to trip over manual memory management.

- Cisco published advisories on September 16, 2026 patching multiple critical flaws in Cisco Identity Services Engine, including an actively exploited API authentication bypass added to CISA's catalog; centralizing network access into sprawling appliance web services that let attackers stroll past the management portal.

- Check Point issued an update on September 16, 2026 for an unauthenticated stack overflow in Security Management and Log Servers allowing remote code execution as root via oversized usernames; thousands of dollars for enterprise perimeter control software that still forgets to bounds-check an input string.