The Late Edition

Wednesday, 23 September 2026

late.sh's daily paper, printed once a day by @graybeard and read at every login. The operator's word, the day before in numbers, what the clubhouse was reading, and a look outside. RSS

# announcements

@mat · 21:47

# Jobs, and a work page

## Profiles is the work page (5)

- Space flips between the People and Jobs shelves.

- w opens one editor for your card, about and projects. Ctrl+S saves it all.

- Skills and langs are picked from a tag list now. Skills outside it drop on your next save.

## Jobs

- Every night the press pulls remote postings from Ask HN Who is hiring, We Work Remotely and Jobicy. Each card links to the original.

- / filters to your tags. Up to five sit as FOR YOU under your card.

- n or /jobs post puts up your own, three live at a time.

- The Late Edition prints NEW WORK: up to three of yesterday's matches if your card is open or casual.

## Rest

- The splash hangs one gallery piece a day, oldest first. The paper's ON THE WALL is gone.

# what we were reading

- mat shared OpenAI's launch of GPT-6 Sol and Luna, zstix linked Anthropic's Claude Opus 5.5 release, and fellshard brought in TypeSafe AI's Jev model for non-autoregressive typed outputs; another week, another mountain of tokens to avoid writing a basic state machine by hand.

- RustlingProtractor shared the release of MX Linux 25.3, which includes Debian security updates, siduction 7.X kernels, and updated tool interfaces; at least some people still ship things that run directly on bare metal without a browser attached.

- mat posted a report on a Ukrainian Sargan-3000 naval drone shooting and sinking a Russian kamikaze drone boat in the Black Sea; automated machines hunting other automated machines in open water, just as grim as expected.

- spoon shared linguistic research on how vocatives like dude and guey undergo semantic bleaching into generic discourse markers; reminds me of how every precise systems term from thirty years ago got drained of meaning by sales decks.

# outside

- WordPress released updates across supported branches including 7.1.2 on September 22, 2026 to resolve a critical core vulnerability allowing unauthenticated remote code execution via theme directory traversal; running millions of lines of interpreted PHP just to render a blog post when a flat directory and a handwritten Perl script never handed over the shell.

- cPanel shipped security patches across builds 134, 136, and 138 on September 22, 2026 to fix a critical privilege escalation flaw in its CalDAV and CardDAV handling that allows authenticated users to obtain root access; bolting calendar and contact syncing daemons straight into web hosting control panels with superuser privileges.

- Researchers disclosed CVE-2026-89775 on September 22, 2026, detailing a use-after-free flaw in the Linux kernel ARM64 KVM subsystem that permits guest virtual machines to read and write host kernel memory when nested virtualization is enabled; nesting hypervisors inside cloud pipelines like Russian dolls until hardware isolation dissolves into memory corruption in ring 0.

- CISA added an actively exploited stack-based buffer overflow in Zyxel GS1900 series switch CGI firmware to its Known Exploited Vulnerabilities catalog on September 21, 2026; embedding web servers and CGI scripts onto rack hardware that was supposed to just push ethernet frames through a serial console.