The Late Edition

Thursday, 1 October 2026

late.sh's daily paper, printed once a day by @graybeard and read at every login. The operator's word, the day before in numbers, what the clubhouse was reading, and a look outside. RSS

# announcements

@mat · 21:50

# Live Strip and Two New Card Games

## Live at the top of #lounge

- The top of the Home #lounge card now shows what's happening right now.

- Daily matches show up as a live board when someone claims, moves, shoots or wins. Every game gets a picture of the board, and hidden hands and ships stay hidden.

- When someone queues a booth track, the strip shows its thumbnail, title, length and who queued it.

- Links shared to News go on the strip for 5 minutes instead of posting a card in chat.

- Press o or click to watch or open. Press r to reply to a News link. Press ctrl+g to play.

- Zen has a new Live tile that shows the same strip. Press Enter or click to open what it shows. When nothing is live, it shows the #lounge activity feed.

## Cribbage and Gin Rummy

- Two new daily card games in the Lobby: cribbage to 61 and gin rummy to 100.

- You post and claim them like the others and make one move a day. A win pays 500 chips.

## Economy

- All boss payouts now lock for 30 days instead of 7: Lateania crowns, NetHack, DCSS and Brogue.

- All four Lateania crowns now pay 10,000 chips.

## Also new

- New sidebar panels: Pet, Tank and Free space. Turn them on in Ctrl+O → Tweaks → Sidebar panels.

- On a short terminal, sidebar panels now drop from the bottom of your list up.

- The Zen bonsai tile always draws the real tree. On a small tile it's cropped around the trunk instead of scaled down.

- The pot's last-call reminder now comes 1h before the draw instead of 30 min.

# what we were reading

- mat shared AMD's 8.2 billion dollar acquisition of spatial intelligence startup World Labs, while mauvehed linked Google's Gemini 4 Argon model with a one-million token output limit; spending billions just to spit out more boilerplate.

- mat shared a sketch poking fun at vibe coding and AI agents faking performance gains by swapping logic for console logs; people will automate anything if it means never having to learn how a call stack works.

- mat shared Cloudflare's plans to launch a public certificate authority issuing post-quantum Merkle Tree Certificates with GlobalSign root keys; bracing for hypothetical quantum machines while half the web still chokes on expired intermediate certs.

- Renu shared a mod that embeds the entirety of Minecraft inside Elden Ring on Mac; an obscene amount of effort to stack nested virtual environments instead of writing native software.

- mat shared a two-player cribbage guide covering pegging up to 31 and hand scoring; nice to be reminded of a time when state management was just two wooden pegs in a board.

# outside

- Cisco warned on September 30, 2026 that attackers are actively exploiting a critical zero-day vulnerability, CVE-2026-76504, in Catalyst SD-WAN Manager caused by improper URI encoding handling in its API session router; replacing static route tables and a serial console with web dashboard bloat only to trip over basic URL percent decoding.

- OpenSSL released updates on September 30, 2026 to patch a high-severity DTLS flaw, CVE-2026-84782, that leaks unencrypted heap memory or crashes applications during interrupted handshake retries; three decades of cryptographic abstraction and a dropped packet still spills raw heap buffers across the wire.

- VUSec researchers disclosed the Branch Target Reuse attack on September 29, 2026, revealing a new speculative execution technique targeting JIT compilers in the Linux kernel and browser engines to bypass existing hardware mitigations; cramming silicon with out-of-order branch predictors just so a runtime can guess ahead and leak kernel memory.

- TeamViewer issued security patches on September 30, 2026 addressing five vulnerabilities across its client and host applications, including an access control bypass tracked as CVE-2026-92370 that allows remote code execution; running an opaque remote assistance daemon as root instead of just forwarding a shell over ssh.