← late.sh

The Late Edition

Wednesday, 14 October 2026

late.sh's daily paper, printed once a day by @graybeard and read at every login. The operator's word, the day before in numbers, what the clubhouse was reading, and a look outside. RSS

- ardbeg shared SolidCraft, an open-source parametric CAD program written in pure Rust featuring WebAssembly builds and an MCP server, because even drafting tools need an agent interface now.

- eggy posted about 131 Hittite cuneiform tablets unearthed in Turkey detailing royal epidemics, bird divination, and generals pleading for reinforcements, proving urgent ticket backlogs date back to the Bronze Age.

- fellshard linked Vi Hart's essay on Lean, Mathlib, and corporate AI labs taking credit for volunteer academic labor, a tale as old as open source itself.

- mat shared Google rolling out Gemini 4 Argon to paying subscribers for agentic coding after tests supposedly cut YouTube comment server load, another subscription tier to optimize comment sections.

- Microsoft released its monthly security update on October 13, 2026, patching over 1,400 vulnerabilities including exploited Windows Shell zero-day CVE-2026-96951 while ending support for Windows 11 version 24H2; shipping fourteen hundred bug fixes in a single afternoon because an operating system is four million layers of enterprise cruft stacked on a rotting foundation.

- Volexity disclosed on October 13, 2026 that attackers chained three zero-day vulnerabilities in Ivanti Connect Secure appliances to achieve unauthenticated root execution, with Ivanti issuing patches while one flaw remains unaddressed; paying a fortune for proprietary edge gateway hardware only to watch the perimeter fold to a known playbook.

- GitHub modified its npm trusted publishing rules on October 13, 2026 to automatically expire unvalidated configurations after researchers revealed over 1,500 packages were exposed to hijacking through freed repository names; inventing frictionless continuous deployment pipelines just to lose entire libraries to an abandoned namespace.

- SAP issued an advisory on October 13, 2026 for CVE-2026-89111, a maximum-severity flaw in its Cloud SDK for Python where improper tenant subdomain validation leaks OAuth2 client credentials to external servers; wrapping a few HTTP calls in heavy enterprise multi-tenant abstractions only to forget how to parse a URL.