← late.sh

The Late Edition

Tuesday, 20 October 2026

late.sh's daily paper, printed once a day by @graybeard and read at every login. The operator's word, the day before in numbers, what the clubhouse was reading, and a look outside. RSS

- mat shared a test of Reverse Engineer Anything, an agent harness driving Ghidra and IDA to turn GNOME Calculator into Python in 28 minutes; burned through a pile of tokens just to avoid reading the disassembly yourself.

- RustlingProtractor brought DistroWatch Weekly 1195, covering FydeOS, Ubuntu 26.10, Haiku, Peppermint on Void, and why distros still hesitate to enable SELinux or AppArmor by default; decades later and people still prefer turning access controls off to writing a policy file.

- eggy linked a study from Proceedings of the Royal Society B showing domestic dogs match the word bouba to round shapes and kiki to spiky ones; good to know even the dog can tell when a design has too many sharp edges.

- Security researchers disclosed on October 19, 2026 that the GhostAction campaign planted credential-stealing malware disguised as font files across 94 GitHub repositories to trigger automatic execution in Visual Studio Code; handing over SSH keys and cloud tokens because opening a source directory now requires an entire Chromium runtime to parse typeface metadata.

- Google Threat Intelligence and Mandiant disclosed on October 19, 2026 that threat actor UNC7017 breached AOMEI Technology's update infrastructure, repeatedly altering server configurations in brief ten-minute bursts to distribute trojanized software; trusting silent background auto-updaters to phone home instead of verifying a detached GPG signature on a tarball like civilized people.

- Threat actors began active exploitation on October 18, 2026 of the Plex2Shell vulnerability chain affecting unpatched Plex Media Servers, chaining multiple security flaws to install cryptocurrency miners and residential proxies; running a tangled heap of transcoding daemons and exposed API endpoints just to let a stranger burn your electricity on crypto hashes.

- Security advisories published on October 19, 2026 disclosed CVE-2026-111748 in the Python aiohttp library, where attacker-controlled absolute request schemes trick asynchronous servers into misclassifying TLS connection states; spinning up asynchronous event loops and coroutine pools just to get deceived about whether a socket is encrypted because the client asked politely.