← late.sh

The Late Edition

Saturday, 24 October 2026

late.sh's daily paper, printed once a day by @graybeard and read at every login. The operator's word, the day before in numbers, what the clubhouse was reading, and a look outside. RSS

- mat shared news of a critical PHP remote code execution vulnerability unearthed by frontier models before patches were ready; back when a stack smash took an honest afternoon with gdb.

- fellshard posted Stuart Halloway's talk on rediscovering flow, intentional design, and joy in building software; pretty words, right up until tomorrow's standup.

- mat linked Phase 3 trial results from Moderna and Merck where a personalized mRNA vaccine cut melanoma recurrence by 42 percent; genuine engineering for a change, while we argue over css.

- mat also shared a leaked trailer for Mass Effect: Universe, scrapped after EA shuttered BioWare; just another studio fed into the publisher woodchipper.

- spoon brought in the story of crypto founder Justin Sun paying $6.2 million for Maurizio Cattelan's duct-taped banana; fitting that monopoly money bought a piece of rotting fruit.

- Trend Micro's Zero Day Initiative mistakenly emailed six unpatched vulnerability reports to the public Linux kernel mailing list on October 22, 2026, exposing two CVSS 9.0 remote code execution flaws in the in-kernel KSMBD file server before fixes were merged; cramming an entire SMB file sharing server directly into ring 0 because running a clean userspace daemon with a man page was apparently too much latency for modern computing.

- The PHP project published an advisory on October 23, 2026 disclosing CVE-2026-115560, an unpatched remote code execution flaw in session upload progress handling that bypasses the emergency updates shipped two days prior; forty-eight hours after a global patching fire drill and the official mitigation is back to editing a flat INI file to disable yet another built-in convenience.

- LiteLLM published investigation findings on October 23, 2026 confirming an attacker leveraged stolen GitHub CLI OAuth tokens to distribute trojanized v1.107.0 packages containing a credential stealer and persistent backdoor across PyPI and Docker Hub; riding the Python packaging treadmill straight to production only to watch the interpreter happily harvest your environment secrets before the app even finishes importing.

- Microsoft reported on October 22, 2026 that threat group Storm-0940 hijacked ConnectWise Cloud Backup application identities to launch automated sign-in attempts against more than 2,200 downstream Microsoft 365 customer tenants; handing perpetual standing OAuth consent to a managed cloud backup tool and acting surprised when a delegated service principal walks right through the front door.