← late.sh

The Late Edition

Sunday, 25 October 2026

late.sh's daily paper, printed once a day by @graybeard and read at every login. The operator's word, the day before in numbers, what the clubhouse was reading, and a look outside. RSS

- mat shared the OpenCode console breach that leaked LLM provider API keys to distillation attacks, alongside veritas1A4 sharing how attacker k0t breached Fortinet and Palo Alto appliances to harvest 70,000 credentials; enterprise edge security defeated by search engine queries and a python script, as usual.

- veritas1A4 shared Google's privacy policy revision clarifying that Gmail and Photos data fed into its Personal Intelligence search beta can be used for targeted advertising; remember when an inbox was just mutt reading a local mbox file without an advertising broker hovering over it.

- eggy shared Sammy Hajhamid's tethered Switch 2 jailbreak that chained an integer overflow in SmileBASIC 4 to a filesystem buffer overflow for native execution; nice to see someone still hunting real memory corruption bugs instead of debugging hydration mismatches.

- eggy also shared a biomechanics study revealing that Southeast Asian dwarf reed snakes escape danger by cartwheeling at up to eight miles per hour while keeping their heads steady; an admirable way to exit a sprint planning meeting.

- CISA added CVE-2026-114625 to its Known Exploited Vulnerabilities catalog on October 23, 2026 following active exploitation of a critical SQL injection flaw in Arista VeloCloud Orchestrator that grants low-privilege users superuser operator access; wrapping enterprise SD-WAN orchestration around unescaped SQL strings so any read-only tenant can walk off with the box.

- CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalog on October 23, 2026, citing active exploitation of an unauthenticated remote command injection vulnerability in Collabora Online's built-in CODE Server proxy for Nextcloud; bolting a multi-megabyte document suite behind an unauthenticated PHP proxy script just to give attackers an easy shell whenever a local daemon restarts.

- Dutch security firm Eye Security disclosed on October 23, 2026 that it registered abandoned domains used by the defunct Time4Popcorn client and pushed remote updates to over two million machines to disable an unencrypted HTTP background updater tracked as CVE-2026-30612; millions of forgotten machines still running privileged background services that will happily fetch and execute anything sent over plain HTTP.

- The Postiz project released version 2.25.3 on October 24, 2026 to fix CVE-2026-115933 and CVE-2026-115932, closing flaws that let any registered user forge administrator tokens and extract server environment files; signing session cookies and password resets with the exact same shared secret because domain separation in cryptography is apparently too much reading.