The Late Edition
Monday, 26 October 2026
late.sh's daily paper, printed once a day by @graybeard and read at every login. The operator's word, the day before in numbers, what the clubhouse was reading, and a look outside. RSS
# late.sh is on Mastodon and Bluesky
## Follow us
- Mastodon: @late@fosstodon.org (https://fosstodon.org/@late)
- Bluesky: @late.sh (https://bsky.app/profile/late.sh)
- Both are linked from the late.sh landing page, and the Mastodon profile shows late.sh as verified.
- One post a day, never two. Nothing from chat is ever posted. Only things you made to be seen.
## What gets posted
Every day at 16:00 UTC, one of these, in this order:
- A gallery piece: a piece you hang in the gallery goes out once, credited to you as ~name. Each piece is checked before it's posted.
- Weekly wins: on Sundays, a scoreboard card with the week's best in every game, credited ~name.
- The Artboard: yesterday's board as the room left it, cropped to what was actually drawn, with a link to the gallery. A near-empty board is skipped.
- The paper: on quiet days, the front page of The Late Edition, linking the full edition.
## Help spread the word
- Follow, boost, repost, reply. Every boost shows late.sh to people who have never heard of it.
- The posts carry tags like #ASCIIart #MastoArt #tildeverse #ssh, so they turn up in those feeds too.
- Post your own late.sh profile or share card, and we'll boost it.
## Get your profile verified on Mastodon
- Put your Mastodon profile URL in your late.sh profile's links or contact. Use the https://instance/@you form, not @you@instance.
- Add your late.sh profile page (late.sh/profiles/...) to your Mastodon profile's links. Mastodon then shows it verified.
## The paper is on the web
- The Late Edition is at late.sh/paper, with dated back issues and an RSS feed at late.sh/paper/feed.xml. It's linked from the landing page now.
Arcade: 160 games finished, Nonograms most played
Lobby: 3 matches finished, Eight-Ball most played
- eggy shared that Denmark abandoned its pilot to replace Microsoft Office with Collabora after users ran into formatting bugs and blank pages converting between ODF and OOXML; decades of standards committees and we still cannot escape proprietary document bloat.
- ronin shared Playden, an experimental Wine-based launcher to play owned Steam games on jailbroken PS5s, alongside the Slurptop, a custom DIY cyberdeck running off swappable 24-volt power-tool batteries; nice to see people still hacking on actual iron instead of another web wrapper.
- On machine learning, mat shared an essay declaring rapid AI breakthroughs an alien singularity, veritas1A4 noted Claude guardrails aggressively flagging reverse-engineering queries, and netoneko shared r/opensource banning AI projects and non-English submissions entirely; breathless tech evangelism on one side and panicked gatekeeping on the other.
- In natural sciences, mat shared research on a 1,000-mile Martian cloud forming via direct ice nucleation without dust particles, while eggy shared successful Phase 3 trial results for a personalized mRNA melanoma vaccine; actual empirical progress in the physical world, which makes for a rare change of pace.
- Wiz disclosed on October 25, 2026 that an automated campaign dubbed Gheist abused compromised GitHub tokens across more than 850 accounts, committing workflow files to over 13,500 branches to exfiltrate repository secrets via CI logs; handing broad API permissions to cloud tokens only to watch an automated runner happily pipe production credentials to the world.
- Kaspersky reported on October 24, 2026 that threat group APT41 deployed a new UEFI bootkit named BlackX in Central Asia, exploiting the Baton Drop vulnerability to bypass Secure Boot and disarm host security drivers; layering cryptographic trust hierarchies inside modern firmware just to get tripped up by a four-year-old bootloader oversight.
- Sweet Security reported on October 25, 2026 that the Brotli decoder out-of-bounds write extends to Go implementations, exposing web frameworks including Traefik, Fiber, and Iris to remote memory corruption; adopting a garbage-collected language for safety only to link directly against the same brittle C decompression logic.
- Oracle issued an out-of-band security alert on October 25, 2026 for the PHP2Shell flaws, assigning CVE-2026-109618 and CVE-2026-109619 a 9.8 severity score across impacted enterprise deployments; five days after the emergency patches shipped and enterprise vendors are still scouring monolithic software stacks to see where they hid a scripting runtime.
The room columns print inside the clubhouse only: ssh late.sh and type /paper.