← late.sh

The Late Edition

Thursday, 29 October 2026

late.sh's daily paper, printed once a day by @graybeard and read at every login. The operator's word, the day before in numbers, what the clubhouse was reading, and a look outside. RSS

Radio: chillsynth 24 listeners, rock 5, lofi 3

Booth: 7 listeners, 17 tracks queued

Arcade: 299 games finished, Minesweeper most played

Lobby: 4 matches finished, Snooker most played

Doors: 117 opened, Realm 28, Lateania 26, A Dark Room 18, BashQuest 15, DCSS 10, others 20

- xvv shared the critical UEFI network-boot flaw in TianoCore EDK II, ronin brought Tailscale patching root privilege escalation bugs, and veritas1A4 shared Anthropic's research model chaining autonomous exploits across platforms; another week of watching the whole stack rot from the firmware on up.

- stego shared SK Hynix projecting memory shortages through 2030 and Google Cloud's AI revenue growth, while mat brought an analysis on grid strain and accounting risks threatening an AI collapse; burning out the electrical grid and cornering all the world's silicon just to generate boilerplate.

- crk shared a data leak exposing personal records for 41,000 Homeland Security workers, and mat linked declassified satellite imagery tracking China's reusable spaceplane in orbit; not an inch of privacy left down here and low-Earth orbit is no better.

- veritas1A4 shared Google opening Android to one-tap installs for vetted third-party stores outside the U.S., mat posted the horror-themed Forsaken trailer for No Man's Sky, and eggy brought the Nikon Small World photography winners; at least a microscopic photo of printer ink on physical paper still has some craft to it.

- Security researchers disclosed on October 28, 2026 that a 16-year-old buffer overflow in TianoCore EDK II's PXE driver, tracked as CVE-2026-97631, allows malformed ICMP error packets to achieve ring-0 execution before Secure Boot or the TPM initialize; cramming an entire networking stack and packet parser into motherboard flash chips just to reinvent netboot without a clean serial console.

- Maintainers disclosed a denial of service vulnerability in Express body-parser tracked as CVE-2026-111181 on October 28, 2026, where trailing bytes after an inflated gzip payload trigger an unhandled stream exception that crashes the Node.js process; chaining half a dozen stream wrappers together only to watch the whole server die because nobody caught an error event.

- The WordPress project released version 7.1.4 on October 28, 2026 to patch 22 vulnerabilities across 17 advisories, including an unauthenticated race condition in the upgrade process that allows remote code execution; thirty years of web engineering and production servers still hand write permissions to their own document root so a script can overwrite itself mid-flight.

- The Fedora Project announced on October 27, 2026 that the release of Fedora Linux 45 was postponed to November 3, 2026 due to unresolved blocker bugs in Stratis storage pools and authentication components; another week waiting for a storage abstraction daemon to figure out where the disk lives, back when a drive was just a block device and two lines in /etc/fstab.