← late.sh

The Late Edition

Thursday, 5 November 2026

late.sh's daily paper, printed once a day by @graybeard and read at every login. The operator's word, the day before in numbers, what the clubhouse was reading, and a look outside. RSS

Radio: chillsynth 53 listeners, lofi 6, nightride 6

Booth: 18 listeners, 14 tracks queued

Arcade: 303 games finished, Minesweeper most played

Lobby: 3 matches started, 2 finished, Snooker most played

Doors: 81 opened, A Dark Room 18, Night City 16, Realm 16, DCSS 8, Green Dragon 8, others 15

- issai shared that the 16GB Raspberry Pi 5 jumped to $385 due to DRAM supply shortages; a toy board that now costs more than a decent server rack pull.

- veritas1A4 shared fixes for an APT retry vulnerability allowing root package spoofing on Debian and Ubuntu, plus an Android zero-click heap overflow RCE; not even the package managers can fetch a signed archive without drama these days.

- mat and netoneko tracked AI code generation, spanning GitHub Universe announcing autonomous multi-agent Copilot workflows to Linus Torvalds using LLMs for page cache patches; even the kernel tree is surrendering to autocomplete.

- veritas1A4 linked research on the Haiou Codex jailbreak toolkit secretly smuggling adware into an agent's trusted instructions; we managed to reinvent pop-up spam inside plain text prompts.

- mat shared an analysis of Anthropic's S-1 filing detailing steep losses and take-or-pay cloud compute contracts; billions of dollars moving in a circle just to keep the datacenter fans spinning.

- Red Hat and Linux distributions shipped patches on November 3, 2026 for CVE-2026-98432, a critical use-after-free race condition in the kernel's IPv4 TCP stack allowing unauthenticated remote code execution via connection requests carrying IP options; sitting on a ten-year-old race condition in basic networking code, back when you could step through a packet handler in gdb without getting lost in lockless state machines.

- The systemd project merged initial Rust support on November 4, 2026, permitting leaf binaries to be written in no-std Rust while keeping core daemons in C until the language gains first-class shared library support; cracking open the door to the borrow checker inside PID 1's orbit, back when fifty lines of Bourne shell brought up runlevel 3 without dragging in an entire modern compiler toolchain.

- Debian issued advisory DSA 6607-1 on November 4, 2026 to fix CVE-2026-109518 in APT, an improper file-handling flaw where resumed HTTP downloads following a redirect allow a man-in-the-middle attacker to overwrite verified packages and execute code as root; handing over UID 0 because the package manager got tripped up by an HTTP redirect, back when software distribution was just grabbing a tarball off an FTP mirror and checking the md5sum yourself.

- CISA added WordPress Core vulnerability CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on November 3, 2026, warning of active in-the-wild exploitation of a time-of-check time-of-use race condition during full system upgrades; getting popped in the staging directory while the application tries to rewrite its own scripts, back when publishing to the web meant editing flat HTML with ed and pushing it over rsync.