Social media moving back to gas station bathrooms. And since there's no gas to buy, the threads are pretty sparse.

Russians are great folks, but never let them form a government.

Actually, the .12 had fixes for other PHP CVEs.
But it was a .13 that did fix the CVEs in question (which are remote code executions).

The repositories were being hammered and the fix was delayed for most people.

Excerpt:

Changes for php8.3 (php8.3-zip php8.3-xml php8.3-readline php8.3-opcache php8.3-cli php8.3-phpdbg php8.3-mysql php8.3-mbstring php8.3-gd php8.3-fpm php8.3-dev php8.3-curl php8.3-cgi php8.3-bcmath php8.3-common) ---
php8.3 (8.3.6-0ubuntu0.24.04.13) noble-security; urgency=medium

    * SECURITY UPDATE: Remote RCE via state corruption issue
        - debian/patches/CVE-2026-109618_109619.patch: Avoid state corruption via
            bailout in Zend/tests/bug40770.phpt, Zend/tests/bug54268.phpt, ...
        - CVE-2026-109618
        - CVE-2026-109619

  -- Marc Deslauriers Mon, 19 Oct 2026 11:16:58 -0400

Although it says Monday 19 Oct, it was not available in the repositories (embargoed) until 10 am Eastern Wednesday 20th of Oct.

But the repository being under load delayed that for most people.

If you are using a distro with long term support (LTS), like I am, they backport the patch to the version that they have.

I am on Ubuntu Server 24.04 LTS, and the change was from

8.3.6-0ubuntu0.24.04.11
To
8.3.6-0ubuntu0.24.04.12

So, .11 to .12.

This should have been posted before 10 am EDT.

Ubuntu LTS (26.04, 24,04, and 22.04) got the fix yesterday, as patches to the existing PHP version.

This is from 24.04:

Upgraded:
        php8.3-bcmath:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-cgi:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-cli:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-common:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-curl:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-dev:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-fpm:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-gd:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-mbstring:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-mysql:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-opcache:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-phpdbg:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-readline:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-xml:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-zip:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12

There is now a PHP2Shell.

... an attacker without a login can run code on Magento 2.4.9, WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, MediaWiki 1.46.2, Roundcube 1.7.4, phpMyAdmin 5.2.3, Nextcloud 35.0.1, Laravel 13.11, Symfony 8.1 and WHMCS. The exploit tool PHP2Shell, credited to Calif, combines both bugs into one attack that needs no login.

There will be lots of hacked sites in the coming days and weeks.

How about this for punditry?

Cringley thinks Apple and Intel are merging.

Also, there has been a recurring comment here on Slashdot about Robert X Cringley, with all sorts of claims allegedly made by him. However, it is posted anonymously, and does not provide sources..

The "working at Apple as employee #12" part appears on a speaker biography.

The same bio also says he taught for several years at Stanford.

This Reddit comment says that he claimed he has a PhD from Stanford when he worked at Infoworld.

This page has more of his claims (invented the trash can icon, ...), and details his foray into Kickstarter and Minecraft.

So, lots of questions about him, to say the least ...

Fuck him and the horse he rode on. Fuck his business. Fuck his technology. Fuck his company. Fuck his employees. Fuck his investors. Fuck his government ties. Fuck him defending this shit. Fuck everyone who wants this. Fuck the government for buying into it. Fuck the laws that allow this if they do.

If I amputate your mustache and affix it to myself, am I wearing a fake mustache?

It sounds like you're saying no. I disagree. If I were wearing a wig made of human hair, my hair is still fake, even if my fake hair is made of real hair.

So we have to account for multiple possibilities - the robot could be wearing a real fake mustache, a fake fake mustache, or perhaps one day we'll see them extrude their own.

- It's impossible to prove anything. Somalia was in the midst of a civil war, there are no records.

The civil war is not even the case.
I have a Somali friend who was born perhaps two decades before the civil war started in 1990.

He told me that he does not know when he was born, simply because there are no birth records in Somalia. He needed this info to apply for something in a Western country.

He said the only way to know for sure is to go to the village elders who will remember when he was born based on a certain event (natural disaster, war, or other notable event).

With people displaced and such in the civil war, it could only be worse ...

That assumes (a) there's a price tag on the item, (b) that price updates happen correctly and (c) the barcode/scanner/computer registers the right item.

I will not use them, but that's because of a quirk of our legal system that leaves customers exposed when they aren't with a cashier.

People have been arrested after the fact over self-checkout mistakes that never would have happened had there been a human cashier. The reason is that the cashier signals acceptance of the deal, takes the money, and concludes the transaction. If they make a scanning mistake, or the price is wrong, or the barcode was wrong, or whatever, that's on the store - they accepted payment and concluded the transaction. If you use their robot scanner, you are representing to the machine what you claim to be purchasing, and LP can later review cameras and call the cops if they disagree.

Florida, which apparently is more enthusiastic about self-checkout than elsewhere, has defense lawyers advertising in this lane. I'll deal with humans and nope out on that whole game, thanks.

It is Apple.

Sure, but the legal mess is chaos for later.

I'm talking about the many folks who have reason kicking them when they're down, right now.

I imagine a lot of Russian businesses are very focused on the particulars of their relationship with Yandex, monitoring systems are demanding attention for everything, and technical folks are scrambling and tired by now.

I also imagine there are a lot of well-rested folks, both Russian and not, who know of an opportunity to make it worse.

Someone so wrapped up in toxic incel bullshit they're losing the ability to hold a theory of mind about other people.

They like to throw out random statistics as totems to appear somewhat tethered to reality, which betrays some remaining awareness of how far gone they are. But they're decorative facts, little different from land acknowledgements or prefatory "I'm not a racist, but..." noises, for similar purposes.

But in general, they no longer treat people as humans, with their own complicated inner lives and desires and confusions and insecurities. No, everyone is locked in to little set-piece lives governed by their looks and genes, performing deterministic dramas that just happen to highlight the incels' own insecurities. A weird, pathetic self-induced solipsism in which being miserable is more comfortable than confronting their own egos and accepting that dealing with insecurity is just part of the human condition.

It is pointless to suggest this, but I will anyway: the fix is to actually talk to humans like you're one, too. Don't run some game you think you're supposed to play, don't put on a mask, don't puff up. Have a conversation, learn how they're different, what they care about, what makes them tick. If you don't treat (at least all) your interpersonal relations as conflicts to either win or lose, you might find you actually... enjoy their company, and they might find they enjoy yours.

Polar circle?
Oh you mean the Arctic Circle.
Hardly ...

I live at latitude 43.44 N.

That is south of Florence Italy, and Nice and Cannes, France.
Also south of Madison, Wisconsin, and Minneapolis Minnesota.

And the most populous places in Canada are nearby.

But yeah, to Americans, we are "up north", so we have to be in the Arctic Circle.

Tim Apple was smart enough to gift a gold plated whatever.

Sam Altman is a grifter himself and knew how to play this.

And now that we know communism is actually defined as anti-bigotry and has nothing to do with the means of production, I guess it is not communist to take ownership in Intel.

But Satya won't pucker up for Piggie. And so Microsoft gets to be the face of an attempt to gin up anti-Indian bigotry before the midterms.

Welcome to the land of the free and the home of the brave.