PHP Warns Admins to Expect Emergency Patches Tomorrow ⇥ bleepingcomputer.com

Lawrence Abrams, Bleeping Computer:

In an advisory published Tuesday, the PHP development team announced that it plans to release security updates on Wednesday, October 21, at 14:00 UTC (10:00 AM Eastern), to address two vulnerabilities, each rated 9.2 under CVSS v4.0.

The PHP security team also sent a notice to its ANNOUNCE mailing list, urging administrators to prepare to install the security updates as soon as they become available.

Word on the street is that these exploits have leaked, and that remote code can likely be executed all the way back to PHP 5. If you have access to your website’s php.ini file, it might be worth turning off multipart uploads for now.

NetNewsWire 7.2 ⇥ netnewswire.blog

Brent Simmons:

We’ve released NetNewsWire 7.2 for Mac with a new column view layout: choose View > Use Column Layout to switch. (Choose it again to switch back.)

This is a new feature in the sense that the previous version of the app didn’t have it — but NetNewsWire of Yore, before the 2018 reboot, certainly had this feature. Even NetNewsWire 1.0 had this feature! In fact, back in those days it was the only layout. In some ways this is the oldest NetNewsWire feature and we’re celebrating its triumphant return. :)

I have been using this view since it appeared in the beta last month and I am a huge fan. It feels like coming home. (Though, I have to say: I recognize there is a history to the name “Column View”, but it is strange to me that the layout more typical of modern apps is reminiscent of what Finder calls the “Column View”. This one is more like a row-based view in my 2026 head.)

The iOS version of NetNewsWire 7.2 adds iPhone Duo support.

What Is the Truth? ⇥ lrb.co.uk

Geoff Mann, London Review of Books:

The dubious achievement of prediction markets is to have found a new way to exacerbate and exploit the simultaneously frantic and passive experience of the world that is a defining aspect of our age. Like any kind of gambling, they are enervating. We put our money down and then (unless we are using a hairdryer on an airport thermometer) fidget anxiously till it’s over. The world happens to us. This passivity is characteristic of the politics of those who think we are stuck with the world we have. The best we can do is make money while events wash over us: ‘Don’t blame me. I didn’t start the war, I just bet on it.’ Such people may think they are ‘courageous’ or ‘gutsy’ because they take ‘risks’ (this is the way people in the financial sector have always talked), but the whole charade is a profitable supplication to, even a cowering before, the power of ‘the markets’. To put the case more gently, the appeal of ‘risk-taking’ just now, especially but not only to young men, may be an indicator of how little control many people feel they have over their own slice of the world, and of the feeling that they can’t shape their lives in a meaningful way. Marking time through a series of ‘settlements’ and ‘closes’, hoping for a windfall, may look like the best way to buffer oneself against an uncertain future.

The “hairdryer on an airport thermometer” phrase is a reference to a story I had not heard before about a temperature sensor at Charles de Gaulle Airport. It is dumb as hell in the best and worst ways you can imagine.

The only way users of Kalshi and Polymarket are predicting anything is if they have either knowledge of — or control over — an outcome. We recently had a by-election in Alberta. Kalshi members bet with 99% odds that one candidate would win — right up until the votes began to be tabulated. Betting on nigh everything is treacherous, and claiming it is not gambling but “prediction” markets is laughable.

The Last Skeuomorph in iOS? ⇥ jarrettfuller.blog

Jarrett Fuller [sic]:

It’s 2026 and when I click the button on my glass phone, it makes a shutter sound! There are still skeuomorphs in iOS after all! The skeuomorphic designs of the early camera simulated a shutter closing and opening when you a took a photo but that’s long been replaced with just a subtle blink of the screen. And yet! The shutter sounds remains.

As Fuller writes, it might be the very last one. I would also make a case for the lock sound. It is not quite the padlock noise it used to be, but it definitely retains a mechanical quality that resembles what it is supposed to be.

One nitpick:

[…] (The irony is not lost on me that this new phone actually does have a physical shutter. That shutter, though, is silent. Apple is essentually simulating the shutter sound while a real shutter is actually firing.)

The new iPhone has physical aperture blades on its main camera, but I am pretty certain it, like all iPhone cameras before, continues to use an electronic rolling shutter.

Update: Via Marcin Wichary, there is lots of good discussion on Kottke, including skeuomorphic icons for apps I do not keep on my Home Screen and, thus, forgot about.

Meta Revises Its Commercial Terms of Service Again ⇥ niemanlab.org

Andrew Deck and Hanaa’ Tameez, Nieman Lab:

In its revision, published Friday afternoon, Meta removed the word “train” from a list of allowed use cases and limited those uses to “advertising and business products,” rather than all Meta products. But the revised terms will still allow for broad scraping of websites, potentially superseding robots.txt files, according to legal experts.

Meta is adamant it will not misuse these capabilities in the way these legal experts say it can. If promises are being made by a company with the kind of public respect and trust Meta has, you can take its tweeted word over its new legal permissions for all the weight that it carries.

Tech Hype Is Cannibalizing the Future ⇥ techpolicy.press

Sun-ha Hong, Tech Policy Press:

Sometimes, failures do lead to wider stigma and skepticism around the technology in question. But this does not happen anywhere near as often as the massive levels of investment and inflated promises might warrant. The distinct characteristic of tech hype of the 21st century is the overwhelming centralization of wealth, cultural prestige and, increasingly, political autonomy that is used to instill a sense of inevitability around Silicon Valley visions of the future, and a sense of learned helplessness, or even “futurelessness,” for those who would prefer another path. Mark Zuckerberg and Meta thus live to dream another day, relatively unscathed from the over $80 billion burned at the altar of the Metaverse.

This pretty well encapsulates the myth-making qualities of Elon Musk, too, particularly after yesterday’s nonsense-filled Tesla “Roadster” announcement. (About which, by the way, Jameson Dow at Electrek has a theory.)

How Targeted Ads Become a Pipeline for Zero-Click Mercenary Spyware ⇥ citizenlab.ca

Bill Marczak, et al., of the University of Toronto’s Citizen Lab:

This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. We call the technique AdFection, and show how it was used to infect devices at Al Jazeera with Candiru’s spyware. We also uncover Discover-Tech, and show how the company helps mercenary surveillance vendors track and hack devices around the world.

Jillian Kestler-D’Amours, CBC News:

Citizen Lab said it was able to confirm a targeted spyware attack on Al Jazeera: At least 45 of the Qatar-based news outlet’s devices were infected with spyware via Discover-Tech’s ads in 2024 and 2025, the report said.

[…]

An Al Jazeera Media Network spokesperson told CBC News in an email that it “strongly condemns the targeting of our staff with mercenary spyware.”

This investigation is worth your time; it is disturbing. It solidified two things for me: the display advertising technology stack is a global threat, and behaviourally targeted advertising needs to be banned. Obviously, installing an ad blocker is mandatory now, and any website that relies on anti-ad blockers like Admiral does not respect you.

Meta’s New Business Terms Appear to Supersede Opt-Outs for A.I. Training on Commercial Websites ⇥ niemanlab.org

Andrew Deck and Hanaa’ Tameez, Nieman Lab:

Meta can use web scrapers to crawl and collect content from websites “associated with” business accounts on its platforms, according to its new commercial terms of use.

[…]

The new terms broadly cover business accounts that manage pages and groups, run advertisements, push marketing messages, and use the platform’s business account dashboard. As written, the new terms could be used to argue that Meta can scrape content from news sites and use that content to train the company’s AI products, according to three legal experts who reviewed the terms at Nieman Lab’s request.

Short of businesses deleting their Meta accounts, there does not appear to be a way to opt out of the new terms. This seems to me to be one way to better insulate the company from the potential consequences of fair use arguments that have mixed results in U.S. courts.

Update: Meta’s Andy Stone disputes this analysis, and says “content owners can use robots.txt flags to indicate their preferences”.

Evidence Does Not Show Decreased Russian Propaganda After Ukrainian Strikes on Yandex Data Centres ⇥ lawfaremedia.org

Renée DiResta, writing for Lawfare:

There is a real event underpinning the story, and an authentic chart showing a dramatic decline in automated internet traffic. But the leap from a viral chart to the disappearance of Russian propaganda bots is a large one. Much of the apparent corroboration comes from anecdotes about how social media feels, rather than measurements of what actually changed. And this speaks to a broader problem: as platforms have reduced access to data, and as “disinformation” has become a politically contentious term, the ability to investigate claims about online manipulation has decreased.

My concern remains that offloading responsibility for the toxicity of online spaces to foreign propaganda campaigns makes it more difficult to confront the actual problems. There is plenty of blame to go around. Russia has, as DiResta put it in a 2018 New York Times opinion column, developed an “enthusiasm for and commitment to modern information warfare”. Other countries are also using social media for propaganda and misinformation, too.

But some blame should also be apportioned to the platforms that incentivize bad actors, and those that accept no responsibility for what they promote. Of course, there are also the individual users who are hostile and abusive toward others. This is made possible in part by platforms that moderate poorly and tacitly — and, in some cases, explicitly — encourage an outrageous environment. But it is also the fault of individual users who spread lies, hate, and harm. Many of them are not foreign actors, but our neighbours right here at home.

Here’s to the Normal Ones ⇥ time.com

Time announced its roundup of what it thinks are the best inventions of 2026. Among them are John Ternus — or so it would seem — and the iPhone Duo.

Andrew R. Chow profiled Apple’s new CEO, and this excerpt has caught some eyes:

But Ternus and other Apple executives say they aren’t concerned. In the midst of a populist AI backlash, they contend that they are building a modest but personalized and privacy-preserving form of AI that will actually help ordinary people as opposed to merely dazzling Silicon Valley’s “lunatic fringe,” as Greg Joswiak, senior vice president of worldwide marketing, puts it. And besides, Ternus argues, even if other companies succeed in their mission of building super-intelligence, users will still want to talk to it on Apple devices.

I hope the “lunatic fringe” is very upset about this. Perhaps they can be so upset that refurbished Mac Studios can be restocked. Oh, please.

Joining the iPhone Duo among the “best inventions” are the Brick and Dumbphone 2, two devices that attempt to get you to put away your smartphone, and the Plaud NotePin S, another entry in the apparently booming category of A.I. note-taking products.

W Social Makes Verified Users’ Personal Details Visible on the Open Web ⇥ blog.elenarossini.com

Elena Rossini:

W Social is a European social media company that launched in Davos earlier this year, during the World Economic Forum. I have written a series of articles about them; […]

[…]

I wonder: are W Social verified users aware that their personal details (first name, last name, nationality and approx. birthday) are being shared OUTSIDE of W Social and published as a permanent record on the web, in plain text?

This has to be in violation of European privacy laws, right? No way would anyone expect their full legal name to be publicly accessible. W Social disputes this framing and has taken an aggressive posture in response.

‘A Man From the Future’ ⇥ petshopboys.co.uk

The Pet Shop Boys have a new album out:

Created in collaboration with Alan Turing biographer, Andrew Hodges, and performed by Pet Shop Boys and the Manchester Camerata Octet with narration by Juliet Stevenson, string arrangements by Sven Helbig and additional production, programming and synthesisers by Maarten Vos, the work explores eight significant chapters in the life and death of Alan Turing, the pioneering British mathematician and cryptanalyst who laid the foundations of modern computing.

There are some wonderful poetic choices across the whole record.

Elevation Lab Pulls Its AirTag Silencing Product ⇥ elevationlab.com

Not too long ago, Apple accessory company Elevation Lab released a product designed to silence the noises made by AirTags when they are out of range. That is a reasonable idea for an AirTag installed in something someone might steal. It is also a dangerous product in the hands of someone who might want to stalk or harass another person, a distressingly well-documented use of AirTags.

Elevation Lab, today:

We have removed the product and will use our patent on it to prevent anyone else from making one in the future.

This is excellent news — a necessary correction for, as the Electronic Frontier Foundation’s Eva Galperin put it, “the mindset that things are more important than people”. Kudos to Elevation Lab for doing the right thing.

Tired of Recommendation Engines ⇥ ethanmarcotte.com

Ethan Marcotte is tired of all the recommendations and suggestions in internet services. For the most part, I am, too. At the very least, I dislike how much they feel imposed or as a default, as though my use of most services should flow through the suggestions they provide.

Even calling them “suggestions” or “recommendations” feels a little bit generous for sites like YouTube — where continuous playback to an automatically selected video is on by default — or Instagram, where algorithmically selected posts can only be “snoozed” from the timeline for thirty days at a time before they are automatically re-enabled.

It should not be so difficult for me to simply look at things I want to see and, just as importantly, not see things I do not want to look at.

The Probably Fake Russian Troll Exodus ⇥ br.de

After Ukrainian forces struck several data centres belonging to Russian internet services giant Yandex, a couple of charts began circulating social media purportedly showing a decline in traffic from Russian bots. The narrative suggested — by people like political scientist Ian Bremmer, journalist Jamie Dupree, TPM’s Josh Marshall, and historian Timothy Snyder — is that these attacks silenced a noticeable number of automated troll accounts on X, particularly those promoting far-right talking points.

This does not appear to be true.

There are two charts in question. The first, as posted by Dupree and others, is sourced from Cloudflare data indicating a precipitous drop in Yandex bot traffic. But, as Jowi Morales writes at Tom’s Hardware, this does not show a reprieve from nefarious users:

Yandex is Russia’s equivalent to Google, and its Yandex Cloud service status reports that at least 84 services are currently offline. Global internet monitoring firm NetBlocks said that Yandex’s network traffic has dropped to just 30% for Yandex Cloud and 63% for Yandex LLC, most likely resulting in slower internet services or complete disruption for the average Russian. […]

Yandex operates search engine crawlers, just like Google, which are referred to as “bots”. This is, in part, what these data centre strikes took out, and the reason Cloudflare is seeing a big drop in traffic from Yandex.

The other chart is a doozy. It was popularized in an X post by Tomáš Zdechovský, a Member of the European Parliament for the Czech Republic, though its original source is unknown. It purportedly shows a massive recent decline in social media posts promoting the far-right Alternative für Deutschland party, with Zdechovský suggesting “[s]o much talk about German patriotism… then the connection from Russia goes down. 🤔🇷🇺” But the chart itself does not indicate this is AfD-related traffic at all. The title translates to “daily activity over 3 months” — but “daily activity” of what, exactly, is not defined.

Max Gilbert, of German public broadcaster Bayerischer Rundfunk, looked into the chart and found it was full of problems (this is how Safari translated the article for me):

It is striking that the graph on the 15th October ends, so a date in the future. According to #Faktenfuchs-Recherche, the graphic was first published on the 11th. Posted in October. That data is available for an already future date is obviously not possible.

[…]

Which platforms were examined here, how the variable “activity” comes about: All this remains unclear. The unknown or possibly non-existent data base as well as the inaccurate scaling and values “from the future” show that this is not a meaningful, fact-based graphic created according to statistical methods.

Tom Wannenmacher, of Austrian fact-checking site Mimikama, also published a good explanation of the two charts. And overall Russian bot traffic has not really declined recently.

Unfortunately, these charts and their narrative have been circulating widely for days and, I bet, will live on as a kind of orphaned factoid among the terminally online. It is disappointing how uncritically these charts were accepted. There are, of course, disinformation networks and state propaganda all over social media. But when we focus too much on the involvement of foreign actors and unhinged trillionaires in our dire political state, we may forget how much of it is grown right here and self-inflicted.

Satya Nadella and Marc Benioff, Toadies ⇥ cnbc.com

Greg Iacurci, CNBC

Microsoft Chairman and CEO Satya Nadella on Saturday called for advanced artificial intelligence systems to be built with containment, independent controls and an “emergency brake” that lets authorized people pause or shut a model down mid-task.

“We need to surround non-deterministic models with strong, deterministic system design, human controls, and reliable operating procedures, and establish industry standards where existing ones are insufficient,” Nadella wrote in a post on social media platform X.

What Nadella actually wrote is an essay which does not contain the word “artificial”, but instead uses the phrase “super intelligence” four times and otherwise — because it is obvious and embarrassing what he is doing — simply refers to the technology as “intelligence”.

Marc Benioff, also on X:

The era of Super Intelligence is here. AIForce is officially SIForce.

There is no legal or moral requirement to replace the vocabulary of “artificial intelligence” unless one is trying to appease a dumb and unpopular administration. Truly spineless stuff from Nadella and Benioff alike.

The People Holding Up the Internet ⇥ sheets.works

Sheets.works put together an excellent but — perhaps ironically — unbylined visualization with this simple premise:

Billions of phones run on code looked after by a handful of people. We counted them from the code itself.

I had no idea SQLite or sudo were maintained by such a small number of individuals and — like many other examples in this story — seemingly without the financial support of the companies relying on their work. Some of those are among the most valuable companies on the planet.

Next Year, YouTube Will Allow Testing Different Versions of the Same Video ⇥ youtube.com

Aparna Pappu of YouTube:

This builds on the incredible success we’ve seen with other Studio tools like A/B testing, where creators have run more than 40 million experiments to find the perfect titles and thumbnails for their videos since the feature officially launched in 2024. Coming soon, you’ll also be able to test up to three video cuts to see which hook performs best with the new video A/B testing feature.

This is a very short introduction to a potentially very transformative feature: different people will now be watching different versions of what is ostensibly the same video.

Marques Brownlee has a thoughtful video about the potential consequences and I think it is worth your time. Brownlee got to speak with some YouTube engineers about his concerns — including really basic questions like whether someone will know they are watching a video that has other versions — and they apparently had few answers. One thing they did address, though, is that this feature is apparently intended to allow slightly different variations and not wholly different videos. Some mysterious-to-everyone A.I. analysis will determine whether the variations are similar enough to permit A/B testing.

YouTube announced this feature about two weeks ago, and according to Brownlee, it will be launching next year. I am not exactly plugged into the YouTube world but this is the first I am hearing of it and, while I would like to believe YouTube will adequately communicate this closer to launch, I think most video viewers are going to find this unpleasant and surprising. If it rolls out as described now, I bet you will see a lot of confused comments under videos with people referencing something that only happened in one version.

Meta Is Restricting Some Pages to Two External Links Per Month Unless They Pay Up ⇥ pressgazette.co.uk

Meta:

Drive people directly to your website, shop or latest offer by adding a clickable link to your Instagram posts and reels. People can visit the website from your post or reel.

If you subscribe to a Meta One plan, you can add links to a set number of posts and reels each month based on your plan: […]

It seems utterly bananas to me that Meta is pitching links as a feature people need to pay for, but here we are.

Instagram has never supported links of any kind in individual posts, so that is a new feature with two links per month permitted for free, and more enabled by this pricey subscription — starting at $50 USD per month for four posts per month containing external links. But links in Reels have been commonplace for years. Meta is now gating that, too; and there is more.

Andrew Hutchinson, Social Media Today:

As outlined in the explainer, some accounts are now being limited to two link posts on Facebook per month, unless they pay for a Meta One subscription.

Charlotte Tobitt, Press Gazette:

Until now it has been unclear whether news publishers will come up against the link limit. But Press Gazette understands that news publishers are excluded – as they were from similar tests for the Meta Verified subscription (now folded into Meta One) that began at the end of last year.

However it has not been confirmed how Meta defines who falls into this category – and Press Gazette is aware of small publishers that have been told they hit the free link limit.

Meta seems to have two objectives here: to take a cut from businesses that use Meta’s services as a referral source more generally, and — more specifically — to capture some of the money made by influencers. There are people who post essentially one ad after another, without compensating Meta, as they have a personality that can carry a sales pitch. Those users are extremely dependent on their Instagram following for their own careers. I think Meta believes it can extract hundreds of dollars per month, at the highest end of Meta One’s tiers, from people who want to keep their referral code links.

Between this news and the expansion of Google A.I. features, it is extraordinary to see what were, in 2023, the two top referral sources make moves to become more insular.