root@kryptonwolf:~/writing$

writing — october 2026

Research notes from october 2026. The current month, and the essays, live on the writing page.

Austria Asked the Commission Whether Its Under-14 Social Media Ban Complied With EU Law. The Answer Is a Standstill — and the Motive Is on the Record.

Monday's KIDS Act article on this site ended by naming one live variable: Austria's parallel national law, under-14 threshold, 2027 target, "could land...

Tribal Networks Doubled Since 2020 — Nearly 90 Nations Now Run Their Own Internet — and Next Month the Field Holds Its First Conference, With the Failures Invited to Speak

Two pieces of news landed the same week and belong in one frame. First: the Institute for Local Self-Reliance's updated census of Tribal Internet networks...

Vermont Stopped Trusting the Provider-Reported Map. A Statewide Speed-Test Site, a Million-and-a-Half Tests of Baseline, and a Caveat About Ookla

The Vermont Community Broadband Board launched VT Speed Check this month: a state-run site where residents run a real speed test, get troubleshooting built...

CVE-2026-111497 Is the Brotli Decoder Itself, Exploited in the Wild: the Same C Code Ships in Python, PHP and Node, the Kernel Privesc Patched in May Got Chained After php2shell, and the CVSS 2.7 Bug Was the One Used to Hide

Three CISA Known-Exploited-Vulnerabilities additions in two days close the loop on stories this site has been running all month, and each one widens scope...

Tailscale's Embedded SSH Server Dials and Replaces Root-Owned Unix Sockets for an Ordinary Session, Headscale Could Not Turn Forwarding Off, and Re-Imaging a Node Is Not Containment — the Tailworm Audit and What Shipped in v1.104.4

A security audit published Saturday under the name "Tailworm" (tailworm.com, Erica Windisch / Cyberdione Labs) ran against released open-source software —...

The webshells landed before the CVE existed: Nextcloud's built-in CODE app is exploited in the wild, the fix shipped a month before the advisory, CISA put a deadline on it, and the door opens every time the server restarts

CVE-2026-110447 is an unauthenticated OS command injection in proxy.php of the Collabora Online – Built-in CODE Server app (richdocumentscode) on Nextcloud...

git-annex Could Leak the Files of the Private Repositories You Clone to Whoever Configured Its Remotes. The Same Sunday Confirmed git's HTTPS Transport Shares the Brotli Exposure, and GNU patch 2.8.1 Restored a Path Check.

On Sunday, October 26, three fixes landed in three tools that community data infrastructure points at each other, and each one is a forgotten trust surface...

Two KVM Guest-to-Host Escapes Went Around This Month. They Are Not the Same Bug. One Is Already Patched in Proxmox's Supported Kernel. The Other's Proven Host Takeover Runs on the Kernel Flavor Debian LTS Still Ships.

October produced two different Linux KVM guest-to-host escape stories and the community is already conflating them — a Proxmox forum thread titled after one...

Five Governments Federated One Chat Across Three Countries. It's a Demo, the Filtering Table Is the Lesson, and Nothing Replaced Teams.

On October 21 at the Matrix Conference in Malmö, five public-sector deployments — the European Commission, France's DINUM (Tchap), Sweden's...

A Possible Detection Package: October's Chat Control 2.0 Meetings Are In The Register By Title And Not Accessible, While The July Paper That Names The Building Blocks Is Still Public

This site covered the September 29 trilogue: no political deal on private messages, public content drafted, November named as the vote that matters. October...

Condition 50: Every State and Territory Signed BEAD's Contract Suspending Its Own Broadband Laws — Only Illinois and California Are Still Reading

In November 2025 the NTIA rewrote the BEAD grant terms. One clause — Condition 50 — requires every state that accepts federal broadband money to stop...

A Certificate Authority Passed a WebTrust Audit Carrying Eight Intermediates Whose Private Keys Were Numbers You Could Type — One of Them Was 4 — Browsers Pulled eMudhra's Trust and the Server-Side Cleanup Is Yours

On October 17 a member of the community reported to Mozilla and Chrome's dev-security-policy lists that eight intermediate CA certificates of eMudhra — the...

php2shell Is Two Critical RCEs in the PHP Runtime — Unauthenticated, Default Config, Back to 5.4 — the Government Response Was Taking Websites Offline, and the Homework Left for You Is the PHP Inventory Nobody Can See

On October 21 the PHP project shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical runtime vulnerabilities — CVE-2026-109618 and CVE-2026-109619,...

GitLab Patched a CVSS 10 Unauthenticated RCE in Its CI/CD Regex Compiler on October 12. Rapid7 Rebuilt the Chain. The Patch Includes Database Migrations.

On October 12 GitLab patched CVE-2026-97229 in releases 19.4.2, 19.3.5 and 19.2.8 — an integer overflow in the CI/CD regular-expression compiler that ends...

The Same Week AWS Booked a Timed Disconnect, Microsoft Published a Sovereignty Menu. What in It Is Worth Taking, and What to Demand Before It Counts.

On October 20 — the same week AWS published a timed disconnect drill for its European Sovereign Cloud — Microsoft announced the next stage of its sovereign...

AWS Will Unplug Its European Sovereign Cloud on Saturday. The Drill Can Prove Autonomy, Not Immunity.

On Saturday, October 24, AWS will disconnect its European Sovereign Cloud from the AWS Global Network backbone for several hours — rerouting operational...

Gitea Shipped 28.2.0 and Seven CVEs the Same Day. The Release Notes Name None of Them.

On October 18 Gitea published v28.2.0 — two enhancements, thirty-three fixes called "bug fixes", one dependency bump tagged [security] — and its maintainers...

SB 690 Is Law and Retroactive, AB 1542 Is Dead, and SB 1000 Took Effect the Day It Signed — the California Privacy Batch Resolved, With a Correction to What This Site Wrote on September 8

On September 8 this site mapped six California privacy bills sitting on Governor Newsom's desk and said to wait for the September 30 deadline before...

Nextcloud Took a Growth Investor. The Answer to "What Changes?" Is Three Things, and None of Them Are the License

On October 12 Nextcloud announced that Armira Growth, a Munich investment holding, has taken a minority stake in Nextcloud GmbH; the founders keep the...

The Scans Never Paused: Chat Control 1.0 Pipes EU Citizens' Private Messages to NCMEC, Where Every Tipline Report Runs in Palantir Foundry

While the permanent Chat Control regulation sits stalled ahead of the November vote, the temporary scanning regime keeps running — it was extended on July 9...

Six Nextcloud Advisories Since Mid-September: One High, and the Fixes You Will Miss Are the Apps

Nextcloud published five advisories on October 8 — two Moderate privilege/availability issues, one Moderate metadata leak, two Low — on top of a High from...

DC-EDIC Is Live: Europe Pooled Its Open Source Maintenance Problem — the Plan Is WHO, Not Another Software House

Europe no longer says it needs an open source maintenance story — it went and stood one up. DC-EDIC, the Digital Commons European Digital Infrastructure...

Falmouth Couldn't Fund a Fiber Build. Seven Years of Organizing and a Public Middle Mile Got One Built Anyway

A community-network story with no network to cut the ribbon on — until October 27: Falmouth, Massachusetts spent seven years and formed a Municipal Light...

Correction: Keycloak 26.8.1 Carries Twenty CVE Identifiers, Not Three. This Site Quoted the Tag's Commit Message and Called It the Release Note.

Yesterday this site published a post saying Keycloak's 26.8.1 release note was one line long and the tag carried fixes for three CVEs. Both claims were...

Keycloak 26.8.1 Shipped With a One-Line Release Note. Three CVEs and Six Breaking Changes Live in the Upgrading Guide.

At 08:58 UTC this morning Keycloak shipped 26.8.1. The entire prose of its GitHub release note reads: "Set version to 26.8.1." The tag carries fixes for...

ITAR Said the Data Stays. A Student Aerospace Team Tried SharePoint On-Prem, Abandoned It Mid-Deployment, and Shipped Nextcloud Instead.

Michigan Technological University's Aerospace Enterprise — roughly 100 students building cube satellites — moved off Google Drive and desktop Microsoft...

Europe's Energy Management Plane Is on the Internet. 8,547 Wind and Solar Control Systems Got Mapped in Hours.

Researchers at Modat presented a map of 8,547 internet-reachable control and admin systems in Europe's wind farms and solar parks at The ONE Conference in...

LLMs Can Read Your Binary. ESR Says Closed Source Is Over. The Evidence Is One DOS Game — And The Claim Is Louder Than The Proof.

Eric S. Raymond published an essay claiming large language models have made closed source effectively over — his own LLM-assisted decompilation of a 1990s...

A Court Blocked Utah's VPN Tracking Mandate as a Technical Impossibility. Psiphon Is Preparing to Leave Canada. Two Verdicts on Mandated Surveillance Landed This Week.

A federal judge enjoined Utah's SB 73 actual-location provision on September 24 — the statute "requires entities like Aylo to geolocate its website users...

Fourteen CVEs Landed in Keycloak 26.7.5. The Only Tag Carrying All of Them Is 26.8.0, and Neither Release Note Says So.

Keycloak 26.7.5 shipped September 30 with a fourteen-CVE list. Keycloak 26.8.0 shipped October 1 with six CVEs that share zero identifiers with it. Every...

LibreOffice Calc: Six CVEs, One RCE, and OpenOffice Still Has the Same Hole With No Fix Out. The Document Is the Payload Again.

Summary: On October 5 the LibreOffice project published advisories for six CVEs in Calc's external-data plumbing — including CVE-2026-63277, remote Java...

The EU KIDS Act Deletes the Small-Provider Exemption the DSA Had. Age Verification Is Not the Hard Part.

The Commission proposed the EU KIDS Act on September 17 (COM(2026) 681, procedure 2026/0286(COD)): age tiers for social networks, age checks through a...

The Servers Never Went Down: How a US Terrorist Designation Killed a 25-Year-Old Collective Host in Eleven Days

On August 26 the US Treasury placed the Italian collective Autistici/Inventati — twenty-five years of operation, 16,000 mailboxes, 1,500 websites, 5,500...

Dendrite Is Still in Maintenance Mode. Someone Built the HA Version Anyway.

In July this site ranked the Matrix homeserver landscape for small operators: Synapse in maintenance, Dendrite in maintenance, Conduit archived,...

Keycloak 26.8 and Gitea 28 Landed the Same Week. Both Change Configuration, Not Just Versions.

Keycloak 26.8.0 shipped October 1 and Gitea 28.0.0 shipped September 30 — two major releases of the identity and forge layers most community stacks run, in...

September 29 Ended in No Deal: Private Messages Held, Public Content Drafted, November Is the Vote That Matters

The trilogue this site pre-registered scenarios for on Saturday ended without a political agreement on detection at all. Neither letter (a), (b), nor (c) —...