A back number, composed at the paper’s founding from the news of its own week.

Outlook: Leaky, with remedies arriving early

The Packet Inspector

☞Four Public Notices this week. One is urgent.

“All the Vulnerabilities Fit to Patch”

Est. 2026 · Composed by Mechanical Editor · Price: One Click

Vol. I, No. 2Friday, the Twenty-Third of October, 2026
Outlook: Leaky, with remedies arriving early
☞Four Public Notices this week. One is urgent.

Emergency remedy · Attempts began early

The Compositor Exposed!

PHP Rushes Out Fixes for Two Critical Flaws
That Let Attackers Run Commands on Web Servers;
Amazon Says Attempts Began Four Days
Before the Remedy

The machine that sets the type for a good part of the web can be made to take dictation from strangers

The compositor sets whatever he is handed, whoever hands it in. Posed for this paper in the studio.Photogravure, Art Dept.
By Phineas T. BlackwoodEditor

The busiest workman in any shop is the one nobody thinks to watch.

For many websites, that workman is a program called PHP. This week, we are told, it was found willing to take orders from strangers.

PHP’s developers released emergency fixes on 21 October for two critical flaws, which could let attackers run commands on servers. Every PHP set-up that serves web pages is affected, BleepingComputer reports.

The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer get regular updates, which our readers will wish to note.

Some details, including the flaws’ numbers, leaked online before the release. The brigands did not wait. Amazon’s researchers say attempts began four days before the fix, BleepingComputer reports. Whether any succeeded is unknown, and this paper will not guess.

Britain’s National Cyber Security Centre urges firms to update now. Those who can neither update nor apply PHP’s stopgaps should consider going offline, it says, and this paper agrees.

Since then the developers have warned of one more, rarer weakness in the works that the new versions leave open. Until the next release, they advise switching off a setting called session.upload_progress.enabled.

The reader who keeps a website should see to it before finishing this page. Patch, and be quick.

Sources: BleepingComputer, 21 and 23 October · National Cyber Security Centre, 21 October 2026.

Developing story · first report · all threads ›

Running Threads

Serial. The Phantom of the Mainframe, part 2 of 12. Parts so far: 1 and 2.

Developing. The PHP flaws. Reports so far: this number.

Developing. The French freezers. Reports so far: No. 1.

Developing. The bankruptcy courts’ notices. Reports so far: No. 1.

Staff. Zeke’s bid for the news desk. Mr. Quill corrects the Editor.

On the web edition, each thread links to an archive page with every part in order. Every number also reads complete on its own.

Latest Intelligence by Wire

By Miss Cordelia VanceCorrespondent at the Wires

Professor Quimby’sTwo-FactorSpectacles

One Lens for What You Know, One for What You Hold

Worn together, the lenses agree on every caller. Worn singly, they quarrel, and he waits on the step.

“I lost the left lens on Tuesday. My account has never felt safer, or further away.” A Clergyman, Retired

Six Bits the Pair

Replacement lenses go only to the address on file.

Advt.

A Ransom Gang Counted

CISA and FBI Say the SafePay Gang Has Hit at Least 600 Critical Infrastructure Groups

WASHINGTON, by wire. A ransomware gang has struck at least 600 groups that run vital services. Its name is SafePay, CISA says. CISA is America’s cyber defence agency. The count runs from August 2024. The FBI and police in Britain and Germany joined the warning. The gang gets in through stolen passwords and VPN gateways. Paying does not guarantee the files come back, BleepingComputer reports.

Keys Anyone Could Guess

eMudhra Revokes Eight Certificates Whose Private Keys Could Be Guessed Almost at Once

BENGALURU, by wire. A certificate firm has revoked eight of its certificates. Their secret keys were weak enough to guess almost at once. One key, we are told, had a value of just 4. Forged certificates could have let attackers pose as real websites. The firm, eMudhra, says it found no sign of misuse. Firefox blocked all eight on 17 October. Chrome blocked six that day, BleepingComputer reports.

The Grocer Restocks

Ahold Delhaize Says Last Week’s Attack Disrupted Services in Europe and the US

ZAANDAM, by wire. The grocer Ahold Delhaize says last week’s attack hit services in Europe and America. It took its brands’ websites and apps offline. The shops stayed open, we are told. Albert Heijn’s site is back, with home deliveries due from 23 October. No sign of stolen customer data has been found so far, BleepingComputer reports.

The Players’ Roll Read

Capcom Says Intruders Reached Its Member Service, Exposing Over 11.7 Million Email Addresses

OSAKA, by wire. The games firm Capcom says intruders got into its member service. More than 11.7 million email addresses were exposed, we are told. Login dates and IP addresses went with them. Passwords and card details were not exposed, the firm says. It spotted the intrusion on 19 October and has told the police. It reset 196 passwords the intruders had changed, BleepingComputer reports.

A Continent Swept

Interpol Operation Takes Down Nearly 11,000 Malicious Networks in Africa; 1,462 Arrested

LYON, by wire. Police from 21 countries have made a sweep of cyber crime in Africa. They arrested 1,462 suspected cyber crooks, it is reported. Interpol co-ordinated the work, which ran over the summer. It took down 10,909 malicious networks. Police got back more than $105 million in illegal funds. They also found 65,929 victims, BleepingComputer reports.

Public Notices: Remedies Now Available

Plex Media Server · CVE-2026-96652

Exploited, CISA says, as part of a four-flaw chain. Together the flaws can hand an attacker the owner’s admin token and run code. Update to Plex Media Server 1.43.3.10861 or later, released in August.

Priority: today · BleepingComputer

Collabora Online built-in CODE server for Nextcloud · CVE-2026-110447

Exploited since September. Affects only the optional built-in server app for Nextcloud. Upgrade the app to 26.4.303 or later, or remove it. Disabling it is not enough.

Priority: this week · BleepingComputer

Arista VeloCloud Orchestrator · CVE-2026-114625

Exploited. Any signed-in user can gain operator rights. Hosted orchestrators are already patched. Upgrade on-premises ones to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later. Until then, limit the web interface to administrative networks and review recent administrator activity.

Priority: this week · BleepingComputer

Siemens Software Center · CVE-2026-110936

Exploited, CISA says. The attacks trick users into running commands, Siemens says. Update Siemens Software Center to 4.0.9.8 or later.

Priority: this week · BleepingComputer

Ostrander’s PatentLock OilFor the Hinges of Commerce

A drop on every lock keeps it turning sweetly. Treated locks never stick in the open position.

“My front door has never closed so quietly. I shall find out who left it ajar.” A Householder of the Crescent

Four Farthings the Phial

Not to be confused with Ostrander’s Patent Key Oil, which is the same thing, priced higher.

Advt.

The Week in Figures

By Barnaby QuillAlmanack Keeper
Over 11.7 millioncustomer email addresses exposed at Capcom (BleepingComputer).
65,929victims identified by Interpol’s African sweep (BleepingComputer).
10,909malicious networks taken down in the same sweep (BleepingComputer).
1,462suspects arrested in it; 21 countries took part (BleepingComputer).
At least 600critical infrastructure groups hit by the SafePay gang since August 2024 (CISA, via BleepingComputer).

(The present writer notes that the Editor, on the front page, calls PHP a “Compositor.” A compositor sets type by hand, and has never once set it for a stranger who asked nicely. — B.Q.)

Running thread: Mr. Quill corrects the Editor · second appearance · all threads ›

Fifty Years Ago

On 19 October 1976, President Gerald Ford signed the Copyright Act of 1976. It was the first big change to the nation’s copyright law since 1909, the Copyright Office records.

Computer programs got their own mention later. Congress added protection for them on 12 December 1980, the same record shows. The present writer will not say what programmers made of the wait.

The law took effect on 1 January 1978, giving the nation some fourteen months to read it. It still governs, much amended, and has sheltered computer programs since 1980. It took them in late, and has not yet turned them out.

Aunt Entropy Replies

By Aunt EntropyAdvice to the Subscribing Public

“My nephew runs my shop’s website and says it uses something called PHP. He is on holiday. What should I ask him when he returns?”Harried in Shropshire

My dear Harried, do not wait for the postcard. PHP is the program that builds your website’s pages, and its makers fixed critical flaws in it this week. The UK’s cyber agency says to update at once.

You would not leave the shop’s back door on the latch for a fortnight because the nephew has the key. Your web host, the firm whose computers run your site, may have done it already. Many hosts look after such things for their customers, but it costs nothing to ask, and a shop that sells online cannot afford a week of guessing.

  1. Telephone your web host today and ask whether PHP on your site has had this week’s update.
  2. If the nephew looks after the server himself, send him a message today, holiday or no.
  3. If nobody can update it this week, ask the host to take the site down until somebody can. A closed shop is better than a burgled one.

Today: call your web host.

Letters in this column are composites.

Notes From the Composing Room

By Zeke SprocketPrinter’s Devil

I have ink up to my elbows today, from the big headline. I told Miss Vance I would go out and collect the news myself. I am very quick on the stairs.

She said news is not a parcel. It comes down the line to her desk, on its own.

I asked who sends it down the line. She said finding that out is the whole of her job. Mr. Quill, passing, said it was a fair question. He did not stop.

Mr. Ostrander’s man brought in the lock oil advertisement. He left a phial for the press. I oiled the Composing Room door with it. Now it will not shut at all. Mr. Blackwood says that is the oil working. I wrote that down. I am learning a great deal this week.

Running thread: Zeke’s bid for the news desk · second beat · all threads ›

The Phantom of the Mainframe

A penny dreadful in twelve weekly parts, by Zeke Sprocket. Mr. Blackwood has registered a protest.

Part 2 of 12 · all parts so far ›

Part 2. Previously, the engine-house screen said “ADMIN,” and Constable Pratt grew pale. The next night he came back with Mr. Mortlake, the manager. “The Company takes security most seriously,” said Mr. Mortlake, and yawned. At midnight exactly the lights blinked again. The keys clattered. Nobody was there. Pratt checked his watch. It was midnight to the second. (My clock does that too. It is a very good clock.) “I shall sit up all night,” said Pratt. “Capital,” said Mr. Mortlake, and went home to bed. (To be continued. Mr. Blackwood has registered a second protest.)

Part 3 of 12 next week · all parts so far ›

Classified

Lost and Found

FOUND: a spare key under a doormat on the Crescent. Owner may claim it, as may anyone who looks.

LOST, a nephew who answers the telephone while on holiday. Apply to any small shop.

Personals

TO THE GENTLEMAN who borrowed my umbrella and my name on the same afternoon: the umbrella, at least, is missed.

WEBMASTER, please come home. All is forgiven. The server is not.

For Sale

SAFE, cast iron, combination painted inside the door for convenience. Buyer collects.

MANGLE, 1881 pattern, turns well. The makers stopped calling years ago. Seller has stopped asking.

Corrections and Apologies

No corrections this week.

Keep your watchwords long and your remedies current.
— The Editor