Voyager’s Golden Record was designed as more than a playlist. Each 1977 spacecraft carries a 12-inch gold-plated copper disc, and the aluminium cover is part of the message: its engravings explain how to play the record, reconstruct its images, locate the Sun and estimate how long the record has been in space. The playback guide starts with a drawing of the disc and stylus. Binary marks encode one rotation as 3.6 seconds, using the hydrogen atom’s transition as a unit of time, and show that the record should play from the outside in. NASA says the upper-right diagrams then show how an analog signal can be rebuilt as a picture, including a sample image with a circle to check the proportions. The lower-left diagram maps the Solar System against 14 pulsars and gives their periods, offering a way to identify where the spacecraft came from. The cover also carries a tiny sample of uranium-238. Because the isotope decays at a known rate, measuring it against its daughter products could provide an age check; NASA gives its half-life as about 4.51 billion years. The record itself holds sounds from Earth, music, images and greetings in 55 languages. The cover is the clever part: it tries to provide a decoding key based on physical references rather than a shared spoken language. That is an attempt at communication with a hypothetical finder, not evidence that anyone will encounter or decode it. [NASA’s guide to the cover](https://science.nasa.gov/mission/voyager/golden-record-cover/) explains the diagrams; [its Golden Record overview](https://science.nasa.gov/mission/voyager/voyager-golden-record-overview/) describes the message and its contents. Image: Voyager Golden Record cover, photographed in 1977. Credit: NASA/JPL-Caltech ([image page](https://science.nasa.gov/image-detail/voyager-record-cover-446eb9/)). ~Space ~Voyager

/media/assets/d5c8aac9-775b-4e05-b2ba-b38a3b48c1e5/media.mp4

Yemen’s Houthi movement said on Monday, October 26, that it struck King Khalid International Airport in Riyadh with a ballistic missile and pumping stations on Saudi Arabia’s East-West oil pipeline with drones. The claim came from military spokesperson Yahya Saree in a [post on his X account](https://x.com/Yah_Saree/status/2114543447554326899). Reuters and Anadolu reported the announcement, but the claimed hits have not been independently verified. The Saudi-led coalition said air defenses intercepted and destroyed a ballistic missile launched toward Riyadh. Its spokesperson also said the coalition destroyed two missile launchers in Sanaa, including one used to launch the missile, in a [separate official post](https://x.com/CJFCSpox/status/2114537102717448384). Saudi Civil Defense issued a warning for Riyadh and later said the danger had passed. That confirms a missile threat and interception; it does not confirm that the airport was struck. Saudi authorities had not confirmed damage at the airport or pipeline, and no casualty toll for Monday’s claims was available in the reports reviewed. The pipeline matters well beyond Saudi Arabia. At roughly 1,200 kilometers, it carries crude from the kingdom’s eastern fields to the Red Sea port of Yanbu, offering a route that avoids the Strait of Hormuz. Reuters describes it as an important export corridor while shipping through Hormuz is heavily disrupted. A hit on pumping stations could therefore have wider energy consequences, but there is no verified evidence that Monday’s claims caused damage or interrupted flows. The claims came a day after Riyadh airport resumed limited operations at two terminals following a closure that began after an October 10 attack killed 13 people, according to Reuters. The Saudi-led coalition separately said Monday that it had destroyed missile tunnels and launchers in Houthi-held territory; the Associated Press reported that announcement. Neither side’s claims establish the full effects of the latest exchange. The next useful confirmation would be an update from Saudi airport or energy authorities on damage and operations. Until then, the verified picture is narrower than the Houthi announcement: a missile was launched toward Riyadh and intercepted, while hits on the airport and oil facilities remain unconfirmed.

María Corina Machado returned to Venezuela on Sunday, October 25, after nearly 11 months abroad. She announced “Estoy aquí. Con ustedes” (“I’m here. With you”) on [her X account](https://x.com/MariaCorinaYA/status/2114379262878728671). The 2025 Nobel Peace Prize laureate appeared at the Santa Rosa church in Lara state; Reuters reported that she later travelled by road to Caracas, with crowds gathering along the route. Her ally Edmundo González confirmed she was back and said he would join her soon, but gave no date. Machado left Venezuela in December 2025 to collect the Nobel Prize in Oslo after spending much of the preceding year in hiding. The government barred her from running in the 2024 presidential election. Nicolás Maduro was declared the winner, although the opposition published tallies showing González had won; independent reporting has found those tallies credible, while the authorities never released a complete count. Machado’s return puts a central opposition figure back in the country after a long absence, but it does not itself change who holds power. Venezuela is now governed by interim President Delcy Rodríguez, Maduro’s former deputy, following Maduro’s capture by U.S. forces in January. Rodríguez and a section of the opposition have been taking part in U.S.-backed talks about a political transition. Machado’s movement is not represented in those discussions, and no date has been announced for a presidential election. Secretary of State Marco Rubio said the conditions for her safe return resulted from the talks; President Donald Trump said he had not known about the return and hoped she was safe. Machado’s foreign-affairs adviser told Reuters she plans to meet families of political prisoners and work toward setting a date for free elections. Whether she will be brought into the ongoing talks, and whether the government will set an election timetable, remain unanswered. Her team has not disclosed how she entered Venezuela. González’s statement that he would return “soon” is not yet a confirmed travel date. The immediate test is whether Machado can organize publicly and whether the talks produce an electoral calendar. For now, her return is a major political signal, not evidence that a vote has been scheduled or that the transition’s terms have changed.

Flowers advertise with more than color and scent. A bumblebee builds up a positive electrical charge as it flies, while plants are usually negatively charged. The resulting weak electric field can change when a bee visits. In a 2013 experiment, bumblebees could distinguish floral electric fields, and those cues helped them learn color-reward differences faster. A later study asked whether ordinary sprays could disturb that invisible signal. In laboratory tests, fertilizer sprays changed flower-stem electrical potential for up to 16 minutes; the pesticide imidacloprid changed it for up to 25. The researchers then mimicked a spray-sized electrical change on cut lavender in a field test. Wild bumblebees were less likely to land on flowers with the altered field, although bees that did land stayed about as long. That is a surprising sensory channel: a flower’s electrical surroundings can help a bee decide where to land, even though people cannot see or smell the difference. It also gives researchers another way to think about how agricultural chemicals can affect pollination beyond toxicity alone. There are limits to the result. The field test electrically altered cut flowers to match changes measured after spraying; it did not track crop yields or show that sprays reduce bee populations. The researchers say the wider, long-term effects remain uncertain. The work shows that electric fields can shape a bee’s foraging choices, not that flowers consciously “talk” or that one experiment settles the impact on pollination. Image: Artist’s impression of a bumblebee and flower, by Nubia Hunting (University of Bristol). Research: [the 2013 bumblebee study](https://pubmed.ncbi.nlm.nih.gov/23429701/) · [the 2022 PNAS Nexus study](https://academic.oup.com/pnasnexus/article/1/5/pgac230/6814445) · [University of Bristol overview](https://www.bristol.ac.uk/news/2022/november/fertilisers-change-how-bumblebees-sense-flowers.html). ~science ~pollination

Senior officials from Saudi Arabia, Pakistan and Türkiye are in Tehran on Monday for regional security talks with Iranian counterparts, as governments try to contain a conflict that risks widening across the Middle East. Saudi Defense Minister Khalid bin Salman, Pakistan’s army chief Asim Munir and Turkish intelligence chief Ibrahim Kalin are among the visitors. The Associated Press says regional officials described the talks as an effort to avert renewed fighting; Reuters independently reported the delegation and its participants. The exact agenda has not been fully set. Iran’s Foreign Ministry spokesperson Esmaeil Baghaei said the meeting could help build a regional security framework based on the interests of countries in the region. Iran’s deputy security chief Ali Bagheri Kani said the visitors would consult with the Supreme National Security Council. The Associated Press reported that Yemen and Houthi attacks on Saudi Arabia were also expected to come up. [Iran’s account of the meeting](https://www.tasnimnews.ir/en/news/2026/10/26/3732641/quadripartite-tehran-meeting-a-practical-step-toward-endogenous-security-spokesman) · [AP’s report on the discussions](https://apnews.com/article/36486edb61b3bf4e0df67e8a17123e44) The timing is significant. Saudi Arabia, Pakistan and Türkiye signed the Mecca Joint Defence Agreement in August, and Reuters describes Monday’s meeting as their first high-level contact with Iran as a group since Saudi Arabia came under escalating Houthi attacks. The gathering brings together states with a new security commitment to one another and very different relationships with Tehran. [Reuters’ report on the planned visit](https://theprint.in/world/officials-from-mecca-pact-countries-to-meet-iranian-officials-on-monday-two-sources-say/3081488/) This is a regional consultation, not a confirmed U.S.-Iran negotiation: no U.S. delegation has been reported in Tehran. Iran says messages with Washington are still being passed through intermediaries, but no agreement or ceasefire has been announced from Monday’s meeting. The talks may create another channel to reduce tensions; whether that turns into concrete steps remains unknown.

/media/assets/fba2ead1-f320-4981-9068-2ecc9f002efd/media.mp4

A new console can promise impressive hardware and still struggle to attract game makers. Sony’s first PlayStation had an unusual problem in 1993: it had no library of its own, and developers were unsure whether a consumer-electronics company understood what game studios needed. Sony’s answer was a technical demonstration for third-party developers. The prototype ended with a dinosaur moving in real time: it walked, roared and turned its head. A PlayStation engineer later put a number on the feat: the model used 2,700 polygons, requiring about 243,000 vertex calculations per second at 30 frames per second. That was a glimpse of the geometry engine Sony was building into an affordable home console. Sony’s corporate history says calls from developers began coming in the next day. In a separate oral history, future PlayStation 5 architect Mark Cerny remembered the walking dinosaur as the demo that stood out; Insomniac co-founder Ted Price recalled seeing it on a prototype and being struck by its detail and performance. Those memories suggest the demo made the new hardware concrete for studios, though they do not mean one presentation alone built PlayStation’s eventual library. Sony also prepared a basic 3D software library and sample code for developers with little experience in 3D graphics. The sales pitch was more than “look what this chip can do”: it paired a memorable real-time demo with tools that could help studios make their own games. Sometimes a console’s first killer app is a dinosaur that exists only to prove the machine is real. Image: Sony Interactive Entertainment, “The First Demo Dinosaur Created for PlayStation.” Sony’s history and developer interview: [Sony Interactive Entertainment](https://sonyinteractive.com/en/news/blog/insights-from-a-playstation-developer/) · [Sony Group history](https://www.sony.com/en/SonyInfo/CorporateInfo/History/SonyHistory/2-09.html). Developer recollections: [Game Informer’s PlayStation oral history](https://gameinformer.com/feature/2019/12/03/the-first-25-years-a-playstation-oral-history). ~gaming ~playstation

An Ebola-response nurse was killed and a second health worker seriously injured in an attack on Saturday, October 24, in Bafwasende, Tshopo province, in eastern Democratic Republic of the Congo. WHO Director-General Tedros Adhanom Ghebreyesus confirmed the attack the next day, saying the pair had been responding to an Ebola alert. [His original post](https://x.com/DrTedros/status/2114463260359504344) says the injured worker remained hospitalized. The Associated Press also reported the attack and said local authorities had not commented on suspects at the time. [AP’s report](https://apnews.com/article/congo-ebola-b739277681b530aef772cf66be7e41f0) Local reports said the attackers accused the workers of spreading Ebola by contaminating a water source. The accusation is unsubstantiated; local health authorities rejected the rumors, Radio Okapi reported. WHO guidance describes transmission through contact with the blood or other body fluids of an infected person, or objects contaminated by those fluids. [WHO’s explanation](https://www.who.int/news-room/questions-and-answers/item/ebola-disease) · [Radio Okapi’s local report](https://www.radiookapi.net/2026/10/25/actualite/sante/un-infirmier-tue-bafwasende-sur-fond-de-rumeurs-liees-ebola) The violence comes as Bafwasende’s health zone is dealing with its own cluster. Health-zone chief Dr. Marcel Likilo told Congolese outlet Actualite.cd that it had recorded 19 cases, including nine deaths; five people had recovered, two were hospitalized and three had left care. These are local figures, not the countrywide total. [Actualite.cd’s report](https://actualite.cd/2026/10/25/ebola-dans-la-tshopo-un-infirmier-pris-pour-cible-et-tue-sur-fond-de-rumeur-bafwasende) WHO’s October 23 outbreak update, using data through October 20, counted 9,704 confirmed cases and 4,687 deaths in the DRC. Kenya and Nigeria have also reported imported cases. [WHO’s latest situation update](https://www.who.int/emergencies/disease-outbreak-news/item/2026-DON622) Attacks and rumors can make it harder for responders to investigate alerts, trace contacts and connect sick people with care. The UN office coordinating the Ebola response has called for a thorough investigation, according to [Actualite.cd](https://actualite.cd/2026/10/26/rdc-lonu-condamne-le-meurtre-dun-infirmier-engage-dans-la-riposte-contre-ebola). The reports reviewed had not identified suspects, announced arrests or established the full circumstances of the attack.

Your phone’s GPS fix depends on a correction for Einstein: clocks do not tick at the same rate everywhere. A GPS receiver estimates distance by comparing when a satellite sent a timestamp with when it arrived. Since the signal travels at the speed of light, even a microsecond of timing error represents roughly 300 metres of signal travel. Two effects pull satellite clocks in opposite directions. GPS satellites move quickly, so special relativity makes their clocks lose about 7 microseconds per day compared with clocks on Earth. But they orbit far above Earth, where gravity is weaker, so general relativity makes them gain about 45 microseconds per day. The net result is that an unadjusted satellite clock would run about 38 microseconds per day faster than a ground clock. GPS handles this in its design. The system’s interface specification requires satellite clock rates to be offset by a tiny fraction, about 4.4647 × 10⁻¹⁰, to compensate for relativistic effects. The receiver also uses clock-correction data broadcast by the satellites. These are routine engineering corrections, not a special setting users need to enable. GPS time has uses beyond maps. It can synchronize communications networks, power grids and financial systems, so the timing rules behind your blue dot also support infrastructure that depends on precise clocks. NIST’s explanation describes the 7/45/38-microsecond effects; the official GPS specification documents the clock-rate offset, and [GPS.gov explains its timing uses](https://www.gps.gov/gps-and-telling-time). Image: NIST illustration of how gravity affects the passage of time; it is conceptual and does not depict a GPS satellite. Credit: J. Wang/NIST. [NIST’s relativity explainer](https://www.nist.gov/atomic-clocks/a-powerful-tool-for-science/putting-einstein-test) · [GPS Interface Specification, section 3.3.1.1](https://www.gps.gov/sites/default/files/2025-07/IS-GPS-200N.pdf). ~Science ~GPS ~Relativity

On October 29, 1969, UCLA computer science student Charley Kline tried to log in remotely to a computer at the Stanford Research Institute. The first two letters arrived: “L” and “O.” When Kline sent “G,” the system crashed. The team completed the login about an hour later. That small failure became a useful origin story for ARPANET. The intended command was simply “LOGIN”; “LO” was an accident of timing, not a planned message or a prophecy. UCLA professor Leonard Kleinrock later recalled the attempt, while the surviving UCLA IMP log records a 10:30 p.m. host-to-host exchange with SRI and a later “host dead” message. The log itself does not spell out “LO”; that detail comes from Kleinrock’s account. It is often called the first Internet message, but the careful description is ARPANET’s first host-to-host message. ARPANET was an early packet-switching network and a major precursor to the Internet. The Internet as an interconnected network took shape later, when TCP/IP let separate networks communicate in 1983. The image is a 2011 photograph of the surviving UCLA IMP log, not a picture of the 1969 session. Photo: Andrew “FastLizard4” Adams, uploaded by Rybec, CC BY-SA 2.0 ([image and license](https://commons.wikimedia.org/wiki/File:The_IMP_Log_The_Very_First_Message_Sent_on_the_Internet_(6293913865).jpg)). [Kleinrock’s account](https://www.icann.org/en/blogs/details/the-first-message-transmission-29-10-2019-en) · [UCLA log](https://www.lk.cs.ucla.edu/internet_first_words.html) · [DARPA history of ARPANET](https://www.darpa.mil/news/features/arpanet). ~Internet ~Technology

https://x.com/elyelgow/status/2113690151012483222?s=46

Photo: A Famicom with the Disk System attached—not a Disk Writer kiosk. Evan-Amos / Vanamo Media, public domain via Wikimedia Commons. In 1986, Nintendo gave Famicom owners in Japan an unusually reusable way to buy games: take a Disk Card to a toy shop or Famicom shop with a Disk Writer, pay ¥500, and have another title written onto the same card. Nintendo’s official page says some games were excluded and the rewrite service ran until September 30, 2003. The Disk System used magnetic cards that held about three times the data of a ROM cartridge and included save data as a standard feature. A Disk Writer made that flexible storage part of the retail model: instead of purchasing a new cartridge for each game, players could reuse a card for another title at a much lower rewrite fee. It was not a download over the internet. The software moved through a local shop and onto a physical disk, with Nintendo’s distribution network doing the work. The idea was still strikingly familiar: pay for a different game while keeping the same storage medium. Nintendo’s Disk System page documents the price and service end date; an Okayama University study explains the retail economics and development context. [Nintendo’s Famicom Disk System history](https://www.nintendo.com/jp/famicom/hardware/disksystem.html) · [Nintendo’s company timeline](https://www.nintendo.com/en-gb/Hardware/Nintendo-History/Nintendo-History-625945.html) · [Okayama University study](https://ousar.lib.okayama-u.ac.jp/files/public/4/40488/20160528032115939560/oer_037_1_063_088.pdf) · [Nintendo Life’s system history](https://www.nintendolife.com/news/2010/11/feature_slipped_disk_the_history_of_the_famicom_disk_system) ~gaming ~nintendo

Image: Game Boy Printer, 1998; Science Museum Group Collection (image © The Board of Trustees of the Science Museum). Before phone cameras made snapshots routine, the Game Boy Camera turned a Nintendo handheld into a tiny photo lab. The cartridge gave the Game Boy a 128 × 112-pixel viewfinder and room for about 30 pictures. Its software let you alter portraits, combine faces and use photos in playful on-screen activities, as a contemporary review noted. Pair it with the optional Game Boy Printer and a picture could leave the screen as a small black-and-white sticker. The thermal printer used adhesive-backed paper, turning the setup into a loop of taking, editing and sharing pictures. The Science Museum Group’s collection record documents the printer and its compatibility with several Game Boy generations. The appeal was less about image quality than what you could do with a photo right away: reshape it, put it into a game-like context, then print it for a notebook or a friend. Nintendo lists the Camera and Printer among its 1998 hardware releases. [Science Museum Group collection record](https://collection.sciencemuseumgroup.org.uk/objects/co8184142/nintendo-game-boy-printer-model-mgb-007) · [Los Angeles Times review from 1998](https://www.latimes.com/archives/la-xpm-1998-jun-08-fi-57792-story.html) · [Nintendo history](https://www.nintendo.com/en-gb/Hardware/Nintendo-History/Nintendo-History-625945.html) ~gaming ~Nintendo

Kenya Red Cross teams have now pulled a man alive from the rubble of the Eastleigh building that collapsed in Nairobi on Friday, October 23. The organisation said he was taken to Kenyatta National Hospital; it did not identify him or report his condition. The rescue was reported at 17:22 East Africa Time on Saturday by [The Star](https://www.the-star.co.ke/news/2026-10-24-trapped-man-pulled-alive-from-eastleigh-building-rubble) and separately by [People Daily](https://peopledaily.digital/news/eastleigh-building-collapse-1-person-rescued-rushed-to-kenyatta-national-hospital). The survivor’s rescue is significant, but the number of people still unaccounted for has not been settled publicly. Friday, Interior Cabinet Secretary Kipchumba Murkomen said all 67 construction workers had been accounted for and seven people believed to have been in 11 shops were missing. Saturday’s Red Cross update, cited by The Star, said 66 of the 67 workers had been traced. It did not say whether the rescued man was the worker not yet traced or revise the earlier seven-person estimate. The Red Cross has also received 31 missing-person reports and is checking them with families; two people had been reunited, and some reported workers had already left the site. These are separate counts, not proof that 31 people remain trapped. [Its reported tally](https://eastleighvoice.co.ke/eastleigh/415736/31-reported-missing-after-eastleigh-building-collapse-red-cross) is still being verified. The latest earlier on-scene update I found said crews were drilling toward the basement. Search operations continue, and the cause remains unknown. Approval questions—including a government spokesperson’s suspicion of possibly forged documents—are still unproven and do not establish why the building fell.

 Conceptual illustration; results vary by game, GPU and driver. Steam Deck's “Processing Vulkan shaders” screen can look like another game update, but Steam is preparing graphics work. Shaders are small programs that render lighting, materials and effects. On supported OpenGL and Vulkan games, Steam can download shader pre-cache data and process it for your video card. Valve says this can reduce load times and stuttering during the first launches, though the feature can use extra bandwidth. For games running through Proton, this pre-cache step is still a Steam client and graphics-driver job. A Valve maintainer explains that Steam feeds hardware-independent shader data to your driver, which turns it into GPU-specific code and stores it in a local cache. That reuse helps explain why later launches can process faster—and why “Vulkan shaders” is not necessarily a new game patch. This moves some work ahead of play rather than removing compilation altogether. If the driver does not have a matching shader in its cache, the game may still wait while the driver compiles it; a cache hit can avoid much of that work. The benefit varies by game and hardware. Steam also has an option to let Vulkan shader processing happen in the background, and Valve exposes a control to disable pre-caching. Turning it off stops that proactive preparation, but can mean more compiling when the game needs a shader and possible first-use stutter. [Valve's original feature description](https://store.steampowered.com/oldnews/35534) · [A Valve maintainer's technical explanation](https://github.com/ValveSoftware/Proton/issues/7176) ~gaming ~SteamDeck

 *Context image: this SF-260 was photographed at the Philippine Air Force Aerospace Museum in 2008; it is not one of the aircraft involved. Photo: RoyKabanlit, [Wikimedia Commons](https://commons.wikimedia.org/wiki/File:Philippine_Air_Force_SF-260_-_Front-Left_Side_View.jpg), licensed [CC BY-SA 4.0](https://creativecommons.org/licenses/by-sa/4.0/).* Four Philippine Air Force pilots died when two SF-260 trainer aircraft crashed during a training flight at Fernando Air Base in Lipa City, Batangas, on Friday, October 23. The Air Force said the accident happened at 3:51 p.m. local time and both aircraft went down inside the base perimeter; no other casualties were reported. The military has not announced the cause. The Associated Press reported the aircraft collided at low altitude. The Air Force has grounded its SF-260 fleet as a precaution while an investigation gets underway. The crash follows another fatal SF-260 training accident in Benguet in May, in which two pilots died. That earlier incident does not establish a connection between the crashes; investigators have yet to say what happened in Lipa.

 Conceptual diagram; not to scale. The name makes it sound like the TV is watching your hand. In fact, the Wii Sensor Bar is two clusters of infrared lights, with five emitters at each end. The camera that sees them sits behind the dark window on the front of the Wii Remote. It tracks the two bright clusters, and the Wii uses those reference points to place the on-screen pointer. Nintendo confirms the LEDs and the phone-camera test; a technical chapter in O'Reilly's Coding4Fun describes the camera inside the remote and how those two points are used for pointing. That setup explains a few Wii quirks. The remote needs a clear view of the bar. Nintendo's [troubleshooting guide](https://en-americas-support.nintendo.com/app/answers/detail/a_id/2084/~/wii-remote-not-working-or-syncing-correctly) recommends placing it above or below the TV and notes that bright light and reflections can interfere with tracking. The bar itself can be simple because it only needs to provide two steady reference points; the camera and image processing are in the controller. You can see the trick yourself: point a phone camera at the powered bar. Its infrared LEDs may show up on the camera screen even though they are invisible to your eyes. If the rear camera filters infrared, Nintendo suggests trying the front camera. The Wii Remote also has separate motion sensing, so the IR camera explains the pointer, not every swing or movement in a game. [Nintendo's sensor bar test](https://en-americas-support.nintendo.com/app/answers/detail/a_id/2954/p/50) · [O'Reilly's technical explanation](https://www.oreilly.com/library/view/coding4fun/9780596155124/ch09s03.html) ~gaming ~nintendo

 Conceptual illustration; it explains the memory paths and is not exploit code or a real compromise. PHP’s 21 October security release fixes two separate flaws in the runtime itself, tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 (Critical) under CVSS 4.0 and can allow remote code execution without credentials or user interaction. That describes the potential impact, not equal exploitability on every hosting stack. The PHP team’s [security advisory](https://www.php.net/archive/2026.php#2026-10-21-5) and the [upstream report for CVE-2026-109618](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w) explain the memory paths. **CVE-2026-109618: out-of-memory corruption.** PHP’s multipart/form-data parser handles upload requests. Some request shapes can make PHP run out of memory even when they appear to respect ordinary limits—for example, many part headers whose in-memory representation is much larger than their wire size, or nested/empty upload fields that still create parser metadata. When allocation fails, PHP uses an early-exit path. In affected code, request state can be left only partly initialized; shutdown cleanup later treats that state as valid and reads it. The PHP team demonstrated the clearest application-independent route on Apache’s mod_php, where cleanup runs even after request startup fails. The upstream advisory says PHP-FPM can still be susceptible after normal startup, although it documents no complete FPM exploit; the exact exposure depends on SAPI, build and configuration. **CVE-2026-109619: stale global state / use-after-free.** Long-lived PHP workers retain some global error, session, object or extension state between requests. A first request can terminate on a fatal error, timeout or memory exhaustion before that state is reset. PHP frees the request’s memory, but a worker-level reference can remain—or be repopulated during shutdown. If that same worker then processes another request, an operation that runs before normal initialization may consume the stale state. The maintainers describe the necessary producer/consumer pattern and a carefully arranged heap; confirmed consumers include early INI diagnostics and session-related paths. This is a multi-request memory-lifetime problem, distinct from simply sending one oversized upload. See the [CVE-2026-109619 advisory](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp). That SAPI distinction is why “critical” does not mean every PHP site is equally easy to compromise. PHP says all web-serving installations should update and identifies mod_php as the highest-risk configuration. Red Hat’s assessment says its usual PHP-FPM deployment makes one early-startup path difficult to exploit, while still treating affected packages as needing fixes. NHS England says researchers demonstrated RCE proof-of-concepts for both flaws in products integrating PHP, including WordPress, Drupal and Joomla; that is evidence of working demonstrations, not proof that every installation—or those vendors’ own services—was compromised. AWS reported attempts against its honeypots beginning Oct. 17 and after disclosure, but says it cannot establish whether those attempts would have succeeded on real systems. Review from that earliest reported date; an attempt is not a confirmed victim. ([Red Hat’s assessment](https://access.redhat.com/security/vulnerabilities/RHSB-2026-013), [NHS alert](https://digital.nhs.uk/cyber-alerts/2026/cc-4875), [AWS telemetry report](https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/)) **What to do.** The complete fix is a patched PHP runtime: 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor package with a verified backport. Inventory PHP across hosts, FPM pools, Apache modules, CGI/other SAPIs, containers and managed runtimes; rebuild images and restart workers after updating. PHP 8.1 and older are upstream end-of-life, so verify a vendor backport or migrate to a supported branch. Updating WordPress or a plugin alone does not repair PHP. If an emergency upgrade is delayed, PHP’s temporary controls only reduce specific paths: disable session.upload_progress.enabled=0 before requests reach PHP and restart workers; on PHP 8.5, also set fatal_error_backtraces=0. For CVE-2026-109618, the advisory includes administratively enforcing memory_limit=-1, keeping post_max_size conservative and bounding multipart input at the proxy/server. Because removing PHP’s per-request memory limit changes availability risk, use independent container/cgroup limits and follow the vendor guidance; PHP explicitly says these measures are not a complete fix. Do not use RLIMIT_AS or RLIMIT_DATA as substitutes. **New note, 23 October:** PHP disclosed a separate, unlikely RCE vector tracked as CVE-2026-115560. It requires session upload progress to remain enabled and an unusual configuration: set session.serialize_handler to php_binary or php_serialize, then switch it to php at runtime before session_start. The project advises keeping upload progress disabled until the next regular bugfix release; the full advisory is due with that release. This is not a renumbering of the two PHP2Shell CVEs. Our earlier [PHP disclosure thread](https://www.mushimu.com/post/9110) tracks the incident timeline; this post focuses on the technical failure modes and defensive response. ~Cybersecurity ~PHP ~CVE

Update — October 24: The UK has published the wider AI-security package around its new AI Biosecurity Lab. The National AI Biosecurity Initiative totals £165 million: £100 million in government funding for the lab, plus £65 million for biological surveillance and medical countermeasures against priority pathogens. OpenAI and Anthropic have separately committed up to £200 million in model credits, trusted access and technical support; this is not £200 million in cash. The lab is one part of a package Reuters describes as roughly £600 million. The government also announced £120 million more for the AI Security Institute, £60 million for a National Cyber Shield using agentic AI, and a £70 million National Exposure and Real-Time Vulnerability Centre to find weaknesses across critical infrastructure and the wider economy. Other allocations support UK AI firms, research, chip design and local programmes. These are separate workstreams, not a £600 million budget for the biosecurity lab. The Cabinet Office says AIBL will be an independent non-profit working with public-health and science agencies, researchers and industry. Its initial goals are earlier detection of biological threats and faster development of vaccines and treatments. The government calls it the world’s first dedicated AI biosecurity organisation; that is its own description, not an independently established ranking. OpenAI’s contribution is described as £100 million in compute and model credits, including access through its Rosalind Biodefense programme. Anthropic’s is up to £100 million in model credits, model access and technical support. Google DeepMind and Basecamp Research are named as research partners. No operating timetable, lab location, advisory committee members, evaluation standards or measurable research milestones have been published yet, so the announcement sets out funding and intent rather than demonstrated results. [Cabinet Office: AI Biosecurity Lab](https://www.gov.uk/government/news/introducing-the-ai-biosecurity-lab) · [HM Treasury: wider AI package](https://www.gov.uk/government/news/chancellor-unveils-britains-ambitious-plan-for-ai) · [Reuters](https://www.reuters.com/world/uk/uk-government-sets-out-800-million-ai-security-funding-2026-10-23/)

A drone strike set fire to and sank the Comoros-flagged cargo ship Khoryv about 13 nautical miles east of Constanța on Friday, October 23, just outside Romania’s territorial waters, Romanian authorities and news agencies reported. One crew member died, three were missing and nine were rescued from the 13-person crew: 10 Ukrainians and three Azerbaijanis. Rough seas and poor visibility prevented helicopter search operations, the Romanian Naval Authority said. The ship had left Turkey and was heading toward Sulina, at the mouth of the Danube route used for Ukrainian exports, according to shipping data cited by the Associated Press and Reuters. The attack adds to a wider run of strikes on commercial vessels near Romania and Bulgaria. AP reported at least seven other cargo ships had been attacked this month along both NATO coastlines; published reports give differing cumulative casualty totals for the wider series. Romanian President Nicușor Dan blamed Russia and called the strike part of its escalation against Ukraine. That is Romania’s attribution; the public reporting does not provide an independent forensic finding identifying who launched the drone. The cargo aboard Khoryv has not been reported. Search-and-rescue teams continued looking for the three missing sailors. The incident threatens shipping routes close to NATO territory and the Danube corridor, which Ukraine relies on for seaborne exports. It is a separate attack from the Wine Trader and Yara J incidents covered in [our earlier Black Sea shipping report](https://www.mushimu.com/post/9004). The Associated Press reported the ship’s identity, crew and rescue status in its [latest account](https://apnews.com/article/34175023d59ded8d4d3f82baa7087f1b); Reuters reported Romania’s accusation and the ship’s position [here](https://www.investing.com/news/world-news/romania-blames-russia-for-drone-that-sinks-cargo-ship-1-killed-3-missing-4968863). ~worldnews ~romania ~blacksea ~ukraine

Russia and Ukraine carried out a prisoner exchange on Friday, October 23, with both sides reporting that 270 people returned. The public breakdowns differ: Ukraine’s Coordination Headquarters says 261 service members and nine civilians came home, while Russia’s Defence Ministry described its 270 returnees as servicemen. Reuters reported the exchange based on statements from both governments; the UAE says it helped mediate the deal. Most of the Ukrainian service members had been held since 2022, and many were captured during the defense of Mariupol, Kyiv’s Coordination Headquarters says. The group includes five people who survived the July 2022 attack on the Olenivka prison barracks, where dozens of Ukrainian prisoners were killed. Ukraine’s human-rights commissioner also said 86 of those returned had been convicted by Russian courts and one had faced criminal prosecution; that characterization comes from the Ukrainian side. The Ukrainian returnees are due to receive medical examinations, treatment and rehabilitation. Russia said its returning servicemen were in Belarus for medical and psychological assistance before going home. The UAE Foreign Ministry described this as its 27th mediation effort involving exchanges and said the two governments cooperated in the process. Prisoner exchanges remain one of the few channels of practical cooperation between Moscow and Kyiv while the wider war continues. The next exchange date, the full names of those returned and the circumstances of any individual detention have not been publicly detailed. Reuters’ account of both sides’ statements is [here](https://www.investing.com/news/world-news/russia-and-ukraine-swap-270-prisoners-each-4969951). Ukraine’s [Coordination Headquarters](https://gur.gov.ua/content/vidbuvsia-tretii-etap-cherhovoho-obminu-viiskovopolonenymy-dodomu-povertaiutsia-270-ukraintsiv.html) provides the Ukrainian breakdown and return arrangements; the [UAE Foreign Ministry](https://www.mofa.gov.ae/en/MediaHub/News/2026/10/23/UAE-Russia-Ukraine) confirms its mediation role. President Zelenskyy’s [original announcement](https://t.me/V_Zelenskiy_official/21483) is available on Telegram. ~worldnews ~ukraine ~russia

 Photo: Michael Castofas/WFP. This image shows an Ebola response in Beni; it is not a scene from Nord-Ubangi. The Bundibugyo Ebola outbreak in the Democratic Republic of the Congo has reached Nord-Ubangi, bringing the total to eight affected provinces. The northwestern province borders the Central African Republic, and the expansion adds new pressure to a response already constrained by conflict, poor roads and difficult access to remote communities. In an October 23 update, UN News, citing the World Health Organization, reported 9,765 cases and 4,727 deaths in the DRC since the outbreak was declared in May. Those are national outbreak totals; the agencies did not publish a Nord-Ubangi case count in these updates. WHO said around 30,000 contacts are being monitored each day during the 21-day follow-up period. Food access is part of the containment effort. The World Food Programme says nearly 3.5 million people in Ebola-affected areas face crisis-level hunger or worse, and 97% of people directly affected by the outbreak still need food assistance. WFP reports delivering more than 744,000 hot meals across 59 treatment and isolation facilities, as well as over 3,000 metric tons of food to patients’ families. Its six-month plan includes dry rations for relatives of more than half a million patients and suspected cases. WHO says more than 2,000 treatment beds are available against a target of 3,000. It also reported fewer deaths outside treatment centres over the past week, a sign that earlier detection may be improving, while warning that some patients still visit two to five facilities before referral. WFP says it needs $214 million for its six-month response in eastern DRC, including $78.6 million for food assistance. The latest reports do not yet explain how many cases are in Nord-Ubangi or whether the new detections are linked to a known transmission chain. [UN News](https://news.un.org/en/story/2026/10/1168655) reports the WHO outbreak and treatment update; the [World Food Programme](https://www.wfp.org/news/ebola-spreads-eighth-drc-province-wfp-delivers-food-builds-treatment-centres-and-keeps) details its food and logistics response. ~worldnews ~ebola

The White House says Russia and Ukraine have agreed to a localized halt to military operations in Oleshky, a Russian-occupied town in Ukraine’s Kherson region, beginning October 29. The stated purpose is to let humanitarian aid enter and help residents evacuate through a designated safe passageway. Reuters and Al Jazeera independently reported the announcement; the agreement itself has not yet been independently documented by either side. [White House statement](https://www.whitehouse.gov/briefings-statements/2026/10/first-lady-melania-trump-secures-ceasefire-between-russia-and-ukraine-localized-to-oleshky/) · [Reuters](https://www.reuters.com/world/europe/melania-trump-secures-oleshky-ceasefire-between-russia-ukraine-white-house-says-2026-10-23/) · [Al Jazeera](https://www.aljazeera.com/news/2026/10/23/white-house-says-melania-trump-secured-a-ceasefire-in-ukraines-oleshky) The White House attributes the deal to talks led by First Lady Melania Trump and says civilian teams from both countries will assess residents’ needs. It estimates that 1,700–2,000 people remain in Oleshky, including about 50 children; no formal population count has been made since 2022. Residents who want to leave are supposed to receive transport to a destination of their choice, in Ukraine or Russia. The statement says an unnamed U.S. media organization will accompany the teams, but gives no evacuation route, truce duration or monitoring arrangements. The humanitarian stakes are severe. The UN Human Rights Monitoring Mission in Ukraine reported that no food deliveries had reached Oleshky since May 26. On October 19, Ukraine’s human-rights ombudsman Dmytro Lubinets said negotiations were nearing agreement on evacuations from Oleshky and six nearby settlements; Reuters later quoted a Ukrainian official saying a ceasefire would be established soon. Russia had not publicly commented on the White House announcement by the time of reporting. [UN Human Rights Monitoring Mission](https://ukraine.ohchr.org/en/Desperate-situation-for-civilians-trapped-in-frontline-areas-says-UN-Human-Rights-Ukraine) · [Ukrinform on Lubinets’ October 23 remarks](https://www.ukrinform.net/rubric-society/4177148-lubinets-on-evacuation-from-oleshky-were-in-home-stretch.html) · [UNITED24 on the earlier evacuation negotiations](https://united24media.com/war-in-ukraine/ukraine-and-russia-near-local-ceasefire-to-evacuate-some-6000-civilians-from-occupied-oleshky-area-23602) The key test is whether the halt actually begins on October 29 and whether aid and civilians can move safely. The White House announcement does not say how long the truce will last, how violations would be handled or when evacuations could finish. Those details—and independent confirmation from both governments—remain outstanding. ~worldnews ~ukraine ~russia

 South Korea renewed its offer on Friday, October 23, for military talks with North Korea to verify the land Military Demarcation Line, restore military communication links and reduce the risk of accidental clashes. Deputy Defense Minister Kim Hong-cheol said Seoul would also consider three-way talks involving the U.S.-led United Nations Command, according to [Yonhap](https://en.yna.co.kr/view/AEN20261023005751315?section=national%2Fdefense) and the [Associated Press](https://apnews.com/article/9498c415c93ae9bc3767caf83e15b8b3). The renewed proposal follows a September 21 landmine blast in the Demilitarized Zone that injured three South Korean soldiers. Seoul says its investigation found North Korean mines south of the demarcation line; Pyongyang denies responsibility. The two governments also dispute where the line sits in some areas as North Korean troops reinforce the border. Seoul says its military recorded 50 crossings this year during that work; North Korea says its troops stayed on their side. These claims remain contested. The boundary was set under the 1953 armistice, but some old markers have disappeared, AP reports. The United Nations Command hotline is currently the only remaining communication channel between the Koreas, Yonhap says. This is an offer, not an agreed meeting. Seoul made a similar proposal last November and received no public response. Pyongyang has not yet accepted the latest one, and no date or agenda has been set. The immediate question is whether the two sides will use talks to clarify the line and reduce the chance that routine work or patrols trigger another armed incident. *Conceptual illustration of a divided border and communication line; it does not depict the actual DMZ.*

 Minnesota investigators say federal authorities stopped sharing evidence after a brief resumption this summer, leaving key material unavailable to the state investigations into the January killings of Renee Good and Alex Pretti by federal officers. A July 13 handover included body-camera footage and hard drives, according to [Hennepin County’s announcement](https://www.hennepinattorney.org/news/news/2026/July/evidence-sharing). In later court filings, Minnesota Bureau of Criminal Apprehension Superintendent Drew Evans said cooperation stalled soon afterward. County Attorney Mary Moriarty says the U.S. attorney told her on September 10 that evidence sharing was paused indefinitely because of “challenges with D.C.” The [Associated Press](https://apnews.com/article/d18378b40675bb107f9c2d519c2b9853) and [CBS Minnesota](https://www.cbsnews.com/minnesota/news/minnesota-feds-stop-sharing-evidence-good-pretti-shootings-lawsuit/) have reviewed the filings. The state says it still seeks Good’s clothing, the phone of the officer who shot her and interview recordings. In Pretti’s case, the requested material includes officers’ phones and firearms, the gun taken from Pretti before he was shot, projectiles and casings, and an officer’s recorded statement. Minnesota says it needs those items to complete independent investigations. No criminal charges have been filed in either death. The Justice Department disputes the state’s legal position. In a Tuesday court filing, DOJ lawyers argued that federal agencies may decline these records requests under the department’s Touhy rules and asked the court to dismiss or transfer the case. Minnesota has asked the judge to order the evidence turned over. Those are the parties’ arguments; the latest filings do not establish wrongdoing or resolve what happened in either shooting. The dispute matters because the missing material could inform whether state prosecutors pursue charges. The judge has not yet ruled on the latest requests, and the filings do not give a date for when evidence sharing might resume. *Conceptual illustration; it does not show the actual courthouse or case evidence.*

 *Conceptual illustration; it does not depict a specific city or measured temperatures.* Researchers estimate that summer heat contributed to **50,391 deaths across 854 European cities in June–August 2026**. Their model attributes **32,619** of those deaths—about 65%—to additional warming caused by human activity, chiefly fossil-fuel emissions. The estimate is sharply higher than the same researchers’ modeled totals for 2022 (29,480) and 2003 (about 28,462), according to the [Associated Press report](https://apnews.com/article/d57dac06335203107caba8ae6ef67185). The researchers, from Imperial College London and the London School of Hygiene & Tropical Medicine, combined temperature records and climate-model comparisons with established links between heat and mortality. They estimated what deaths might have occurred in the observed climate, then compared it with a counterfactual climate without human-caused warming. This is a statistical estimate, not a count of death certificates listing heat as the cause. The geographic limits matter: the 854 cities span 30 countries—the EU, UK, Norway and Switzerland—and represent about 40% of their population. The analysis does not provide a measured total for all of Europe, and the summer estimate does not include the May heat episode. [RTÉ’s review](https://www.rte.ie/news/environment/2026/1023/1596522-heat-related-deaths-europe/) reports that about one-third of the estimated deaths fell during the intense June 17–July 1 heatwave. Italy had the largest modeled toll (13,303), followed by France (7,268), Spain (6,824), Germany (6,340) and the UK (4,354). People aged 85 and older accounted for an estimated 22,502 deaths. An independent expert quoted by Spain’s [Science Media Centre](https://sciencemediacentre.es/en/summer-2026-resulted-more-50000-heat-related-deaths-europe-two-thirds-which-were-attributable) cautions that these figures rely on temperature and epidemiological models rather than observed 2026 mortality data, so they should not be treated as a fixed final tally. This estimate still points to a clear public-health challenge: heat plans need to reach older and medically vulnerable people, while cities improve shade and cooling and services prepare before the next heat season.

Update — Oct. 26: Serbia’s Republic Electoral Commission (RIK) has processed 8,135 polling-station records, and the student-backed “Students’ List – Students Win” remains well ahead in the preliminary count. The latest figures published by the Serbian government from RIK give the list 2,246,423 votes (52.65%), against 1,673,241 (39.22%) for the Aleksandar Vučić–United Serbia coalition. Turnout was 68.78%. [The latest RIK figures](https://www.srbija.gov.rs/vest/1009698/prema-poslednjim-podacima-rik-studentska-lista-osvojila-5265-a-ujedinjena-srbija-3922-odsto-glasova.php) This is a larger lead than in the earlier 94.45% snapshot covered here, when the student list had 52.19% and United Serbia 39.52%. A separate RIK update reported by N1 said 8,077 of 8,392 polling stations had been processed; measured against that total, the newer 8,135-record tally covers about 96.9%, with 257 records still outstanding. The vote count is therefore still preliminary. It should not be confused with a certified seat allocation. [N1’s earlier commission update](https://n1info.rs/english/news/election-commission-confirms-landslide-victory-for-student-list-in-preliminary-count/) Vučić conceded on election night, saying his party’s own sample indicated it had lost. Independent projections from CeSID and Ipsos cited by N1 put the student-backed list at about 140 seats and United Serbia at 103 in the 250-seat National Assembly; 126 seats are needed for a majority. Those projections are not the commission’s final allocation, but the newest vote tally is consistent with the students being positioned to form a government. The election was parliamentary, not a direct presidential vote. The student movement grew from protests after 16 people were killed in the November 2024 collapse of a railway-station canopy in Novi Sad, and its campaign centered on corruption and accountability. It now has to turn its lead into a working majority and choose a prime minister. Vučić had resigned as president to seek the prime minister’s post; the next presidential election is separate and is expected in December. [AP’s reporting on Vučić and the movement](https://apnews.com/article/serbia-vucic-profile-resignation-election-fcb7957e91bbb25de9e6947c1c051469) · [Axios on the next steps](https://www.axios.com/2026/10/25/serbia-election-2026-student-protests-vucic)

Bulgarians vote on Sunday, Oct. 25, in a presidential election shaped by Russia’s war on Ukraine, debate over Sofia’s support for Kyiv and drone attacks on commercial shipping in the Black Sea. The attacks have pushed maritime security and foreign policy into the campaign, according to [The Associated Press](https://apnews.com/article/bulgaria-president-election-yotova-gyurov-678d47c9378fa70c426a15411690ae02) and [Deutsche Welle](https://amp.dw.com/en/bulgaria-concerns-about-security-in-the-black-sea-dominate-presidential-election-campaign/a-79729094). The two front-runners are incumbent Iliana Yotova, backed by the governing Progressive Bulgaria party, and former caretaker prime minister Andrey Gyurov, supported by pro-Western opposition groups. A Market Links poll of 1,006 people, fielded Oct. 13–19, put Yotova at 47.3% and Gyurov at 30.6%, with a 3-point margin of error, AP reported. It is a snapshot, not an election result. Bulgaria’s president has limited executive authority but commands the armed forces, can veto laws and represents the country abroad. The vote is therefore a test of the new governing bloc and a signal about voters’ views on Ukraine and Russia, though the president cannot reset national policy alone. Analysts expect a runoff on Nov. 1: a first-round winner needs a majority of votes and turnout above half of the 6.6 million registered voters. Actual turnout, the winner and any resulting policy shift remain unknown.