FIFA’s network was vulnerable to anyone with even minimal access.
CISA has added two critical Joomla extension bugs to its Known Exploited Vulnerabilities catalog after attackers were caught exploiting both flaws to upload malicious code onto vulnerable websites. The newly listed bugs affect iCagenda, an events calendar extension for the open source Joomla content management system, and Balbooa Forms, a popular form builder used to collect contact requests, registrations, surveys, and file uploads. Joomla powers roughly 1.2 percent of all websites – around a million sites worldwide – with extensions developed by independent, third-party companies, doing much of the heavy lifting beyond the core platform. Both vulnerabilities carry the maximum CVSS score of 10 and allow attackers to upload arbitrary files that can ultimately be executed as PHP code on the server, handing over remote control of the affected site. CISA added CVE-2026-48939, affecting iCagenda, and CVE-2026-56291, affecting Balbooa Forms, to its KEV catalog this week after confirming in-the-wild exploitation. Federal civilian agencies were ordered to patch against the flaws under the agency's vulnerability management directive, but the warning is equally relevant to the wider Joomla community, given that both extensions are used on public-facing websites. The iCagenda bug allows attackers to upload a malicious PHP file through the extension's attachment feature, turning what should be a simple file upload into remote code execution, CISA said. Security firm mySites.guru said it spotted attackers exploiting the iCagenda bug just hours before patched versions 4.0.8 and 3.9.15 were released in mid-June. The attacks targeted the extension's "Submit an Event" feature, which lets visitors contribute events to a site's calendar. Researchers said they observed automated scanning looking specifically for vulnerable installations before dropping web shells onto compromised servers. The Balbooa Forms bug is much the same story. Researchers said the extension's frontend upload endpoint accepted files from anonymous visitors without authentication, CSRF protection, or meaningful checks on file types. That made it possible to upload a PHP file into a publicly accessible directory and execute it remotely. The researchers said they uncovered the flaw while investigating an abuse report from a customer whose Joomla site was already under attack. Balbooa responded with version 2.4.1 on July 9, but researchers warned that exploitation is continuing against sites that have yet to update. If there's a silver lining, it's that the fixes are already available. If there's a downside, it's that the attackers didn't wait around for release notes. ®
Wayland is dominating the recent news about FOSS GUIs – even dignified elder Xfce’s official support is getting close. However, X11 is very much not dead yet, and new developments keep appearing. Last week, Norwegian FOSS developer Geir Isene announced his all-new server for the venerable X11 display protocol. Its description is in the title of the announcement post: Frame - the first Linux Assembly X server. Isene explains his motivation thus: “On my quest to own my software, one foundational piece kept itching… the X server. The underlying graphics engine, the thing that puts pixels on the screen. X11 is 4 million lines of code, a beast very few can claim they understand. So I did the reasonable thing. I wrote my own, in Assembly.” (This, for clarity, is extremely dry Norwegian humor. Writing your own X11 server in assembly language is the polar opposite of what most Unix developers would consider “reasonable…” But there is a reason behind the decision, and you may already have guessed it.) Isene also has his own window manager, Tile; his own terminal emulator, Glass; and even his own shell, called Bare. He calls the whole stack CHasm — CHange to ASM. All the tools are standalone binaries, implemented in x86-64 assembly language, targeting Linux, with no external dependencies. To go with them, he also has a similarly compact suite of Rust-based tools as well, named Fe₂O₃. It reminds us of the Suckless collection of extremely minimal, statically linked Linux apps, which once included a entire statically-linked Linux distro called Stali. Although Stali has been unmaintained for nearly a decade now, there are others: one current statically linked Linux distro is Oasis.) If you like a hyper-minimalist Linux setup, Isene’s custom stack of tools sounds amazing – perhaps even too good to be true. (That’s a hint, or what we gather fiction writers call foreshadowing.) yserver Remarkably enough, Frame is not the first new X11 server for Linux that has appeared recently. That distinction goes to yserver, which appeared last month. Developer Jos Dehaes describes it as “a modern X11 server written from scratch in Rust.” This also sounds good, especially if you’re an admirer of Rust. We have started using a few Rust-based projects here in the Irish Sea wing of Vulture Towers. They tend to be small, fast, stable, and quite clean of legacy baggage. They offer a significant contrast with Electron-based ones. In terms of tech legacy baggage, they score very well on what sometime Reg contributor Verity Stob measured with the Stob Cruft index. Yserver looks impressively complete: for instance, Dehaes has a list of 13 existing environments that run fine under it, from Enlightenment to Xfce. But – there’s always a “but” – before you get too excited, there’s a catch. Both Frame and yserver were built using LLM bots. (“Vibe coded” feels too harsh for programs of this complexity, but some will apply it anyway.) So, although Isene says of Frame, “I wrote my own in Assembly,” further down the same page, he concedes: “When something breaks or I want a feature, I turn to my buddy Claude and describe the itch.” To be honest, for this staunchly AI-skeptical vulture, this means Isene didn’t really write the CHasm programs himself: he presumably wrote a detailed spec, from which a bot generated code. This also arguably means he doesn’t strictly own the software, but on that point, to his credit, he does not call it open source or free software: instead, he put it in the public domain under the Unlicense. There’s less info about yserver development than Frame, but yserver’s Github repository contains both CLAUDE.md and AGENTS.md, and both OpenAI Codex and Github Copilot have commits in its history. Previously… There is also a third new X11 server, which we already mentioned back in January. That one is called Phoenix, and it’s written in the relatively new Zig language. Phoenix’s original Git repo seem to be down, and although the homepage is there, it hasn’t been updated in a couple of years and doesn’t mention Phoenix at all. Even so, the Github repo is active, with commits just three weeks ago at the time of writing. We have no information as to whether the developer, known only as dec05eba, is using any LLM tools to work on it. As well as all these, there is the XLibre fork of the X.org server, whose announcement we covered a year ago, followed by its gathing vocal endorsement, including Devuan. Multiple distros and OSes include or support XLibre. Development is active: the project has put out 27 releases so far. (XLibre development does seem to be happening significantly faster than the Wayback project, which appeared a month later. Wayback is a sort of “Wayland display server” to enable entire X11 desktop environments to run on a pure-Wayland display stack. As far as we can see, there have only been three Wayback releases so far, and the last was six months ago.) Arcan Alongside whole new X11 servers, whatever they’re written in (or how), there is also an active project that is far more technologically ambitious than all of them put together. The Arcan display server hit a significant anniversary in June, and developer Björn Ståhl marked it with a blog post: Arcan: 10 Years of Online Obscurity. We wrote about the project back in 2022, in Lash#Cat9: A radical new Linux UI for keyboard warriors. That article focused on just part of the project, its shell Cat9. Cat9 is a shell in the sense of the Windows Shell: it’s a user interface. Cat9 happens to be a command-line one, and it also contains quite a lot of what in traditional Unix terms would be a terminal emulator. Arcan is a lot more than that. Arcan covers a display protocol (called A12) and a display server (comparable to X.org). It includes a command-line shell (Cat9), but also a desktop environment called Durden. Durden isn’t the only one: there’s also a Zooming user interface (ZUI) called Pipeworld. So you can run X11 apps, Arcan has an X server called xarcan, and it can also run Wayland client apps over a module called Waybridge – a pun on weighbridge. Arcan is the sort of ambitous rethink of the Unix display stack we wanted to see – and which Wayland’s developers didn’t even think about, let alone attempt. Arcan doesn’t just let programs open windows over the network like X11. Arcan lets networked computers send media streams to each other, and because it understands hardware 3D it enables remote 3D acceleration, for instance for network gaming. It integrates multitasking and 3D and media right into the Unix command line: shell commands can fade into the background while displaying grapical progress meters, or play media streams in the terminal, or multiple updating parallel zones of text output. There are multiple prices to pay for this, and they are formidable: in the learning curve, and the maturity of the tools, and in interoperability with existing solutions. Arcan really deserves wider attention. Its potential is amazing. It’s also all hand-coded by a tiny team. As far as we can tell, there are no coding assistants here. This is the sort of thing the Linux world deserved, not some modest improvement to local 2D desktops that has taken nearly 20 years to reach minimal usability. ®
peaceful-jp-scenery posted a photo:
Hasedera Temple
長谷寺
These are the "Good Match Jizo" statues at Hasedera Temple in Kamakura. Apparently, there are three of them located within the temple. I visited Shibuya again over the weekend, stopping by Kamakura on the way.
鎌倉の長谷寺にある良縁地蔵で、境内の3ヶ所にあるそうです。週末は再び渋谷に、鎌倉に寄って行きました。
Kamakura city, Kanagawa pref, Japan
mikeleonardvisualarts has added a photo to the pool:
The tech of Terminator 2: an oral history vfxblog goes back in time with more than a dozen ILMers to discuss the development of key CGI tools and techniques, how they worked with early animation packages like Alias, and how a selection of the most memorable shots in the film—forever etched into the history of visual effects—came to be.
Nu (zometeen, 12.45 op papier, loopt altijd uit) LIVE de uitspraak in de zaak tegen Jamal Thailbe, de Irakees die in juli 2020 met zijn gare Mazda 323 verantwoordelijk was voor de dood van Tamar uit Marken. Jamal was tijdens z'n rit over de Zeedijk met de navigatie van de bijrijder aan het klooien, maar kreeg voor het doodrijden van Tamar aanvankelijk slechts een GELDBOETE van 1.500 euro - ongeveer hetzelfde als drie uurtjes parkeren in Amsterdam. Met het betalen van het geldbedrag heeft Jamal de grootste moeite: hij zat weer lekker in Duitsland, precies zoals hij 'm na het ongeval ook smeerde. En pas nadat de OUDERS van Tamar een Artikel 12-procedure indienden ('voor onder meer het veroorzaken van een verkeersongeval met dodelijke afloop en het verlaten van de plaats van het ongeval') besloot het OM over te gaan tot daadwerkelijke vervolging. Dat leverde een lullige eis van 8 weken op. Belangrijkste puntje: uit onderzoek is gebleken dat Tamar 'op een andere plek lag dan waar zij als gevolg van de aanrijding zou moeten zijn terechtgekomen'. Alleen kan niet vastgesteld worden hoe dat precies is gebeurd. De rechter mag het ons allemaal gaan uitleggen. Erg benieuwd. Zo meer..