CISA has added two critical Joomla extension bugs to its Known Exploited Vulnerabilities catalog after attackers were caught exploiting both flaws to upload malicious code onto vulnerable websites. The newly listed bugs affect iCagenda, an events calendar extension for the open source Joomla content management system, and Balbooa Forms, a popular form builder used to collect contact requests, registrations, surveys, and file uploads. Joomla powers roughly 1.2 percent of all websites – around a million sites worldwide – with extensions developed by independent, third-party companies, doing much of the heavy lifting beyond the core platform. Both vulnerabilities carry the maximum CVSS score of 10 and allow attackers to upload arbitrary files that can ultimately be executed as PHP code on the server, handing over remote control of the affected site. CISA added CVE-2026-48939, affecting iCagenda, and CVE-2026-56291, affecting Balbooa Forms, to its KEV catalog this week after confirming in-the-wild exploitation. Federal civilian agencies were ordered to patch against the flaws under the agency's vulnerability management directive, but the warning is equally relevant to the wider Joomla community, given that both extensions are used on public-facing websites. The iCagenda bug allows attackers to upload a malicious PHP file through the extension's attachment feature, turning what should be a simple file upload into remote code execution, CISA said. Security firm mySites.guru said it spotted attackers exploiting the iCagenda bug just hours before patched versions 4.0.8 and 3.9.15 were released in mid-June. The attacks targeted the extension's "Submit an Event" feature, which lets visitors contribute events to a site's calendar. Researchers said they observed automated scanning looking specifically for vulnerable installations before dropping web shells onto compromised servers. The Balbooa Forms bug is much the same story. Researchers said the extension's frontend upload endpoint accepted files from anonymous visitors without authentication, CSRF protection, or meaningful checks on file types. That made it possible to upload a PHP file into a publicly accessible directory and execute it remotely. The researchers said they uncovered the flaw while investigating an abuse report from a customer whose Joomla site was already under attack. Balbooa responded with version 2.4.1 on July 9, but researchers warned that exploitation is continuing against sites that have yet to update. If there's a silver lining, it's that the fixes are already available. If there's a downside, it's that the attackers didn't wait around for release notes. ®

Wayland is dominating the recent news about FOSS GUIs – even dignified elder Xfce’s official support is getting close. However, X11 is very much not dead yet, and new developments keep appearing. Last week, Norwegian FOSS developer Geir Isene announced his all-new server for the venerable X11 display protocol. Its description is in the title of the announcement post: Frame - the first Linux Assembly X server. Isene explains his motivation thus: “On my quest to own my software, one foundational piece kept itching… the X server. The underlying graphics engine, the thing that puts pixels on the screen. X11 is 4 million lines of code, a beast very few can claim they understand. So I did the reasonable thing. I wrote my own, in Assembly.” (This, for clarity, is extremely dry Norwegian humor. Writing your own X11 server in assembly language is the polar opposite of what most Unix developers would consider “reasonable…” But there is a reason behind the decision, and you may already have guessed it.) Isene also has his own window manager, Tile; his own terminal emulator, Glass; and even his own shell, called Bare. He calls the whole stack CHasm — CHange to ASM. All the tools are standalone binaries, implemented in x86-64 assembly language, targeting Linux, with no external dependencies. To go with them, he also has a similarly compact suite of Rust-based tools as well, named Fe₂O₃. It reminds us of the Suckless collection of extremely minimal, statically linked Linux apps, which once included a entire statically-linked Linux distro called Stali. Although Stali has been unmaintained for nearly a decade now, there are others: one current statically linked Linux distro is Oasis.) If you like a hyper-minimalist Linux setup, Isene’s custom stack of tools sounds amazing – perhaps even too good to be true. (That’s a hint, or what we gather fiction writers call foreshadowing.) yserver Remarkably enough, Frame is not the first new X11 server for Linux that has appeared recently. That distinction goes to yserver, which appeared last month. Developer Jos Dehaes describes it as “a modern X11 server written from scratch in Rust.” This also sounds good, especially if you’re an admirer of Rust. We have started using a few Rust-based projects here in the Irish Sea wing of Vulture Towers. They tend to be small, fast, stable, and quite clean of legacy baggage. They offer a significant contrast with Electron-based ones. In terms of tech legacy baggage, they score very well on what sometime Reg contributor Verity Stob measured with the Stob Cruft index. Yserver looks impressively complete: for instance, Dehaes has a list of 13 existing environments that run fine under it, from Enlightenment to Xfce. But – there’s always a “but” – before you get too excited, there’s a catch. Both Frame and yserver were built using LLM bots. (“Vibe coded” feels too harsh for programs of this complexity, but some will apply it anyway.) So, although Isene says of Frame, “I wrote my own in Assembly,” further down the same page, he concedes: “When something breaks or I want a feature, I turn to my buddy Claude and describe the itch.” To be honest, for this staunchly AI-skeptical vulture, this means Isene didn’t really write the CHasm programs himself: he presumably wrote a detailed spec, from which a bot generated code. This also arguably means he doesn’t strictly own the software, but on that point, to his credit, he does not call it open source or free software: instead, he put it in the public domain under the Unlicense. There’s less info about yserver development than Frame, but yserver’s Github repository contains both CLAUDE.md and AGENTS.md, and both OpenAI Codex and Github Copilot have commits in its history. Previously… There is also a third new X11 server, which we already mentioned back in January. That one is called Phoenix, and it’s written in the relatively new Zig language. Phoenix’s original Git repo seem to be down, and although the homepage is there, it hasn’t been updated in a couple of years and doesn’t mention Phoenix at all. Even so, the Github repo is active, with commits just three weeks ago at the time of writing. We have no information as to whether the developer, known only as dec05eba, is using any LLM tools to work on it. As well as all these, there is the XLibre fork of the X.org server, whose announcement we covered a year ago, followed by its gathing vocal endorsement, including Devuan. Multiple distros and OSes include or support XLibre. Development is active: the project has put out 27 releases so far. (XLibre development does seem to be happening significantly faster than the Wayback project, which appeared a month later. Wayback is a sort of “Wayland display server” to enable entire X11 desktop environments to run on a pure-Wayland display stack. As far as we can see, there have only been three Wayback releases so far, and the last was six months ago.) Arcan Alongside whole new X11 servers, whatever they’re written in (or how), there is also an active project that is far more technologically ambitious than all of them put together. The Arcan display server hit a significant anniversary in June, and developer Björn Ståhl marked it with a blog post: Arcan: 10 Years of Online Obscurity. We wrote about the project back in 2022, in Lash#Cat9: A radical new Linux UI for keyboard warriors. That article focused on just part of the project, its shell Cat9. Cat9 is a shell in the sense of the Windows Shell: it’s a user interface. Cat9 happens to be a command-line one, and it also contains quite a lot of what in traditional Unix terms would be a terminal emulator. Arcan is a lot more than that. Arcan covers a display protocol (called A12) and a display server (comparable to X.org). It includes a command-line shell (Cat9), but also a desktop environment called Durden. Durden isn’t the only one: there’s also a Zooming user interface (ZUI) called Pipeworld. So you can run X11 apps, Arcan has an X server called xarcan, and it can also run Wayland client apps over a module called Waybridge – a pun on weighbridge. Arcan is the sort of ambitous rethink of the Unix display stack we wanted to see – and which Wayland’s developers didn’t even think about, let alone attempt. Arcan doesn’t just let programs open windows over the network like X11. Arcan lets networked computers send media streams to each other, and because it understands hardware 3D it enables remote 3D acceleration, for instance for network gaming. It integrates multitasking and 3D and media right into the Unix command line: shell commands can fade into the background while displaying grapical progress meters, or play media streams in the terminal, or multiple updating parallel zones of text output. There are multiple prices to pay for this, and they are formidable: in the learning curve, and the maturity of the tools, and in interoperability with existing solutions. Arcan really deserves wider attention. Its potential is amazing. It’s also all hand-coded by a tiny team. As far as we can tell, there are no coding assistants here. This is the sort of thing the Linux world deserved, not some modest improvement to local 2D desktops that has taken nearly 20 years to reach minimal usability. ®

Indian Space Research Organisation (ISRO) has successfully tested systems it plans to use on the nation's first crewed space mission, but when that mission will launch remains a mystery. ISRO's crewed mission program, "Gaganyaan," is intended to carry astronauts on a rocket called the Human-Rated Launch Vehicle Mark 3 (HLVM3) into orbit. The space agency has already launched the cargo-rated version of the three-stage LVM3 rocket nine times and has a perfect success rate. When India launches humans into space, they'll occupy a crew module. On Sunday, ISRO announced it had successfully accomplished three major qualification tests for that module. One test qualified the primary flotation unit in the system designed to right the crew module after splashdown. Another tested the mechanism that disconnects the umbilical links between the crew and service modules. The third assessed whether the crew module structure could withstand the loads generated when the cover protecting its parachutes separates. The tests are the latest in a long series of qualification milestones for Gaganyaan. Last July, ISRO tested the Service Module Propulsion System (SMPS) and proclaimed it ready to raise and maintain its orbit, handle an emergency mission abort, and perform the deorbit maneuvers ahead of re-entry. However, the agency has had little to say about when Gaganyaan will fly. ISRO initially targeted 2022 for the first crewed Gaganyaan flight, then changed the date to 2024, before scheduling an uncrewed flight carrying a robot astronaut for 2025. ISRO missed that deadline too. Officials and ministers have since suggested test flights could take place in 2027, followed by crewed missions in 2028. But the agency has never published a firm timeline. That caution is understandable because space is hard and the stakes are high for any crewed mission – never mind a mission that would make India just the fourth nation to launch humans into space. ®

OPINION Capita's share price tanked 9 percent last week after it told investors it was taking a hit on its contract with the UK government's Civil Service Pension Scheme (CSPS), which has left some of its 1.7 million members unpaid following a disastrous launch. A trading update said operating profit would be down between £25 million and £40 million in 2026 as a result. Sage voices were soon on hand to calm fears, though. "The scale of the reaction sits oddly with the contract's modest financial weight," said Ian Lyall of Proactive Investors. The hit to revenue was "a sliver of Capita's roughly £2 billion turnover." For the first four months of the year, Capita reported £750 million of total contract value won, up 20 percent on a year earlier. "For now, there is no sign that reputational damage is denting that momentum," Lyall added. The assessment that Capita's CSPS troubles may barely dent its long-term prospects will be of little comfort to scheme members left struggling to make ends meet. But they do suggest the wider problem. In the House of Commons last week, Minister for the Cabinet Office Nick Thomas-Symonds said the Capita CSPS contract "could be a prime candidate for insourcing in the future." However, he also admitted that option would have to wait. "If I were to terminate the contract straightaway, that would clearly cause severe disruption to the payroll. I cannot replace a complex pension operation overnight," Thomas-Symonds said. So, for now, the government is stuck with Capita, and its performance will be of concern on other contracts. It has a deal to work on CSPS cases to provide the so-called McCloud remedy removing age discrimination from public service pensions. That work is expected to be completed by March next year, through a separate contract at an additional cost of £45 million. Then there is the promise to take over running finance and HR services for the Department for Work and Pensions (DWP), Ministry of Justice (MoJ), Home Office, and the Department for Environment, Food and Rural Affairs (Defra). Its £370 million contract win is being challenged in court by rival bidder Sopra Steria, which alleges the winning bid was "abnormally low" and based on staffing "significantly below the current levels." At the time, Capita told The Register it had taken part in a robust procurement process and stood ready to work with the DWP to ensure value for money. A DWP spokesperson said its priority was continuity of service and value for money for the public. Nonetheless, concerns about staffing levels echo the CSPS contract. In October last year, a report from Parliament's spending watchdog said Capita planned to employ 332 staff on the scheme, 33 less than the previous provider, MyCSP. The Public Accounts Committee (PAC) report said estimated resourcing levels assumed that "more automation and increased functionality of its IT system will require fewer staff." Speaking to the PAC last week, Government Chief Commercial Officer Andrew Forzani said Capita made a series of commitments about its ability to deploy technology and automate the service as part of the selection process. Chris Clements, managing director of Capita Pension Solutions, said that Capita employed additional staff in a "surge" before go-live "because we identified that some of the technology was not going to be there on time." Group CEO Adolfo Hernandez also told the meeting it hired more people because it didn't appreciate the backlog from the previous provider. Whether the DWP's shared service cluster will encounter similar problems is yet unanswered. However, Sopra Steria's case alleges the Capita bid was 40 percent under the DWP's own cost modeling. To understand why the government continues to choose Capita, you have to understand its options. Forzani explained to the PAC last week that "a very lengthy procurement process" for CSPS started with six providers but there were "only two credible final bids, which were Capita and MyCSP." Civil Service Chief Operating Officer and Cabinet Office Permanent Secretary Cat Little also told the PAC the public sector is one of the last parts of the economy to offer defined benefit pension schemes. "We are a very large customer for complex schemes in a market that has a very small number of suppliers," she said, adding that the government's ability to "shape the market" for suppliers was limited by the high risk and complex nature of the scheme. "We are in a very classic make-or-buy decision making process." That kind of decision will come into focus from April next year, when a government policy announced in June kicks in. All contracts over £1 million in value must be assessed for in-house viability before renewal, and central government departments exceeding £100 million in annual spend must develop five-year insourcing strategies. "This framework builds the exact long-term capability that we need, shifting our focus from short-term pricing to service quality and operational resilience," Thomas-Symonds promised the House of Commons last week. While the new policy might seem like a good option given Capita's recent performance on the CSPS, insourcing raises more questions than it answers. Does the government have the management skills to bring contracts in-house, design the services, and build the technology? Can it recruit those skills? Are Civil Service skills, pay, and recruitment systems set up to support such an ambition? The government has promised "a competitive pay framework, high-impact work and clear pathways for new and existing talent" in tech leadership as part of its Roadmap for Modern Digital Government. A report from Parliament's Science, Innovation and Technology committee said earlier this year that the government's aim to ensure that those in leadership roles have the necessary digital expertise "will require reforms to recruitment and retention mechanisms, including pay, as well as a broader process of cultural transformation." Even before its new insourcing rules, the government was struggling to find the technical professionals and leaders it needed. Back in 2023, the PAC reported on barriers to achieving greater efficiency through digital transformation. Dame Meg Hillier MP, chair at the time, said digital ambitions were "hobbled by staff shortages, and a lack of support, accountability and focus from the top." Recruiting the requisite workforce for significant insourcing will take time. The next general election is due by 2029. Until the government builds that capability, inertia may remain stronger than its insourcing ambitions, leaving departments dependent on the same small pool of suppliers. ®

Thomas Hawk posted a photo:

Thomas Hawk posted a photo:

mikeleonardvisualarts posted a photo:

peaceful-jp-scenery posted a photo:

Hasedera Temple
長谷寺

These are the "Good Match Jizo" statues at Hasedera Temple in Kamakura. Apparently, there are three of them located within the temple. I visited Shibuya again over the weekend, stopping by Kamakura on the way.

鎌倉の長谷寺にある良縁地蔵で、境内の3ヶ所にあるそうです。週末は再び渋谷に、鎌倉に寄って行きました。

Kamakura city, Kanagawa pref, Japan

mikeleonardvisualarts has added a photo to the pool:

The tech of Terminator 2: an oral history vfxblog goes back in time with more than a dozen ILMers to discuss the development of key CGI tools and techniques, how they worked with early animation packages like Alias, and how a selection of the most memorable shots in the film—forever etched into the history of visual effects—came to be.

Nu (zometeen, 12.45 op papier, loopt altijd uit) LIVE de uitspraak in de zaak tegen Jamal Thailbe, de Irakees die in juli 2020 met zijn gare Mazda 323 verantwoordelijk was voor de dood van Tamar uit Marken. Jamal was tijdens z'n rit over de Zeedijk met de navigatie van de bijrijder aan het klooien, maar kreeg voor het doodrijden van Tamar aanvankelijk slechts een GELDBOETE van 1.500 euro - ongeveer hetzelfde als drie uurtjes parkeren in Amsterdam. Met het betalen van het geldbedrag heeft Jamal de grootste moeite: hij zat weer lekker in Duitsland, precies zoals hij 'm na het ongeval ook smeerde. En pas nadat de OUDERS van Tamar een Artikel 12-procedure indienden ('voor onder meer het veroorzaken van een verkeersongeval met dodelijke afloop en het verlaten van de plaats van het ongeval') besloot het OM over te gaan tot daadwerkelijke vervolging. Dat leverde een lullige eis van 8 weken op. Belangrijkste puntje: uit onderzoek is gebleken dat Tamar 'op een andere plek lag dan waar zij als gevolg van de aanrijding zou moeten zijn terechtgekomen'. Alleen kan niet vastgesteld worden hoe dat precies is gebeurd. De rechter mag het ons allemaal gaan uitleggen. Erg benieuwd. Zo meer..

Social

Deze vorm van abortus tussen de 22 en 24 weken ligt zo gevoelig omdat het, zoals bij een aangeboren afwijking of een ernstige bedreiging voor de gezondheid van de moeder, niet op medische indicatie is, maar op "sociale indicatie". En sociale indicatie komt er eigenlijk op neer dat de zwangerschap ongewenst is, om welke reden dan ook.

Het Amsterdamse Onze Lieve Vrouwe Gasthuis (OLVG) is begonnen met een pilot-programma, maar de gynaecologenberoepsvereniging Nederlandse Vereniging voor Obstetrie en Gynaecologie (NVOG) schrijft dat "de oproep aan ziekenhuizen (PDF) inmiddels heeft geleid tot belangstelling vanuit verschillende centra verspreid over het land." De oproep schrijft voor dat er onder dit pilot-programma "maximaal vier" van dit soort abortussen uitgevoerd zullen worden.

Maar goed, dan het pijnpunt: "‘Niet zelden’ wordt een foetus bij zo’n zwangerschapsafbreking levend geboren, stelt de NVOG," schrijft het Algemeen Dagblad. En dan rijst natuurlijk de vraag: hoe wordt een levend geboren kindje dan 'geaborteerd'? We zochten het op, en lazen in dit 'Modelprotocol Medisch handelen bij late zwangerschapsafbreking' (PDF) van de NVOG het volgende:

"Het postnatale beleid zal, in beginsel, bestaan uit het niet beginnen van levensverlengend handelen, waarbij in voldoende mate palliatieve zorg wordt verleend."

De voorkeur gaat echter uit naar zogeheten "foeticide" voordat het kind ter wereld komt:

"Foeticide kan op verschillende manier verricht worden, dan wel door het intracardiaal of intrathoracaal inspuiten van een medicijn met asystole tot gevolg, dan wel door middel van navelstrengcoagulatie. Het valt te overwegen om de foetus te sederen en pijnstilling toe te dienen voordat hiertoe wordt overgegaan." Een 'asystole' is een hartstilstand, en een 'navelstrengcoagulatie' betreft het dichtbranden van de navelstreng. Maar foeticide is dus niet altijd mogelijk.

De NVOG schat dat er in Nederland jaarlijks zo'n 225 late abortussen zonder medische indicatie plaatsvinden, waarbij de vrouwen daarvoor dan uitwijken naar Spanje, Engeland of sommige Amerikaanse staten. Volgens het ministerie van Volksgezondheid werden er in 2024 in Nederland in totaal 331 abortussen tussen de 22 en 24 weken uitgevoerd.

De NVOG erkent in het eigen vakblad over deze abortussen op enkel sociale indicatie "dat dat deze late abortussen een ‘aanzienlijke zorgzwaarte’ voor het zorgpersoneel kunnen opleveren. Maar de NVOG vindt ook dat het gaat om ‘wettelijk toegestane en noodzakelijke zorg‘ en dat deze zorg nu ‘tekortschiet’. En, benadrukken de auteurs: ‘Het gaat niet om grote aantallen, maar wel om zwangeren in een uiterst kwetsbare situatie.’ (...) Individuele personeelsleden zouden volgens een woordvoerder altijd mogen weigeren, maar het team heeft als geheel wel een zorgplicht. Verder is de pilot nog in de beginfase en wil het OLVG niets kwijt over de uitvoering ervan."

Toestanden.

Shipping in the Sea of Azov remained restricted on Tuesday, according to Reuters sources, marking the biggest disruption to the Black Sea grain trade since the start of the war in Ukraine.

Ukrainian rapper Kyivstoner denied the Russian allegations in a series of posts on Instagram.

Elke seconde smelt er een scheepscontainer aan sneeuw en ijs van een van de grote gletsjers in IJsland. De snellere afkalving van de ijskappen heeft grote gevolgen. „Herinner je je de vulkaanuitbarstingen in 2010 nog, toen er in Europa niet gevlogen kon worden? Dat gaat vaker gebeuren.”

Het is zomer. Nederland wil op vakantie. Maar waar kunnen we nog naartoe? De eerste aflevering van MAX Vakantieman biedt verdieping in dit urgente vraagstuk. De oplossing ligt volgens onze tv-recensent in de Achterhoek.

De Amerikaanse chipfabrikant Intel investeert 5 miljard euro in de uitbreiding van zijn chipfabriek in Ierland.

​De nieuwste film The Odyssey van Christopher Nolan is eindelijk te zien in de bioscoop. In deze moderne vertolking van het bekende mythische verhaal komt Odysseus steeds in de file te staan wegens bosbranden.

“Net als in het oude Griekse verhaal komt Odysseus onderweg voor allerlei uitdagingen te staan: een afgesloten Route du Soleil, afgezette wegen, urenlange files”, vertelt Nolan. “De vraag is natuurlijk: zal Odysseus het redden tot de natuurcamping in Zuid-Frankrijk?”

Volgens critici is het opnieuw een episch verhaal. “Wat een ritje van 12 uur zou moeten zijn, wordt een dagenlange zwerftocht over kokendhete asfaltwegen”, schrijft filmcriticus Bert Bokhoven. “In een zit van bijna drie uur trotseert Odysseus daarin de grootste obstakels: van tankstation Hazeldonk tot rode kruizen, van een lauwwarm broodje ‘Crunchy Chicken’ tot verloren sanifair bonnetjes.”

​

&

Astronomers have detected erythrulose, a sugar found in raspberries and self-tanners, in a gas cloud near the center of the Milky Way. While not essential for life itself, the molecule can convert into a form thought to be important for life's origins, adding evidence that key prebiotic ingredients may be widespread across the galaxy. The Associated Press reports: Using two dish-shaped radio telescopes in Spain, researchers collected data from a large gas cloud near the center of the Milky Way. They identified the sugar in gas form by comparing telescope signals to samples in the lab. It's the latest kind of sugar detected in space -- in a region crossed by NASA's twin Voyager, the farthest spacecraft to ever travel from Earth.

Scientists have found interesting chemistry in our galaxy, including building blocks for genetic material and parts of the cell. They spotted a cousin to table sugar near the center of the Milky Way about 25 years ago, and black grains from asteroid Bennu retrieved by NASA's Osiris-Rex spacecraft yielded other sugars, including a key DNA ingredient. The latest sugar isn't essential for life, but can easily convert to a form that's thought to be crucial to kick-starting life on Earth. And it's one of the most complex sugars spotted so far, said astrophysicist Erika Hamden with the University of Arizona. The results were published in the journal Nature Astronomy.

Read more of this story at Slashdot.