Wednesday, 4 November 2026
C++26 DIS fails for the first time in standards history; Debian apt gets a root-level MitM RCE fix; AI triples engineering output at a cost
Today's Lead
EngineeringAndreas Fertig's Blog
C++26 DIS failed, how does C++ survive?
On October 23, 2026, the National Bodies (NBs) of the International Organization for Standardization (ISO) rejected the C++26 Draft International Standard (DIS). Several NBs said Contracts, a C++26 feature, was not ready, and the required two-thirds majority was not reached. The author states that this is the first failed DIS in C++ history that he found. ISO allows four paths: a revised DIS, a revised committee draft (CD), a Technical Specification, or cancellation.
Engineering
IEEE Spectrum
The PHP2Shell Vulnerability Heralds Cybersecurity Hell
In late October 2026, the PHP2Shell vulnerability put sites including NASA, Wikipedia, and WordPress or Drupal sites at risk of data theft and remote code execution. The underlying bug, an out-of-memory error, was reported to the PHP Foundation in 2024 and was initially treated as a low-priority crash. A researcher at the firm Calif, aided by AI tools, turned the bug into a critical exploit during an OpenAI-sponsored audit, and a patch was released before any malicious use was known. Experts quoted in the article say that AI is exposing decades of legacy software, that fixing bugs is harder than finding them, and that formal verification tools may help automate patching.
Debian Security Team
[SECURITY] [DSA 6607-1] apt security update
The Debian Security Team published Debian Security Advisory (DSA) 6607-1 on November 4, 2026, for the Advanced Package Tool (APT). APT can merge two different package downloads when an HTTP redirect gives them the same URI. Improper file handling during an HTTP download resume lets a man-in-the-middle attacker replace a package after verification. Successful exploitation can lead to arbitrary code execution as root. The update also fixes several out-of-bounds access issues. For the stable release (trixie), the fix is in apt 3.0.4, and Debian recommends upgrading APT packages. The advisory tracks the main issue as CVE-2026-109518.
The Pragmatic Engineer
How software engineering is changing: a tale of two eras
Neil Kakkar, an engineer at Tano, describes how AI agents changed his work. At PostHog, before AI, he merged 8 to 20 pull requests (PRs) per month. At Tano, he merges over 200 per month. At Tano, an AI review agent checks every PR, and human review is optional. Speed also causes errors, such as a wrong currency unit and a blocked database migration. The team fixes these errors quickly and adds each lesson to the review agent. Kakkar also reports new limits, including mental fatigue, lost shared context, and token costs.
Cloudflare Blog
Introducing Zero Wire, a hub for investigating critical Internet vulnerabilities
Cloudflare introduces Zero Wire, a public vulnerability feed in the security section of Cloudflare Radar. Each briefing explains a significant critical CVE in plain language, names who should investigate, and lists recommended actions. Zero Wire complements vendor advisories and does not list every CVE. Cloudflare uses the php2shell flaw in the PHP runtime as an example, and states that patching application code or plugins does not fix that runtime flaw. Cloudflare also states that a WAF rule is a compensating control, not a replacement for patching.
Humanities
JSTOR Daily
Why We Cringe
Cringing is the discomfort people feel when someone else's behavior seems embarrassing. Drawing on scholar J. Logan Smilges, the article describes cringe as both emotional and political. It arises when an observer expects shared feelings and another person's conduct suggests otherwise. The discomfort often comes from the gap between how the person views their actions and how the observer views them. Smilges also argues that media depictions of cringe often rely on disability, and that disabled, neurodivergent, and queer people are often cast as cringeworthy and excluded from shared feeling.