Google Chrome #zeroday

Google is aware that an exploit for CVE-2026-87491 exists in the wild.

https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html

#Google #Chrome #CVE

bear with you? dude that sounds dangerous get out of there

@jcoglan not a frequent obsidian user, maybe there's some config for this?

coincidentally, I just slop-coded a python static file server that live renders markdown+mermaid in the browser. It doesn't have embedded mermaid (inside md) support yet, but if you think you could use it I'll publish it sometime today.

LLM anti-pattern:

- #FOSS drops, everyone happy
- #FOSS bugs surface, bitrot needs handling
- Instead of contributing fixes, users use #LLM to solve their specific issues
- #FOSS never gets fixed

Bonus: bugs accumulate so much that the project eventually dies, while everyone regenerates parts of it from scratch on-demand with LLM.

Tickets are live and trainings are up too! Round 1 pricing is happening and won’t last long. Now’s the time to grab your ticket: https://re-verse.io

@jcoglan obsidian? https://www.mermaideditor.io/integrations/obsidian

CVE-2026-83991: Windows Cloud Files access-check bypass https://github.com/karollooool/CVE-2026-83991-writeup-and-poc

@acsawdey I'm also thinking about using this as a compat layer between e.g. IBMi/PASE and x86. Feels like it'd match pretty well with IBMi's SLS too?

@acsawdey Just saw your profile, would be really curios how this works on IBMs BE platforms!

@acsawdey I haven't tried it but that seems reasonable (also, protobuf works in a similar fashion iirc)

"The Cap’n Proto encoding is appropriate both as a data interchange format and an in-memory representation, so once your structure is built, you can simply write the bytes straight out to disk!"

https://capnproto.org/

1) Why didn't I know about this??
2) Why did I have to learn about this because of an article about the authors gamer/geek mansion?

OpenAI claims that they used 300 billion output tokens from a swarm of ~10,000 concurrent instances of an internal model that is almost certainly larger and more expensive to run than GPT-6. That's the total token output, including exploring related problems, which, along with spying on other researchers work via codex, "led them to the solution," so that should be considered the minimum accounting - the lower token count focused just on the proof excludes token use that would normally be considered a dead-center part of "working on a problem."

Token use is only a fraction of the cost here, but it's the best estimate we have: this would be billed as R&D, much bigger than cost of service, and so costs here are actually a big slush. the internal model could be 60 quadrillion parameters for all anyone knows. there's no reason to believe any of openAI's numbers here at all, so our conservative estimate will be conservative among possible conservative estimate universes - there are some motivations to inflate token usage, but given the um minified python defaults of GPT-6, we assume OpenAI wants to be seen as minimizing token output per task.

All of OpenAI's API costs are presumed to be subsidized, lower than the actual cost of running the models. If one were to pay the API costs for 300 billion tokens for GPT-6, at $75 per million output tokens with long context, that would be 22.5 million dollars of tokens (the minimum, assuming 100% cached output with short context is still 3.75 million, but that's an unrealistic minimum). OpenAI apparently also had a full team of people working on this, so 22.5 million doesn't include their salaries, etc.

Tristan Buckmaster only has one grant listed from NSF, a CAREER grant for $450k from 2022 through 2028, averaging $70k per year the last three years.

If i search the NSF grants database for any award from the Division of Mathematical Sciences with "navier-stokes" in the abstract (surely, imprecise, and most likely a sizeable overcount because this is "all work that mentions the equation" not "work spent specifically on the millenium prize proof"), then i get $135m worth of awards since 1978, including large training grants for centers, etc. so $22.5m would be ~16% (or, roughly, 1/6th) of all funding that NSF has allocated to research that mentions the problem in their grants for almost 50 years.

If i then use NSF's API to find all the publications that have come from these grants, I find 4,928 papers. I can match 4264 to entries in OpenAlex (85%), yielding 142,606 citations (1/6 of which is 710, and 23,767, respectively).

So, assuming we believe OpenAI's accounting, the headline is basically "OpenAI researchers seem to have stolen the work of mathematicians that were using Codex, and then spent 1/6 of all the funding NSF has given with abstracts mentioning navier-stokes over the past 50 years, which amounts to an entire subdiscipline of work, feeding, housing, and training generations of mathematicians, in order to generate proof of two of the statements in a millenium prize problem"

I dont know how NSF funds math, but i sort of doubt they give grants for "try to solve millenium problems full stop." idk, maybe an alternative strategy would be to just "fund basic research," because even in this specific domain of an axiomatic universe with an unambiguously evaluable solution to a problem where brute force is possible, "AI" doesn't seem like it's really that much of a bargain, and "paying people to be experts at things" has lots of known good side effects like "someone actually understands the solution"

Decided to take some heavy stuff from A to B after lunch as a little exercise.

Now my muscles are so tense I can barely use vim.

Anthropic formalized Fermat's Last Theorem in 13M lines of Lean. We "proved" it in 20 lines by exploiting a bug we found in Lean.

Root cause: Lean's string slicing has two implementations, the logical definition and the compiled C++. At position 2^63 they disagree: one returns "", the other the whole input. This bug causes Lean to accept two contradictory facts, which then lets you "prove" anything, including FLT. https://blog.trailofbits.com/2026/09/09/a-proof-of-fermats-last-theorem-that-fits-the-margin/

#lean

In short, the indiscriminate use of powerful solution-extraction tools can achieve the immediate short-term goal of solving problems at hand, but at the cost of sustaining the ecosystem for the next wave of progress, or in understanding the progress already obtained.

While it may be technically infeasible to completely prohibit the use of automated tools to perform indiscriminate solution extraction, I believe that we can still designate many classes of problems as being desirous of a careful analysis that not only solves the problem, but identifies insights from the solution process, and learn more about the difficulty landscape for nearby problems, and for which raw solutions without such analysis would be of negligible or even negative value for these purposes. This is analogous to how a modern food donation drive no longer accepts arbitrary contributions even when they are verified to be technically edible, but instead maintains explicit and socially accepted standards on what level of contributions are actually sought. (4/4)

[RSS] HP One Agent: local privilege escalation through race condition [CVE-2026-5064]

https://blog.scrt.ch/2026/09/08/hp-one-agent-local-privilege-escalation-through-race-condition-cve-2026-5064/

Hashtag JustDebuggingThings

"Is that encryption load bearing?"
"No, it's emotional support cryptography"

Another 3 Windows LPE's I found just patched in September patch Tuesday!

CVE-2026-68839 - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68839

CVE-2026-69720 - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69720

CVE-2026-69571 - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69571

Today, Project Zero is releasing MAccConc, a tool by @tehjh that enables deterministic testing of race conditions on Linux. It can be used for fuzzing, ad-hoc exploration, regression tests and more!

https://projectzero.google/2026/09/maccconc-race-condition.html