- 01Android is closing, and F-Droid is the wrong shape to survive itFrom 30 September, apps on certified Android devices must trace back to a developer who showed Google a government ID. F-Droid does not have developers in that sense — it has source code and a signing key. That mismatch is not a bug in the policy. It is the policy.
- 02StyleSmuggler: the crash log was the payloadCVE-2026-75650 turns Magento's own error reporting into a file-write primitive, then executes it while rendering an email. CVSS 10.0, unauthenticated, and exploited before the patch existed.