Radar Daily Briefings

Wordfence Argus reports a critical CVSS 9.8 vulnerability in libheif, a library used by servers to process HEIC images. The supplied report does not establish a fixed release or confirmed CVE status.

Wordfence says it demonstrated protected-file disclosure and code execution on one exact WordPress deployment. The report characterizes exploitation as target-specific and says adapting image exploits to real systems is practical.

Security and platform engineers should inventory server-side libheif and HEIC-processing paths, but the supplied evidence provides no affected-version range, patch, or remediation guidance. Its technical conclusions are based on one deployment and lack broader methodology or reproduction detail.

Wordfence reports that its Argus research found a PHP object injection vulnerability in Tutor LMS, affecting more than 100,000 WordPress sites. The advisory identifies Tutor LMS 4.0.8 as the update to apply.

According to Wordfence, attackers with subscriber-level access could use the vulnerability to achieve remote code execution. The supplied excerpt does not explain the exploit mechanics or the underlying remediation.

Site operators using Tutor LMS should prioritize checking their installed version and updating to 4.0.8. The excerpt does not specify the full affected-version range or provide a CVE identifier.

Cloudflare’s Quick Tunnels provide a released workflow for exposing a local web server through a public HTTPS URL. The page says setup requires one cloudflared command and no account, DNS configuration, or inbound port.

Cloudflare says cloudflared opens an outbound-only connection to its edge, forwarding traffic back to the local machine. The page also describes structured JSON output for hostname, edge, and health, plus webhook-ready and ephemeral workflows for coding agents.

This can simplify sharing local services, screenshots, webhooks, and evaluation harnesses. However, the supplied material is promotional and gives limited architectural, performance, and operational detail.

A 2015 Gamasutra feature revisits historical coding hacks from game developers and includes additional examples from non-game software. The article presents these as anecdotes rather than a release, patch, or formal technical study.

The cases cover varied mechanisms: shuffling BSP compiler inputs, streaming data from executable sections, masking a rendering problem with smoke particles, altering linkage layout, and periodically hiding a window to reclaim memory. Other accounts describe flash-memory initialization, stack overflow avoidance, and runtime flag changes.

These examples illustrate debugging and shipping trade-offs under severe constraints. Their causes and effectiveness are context-specific, and the supplied material does not independently verify the accounts or establish applicability to modern systems.

Gutenberg 24.0 has been released and is available for download. The release extends visual revisions to include post-title changes, adds a grid variation to the Gallery block, and introduces fit-text support for Site Title.

Gallery grids provide customizable layouts with column-count and image-cropping controls that can vary by viewport state. Visual revisions show title diffs alongside body changes, while Site Title can scale to its available width. The release also adds selected-list indentation with Tab, URL-based background images, and visible non-breaking spaces.

The changelog includes editor, site-editor, tooling, and bug-fix updates. The supplied text is truncated, so it does not represent the complete changelog.

The article presents a Mac-based workflow for capturing Wi-Fi PCAP files through macOS Wireless Diagnostics or AirTool 2. It covers selecting the channel and width, capturing traffic from a connected client, and locating Wireless Diagnostics output in /private/var/tmp.

AirTool 2 offers a simpler interface for 5 and 6 GHz capture, using the Mac’s built-in Wi-Fi adapter. The article says external USB adapters cannot be added for Mac PCAP capture, and recommends an M2-series or higher Mac for 6 GHz support.

The workflow also includes WLANPi-based remote capture and multi-channel capability. AirTool 2 is described as costing approximately USD 30, while Wi-Fi 7 Mac availability is identified as a late-2025 limitation.

The WordPress Training Team’s September 15, 2026 agenda proposes several contributor and education initiatives. These include a possible biweekly GitHub triage meeting, handbook and lesson maintenance, volunteer review work, and a Plugin Development learning cohort.

The agenda reports 590 open issues and suggests handling them by category through review, prioritization, comments, and fixes. It also requests feedback on text-to-speech or read-aloud prototypes for course lessons and lists queues for content review and validation.

The plans remain proposed: the triage schedule and starting category are not finalized, and the supplied agenda provides no technical evaluation of the prototypes or outcomes for the planned cohort.

datasette-auth-github 1.0 has been released as a stable version of the Datasette plugin that authenticates users against GitHub. The release follows a session-persistence fix in pull request #80.

The plugin had been setting authentication cookies without a Max-Age parameter. As a result, sessions expired when the browser session ended; the release adds the missing cookie lifetime configuration.

The plugin is tested against Datasette 0.65.x and Datasette 1.0ax. Operators using GitHub authentication with this plugin should review the release if their sessions have been unexpectedly short-lived, while noting that the supplied document gives limited implementation and compatibility detail.

The official WordPress development repository has published the 6.9.8 tag, pointing to commit 9fc6fe3. The tag was created on September 17, 2026, and the repository identifies adamsilverstein as the person who tagged it.

The supplied page contains repository metadata and the tag’s Git-SVN identifier, but no release notes or technical change summary. It therefore confirms the release tag without explaining what changed.

Maintainers can use the tag and commit identifier to locate the source revision. Further documentation is needed to assess fixes, compatibility, migration requirements, or operational impact.