The Berlin Bassline Brief

The Berlin Bassline Brief

Archives
Log in
Subscribe
October 21, 2026

Berlin Bassline Brief #23: PHP RCEs, Hexacon, LLM text watermarking verifiability study, xtool, tune into macOS fm

PHP2Shell RCEs, iOS jailbreak at Hexacon, AI watermark verifiability paper, xtool Xcode replacement, on-device macOS LLMs with fm.

"The crows above the forest call;
Tomorrow they may form and go."


This is a very beautiful time of year in Berlin; cranes and greylag geese fly overhead to their Brandenburg rest stops before continuing on to more southerly destinations. You can hear them before you see them, but occasionally they also fly closely past my terrace and leave me speechless.

Most of the security discussion in the middle of this week is about the PHP2Shell RCEs which have caused so many sites to go offline prophylactically, so I won't pretend there was a bigger story.

Security, General:
PHP RCEs: https://krebsonsecurity.com/2026/10/widespread-php-flaw-may-cause-many-site-outages-today/

Security, Apple Platforms:
New untethered jailbreak technique demoed at Hexacon: https://tech.yahoo.com/cybersecurity/articles/hackers-jailbreak-iphone-18-pro-193604534.html

Interesting Paper:
The Invisible Watermark: A Pilot Study on the Verifiability Gap in AI Text Watermarking by Selma Bulut, Adem Korkmaz, Selahattin Kosunalp, Vedat Tümen, Erdal Akin: https://www.mdpi.com/2076-3417/16/20/10335

Interesting Tool:
xtool is a cross-platform Xcode replacement: https://github.com/xtool-org/xtool

Apple Platforms Security (or privacy) Concept of the Week:
Try on-device AI with fm by Howard Oakley: https://eclecticlight.co/2026/10/10/try-on-device-ai-with-fm/




The Berlin Bassline Brief is curated and commentated by Halle Winkler, CEH, Berlin – get in touch if you could use security consulting, fractional AppSec leadership, or team training in the area of iOS and macOS secure development.

Check out my course Breaking Into the Security Mindset, for engineers and engineering managers, to get to grips with the new application security landscape: https://www.driyourcareer.com/security

RSS

Don't miss what's next. Subscribe to The Berlin Bassline Brief:
← Newer Berlin Bassline Brief #24: AI guardrails point at vulns, Apple patches, nuance warfare, ponytail for security, and new Keychain backups rigmarole. Older → Berlin Bassline Brief #22: Missed issue, melting ice cream, iPhone inactivity reboot bypass, FemHealth security from the SWE perspective, new sandbox microVM, FDA changes
Halle Winkler on LinkedIn
Powered by Buttondown, the easiest way to start and grow your newsletter.