Berlin Bassline Brief #23: PHP RCEs, Hexacon, LLM text watermarking verifiability study, xtool, tune into macOS fm
PHP2Shell RCEs, iOS jailbreak at Hexacon, AI watermark verifiability paper, xtool Xcode replacement, on-device macOS LLMs with fm.
"The crows above the forest call;
Tomorrow they may form and go."
This is a very beautiful time of year in Berlin; cranes and greylag geese fly overhead to their Brandenburg rest stops before continuing on to more southerly destinations. You can hear them before you see them, but occasionally they also fly closely past my terrace and leave me speechless.
Most of the security discussion in the middle of this week is about the PHP2Shell RCEs which have caused so many sites to go offline prophylactically, so I won't pretend there was a bigger story.
Security, General:
PHP RCEs: https://krebsonsecurity.com/2026/10/widespread-php-flaw-may-cause-many-site-outages-today/
Security, Apple Platforms:
New untethered jailbreak technique demoed at Hexacon: https://tech.yahoo.com/cybersecurity/articles/hackers-jailbreak-iphone-18-pro-193604534.html
Interesting Paper:
The Invisible Watermark: A Pilot Study on the Verifiability Gap in AI Text Watermarking by Selma Bulut, Adem Korkmaz, Selahattin Kosunalp, Vedat Tümen, Erdal Akin: https://www.mdpi.com/2076-3417/16/20/10335
Interesting Tool:
xtool is a cross-platform Xcode replacement: https://github.com/xtool-org/xtool
Apple Platforms Security (or privacy) Concept of the Week:
Try on-device AI with fm by Howard Oakley: https://eclecticlight.co/2026/10/10/try-on-device-ai-with-fm/