Inktober 2026 24, Bake

Nobody had eaten properly in days. Ration bars, warm water, the dust in everything. So when the robot ducked back into the silver ship and came out carrying a loaf tin, we just stared.

It set up in the lee of the wreckage, using a slab of torn bulkhead as a counter, and went to work with those blunt pincer hands, surprisingly delicate. Dials ticked on its chest panel. Something warm hummed inside its torso. The dapper man stood by with his hands behind his back, looking quietly pleased with himself, as if this had been the plan all along.

Inktober 2026 23, Dapper

Out of the dust sky it came. We had stopped looking up. Hours of waiting under that bruised yellow haze, SOSi still chirping away on its hilltop, and then a shadow slid across the wreckage and the dust began to part. Something was coming down through it. It had answered our beacon.

Clean lines, smooth, silver. No flames, no roar, none of the howling engines we’d braced for. It settled onto the plain with barely a noise, as though it had all the time in the world, and the dust drifted back around it like nothing had happened.

If you use my alpine-lighttpd-php Docker image, please pull :latest again and recreate your container. The image now runs PHP 8.4.27, which fixes the php2shell vulnerabilities.

docker pull alastairhm/alpine-lighttpd-php:latest
# or
docker pull ghcr.io/alastairhm/alpine-lighttpd-php:latest

What is php2shell?

php2shell is the name for two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both are critical, and both allow remote code execution with no authentication. PHP published a security advisory on 21 October, alongside fixed releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35.