Inktober 2026 23, Dapper

Out of the dust sky it came. We had stopped looking up. Hours of waiting under that bruised yellow haze, SOSi still chirping away on its hilltop, and then a shadow slid across the wreckage and the dust began to part. Something was coming down through it. It had answered our beacon.

Clean lines, smooth, silver. No flames, no roar, none of the howling engines we’d braced for. It settled onto the plain with barely a noise, as though it had all the time in the world, and the dust drifted back around it like nothing had happened.

If you use my alpine-lighttpd-php Docker image, please pull :latest again and recreate your container. The image now runs PHP 8.4.27, which fixes the php2shell vulnerabilities.

docker pull alastairhm/alpine-lighttpd-php:latest
# or
docker pull ghcr.io/alastairhm/alpine-lighttpd-php:latest

What is php2shell?

php2shell is the name for two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both are critical, and both allow remote code execution with no authentication. PHP published a security advisory on 21 October, alongside fixed releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Inktober 2026 22, Beacon

It took hours. Cutting torches, pry bars, and the hero’s bare hands on the worst of the beams. Finally the debris shifted and there it was, wedged under a collapsed bulkhead: SOSi.

Bashed, scorched, one panel hanging by a hinge, a long scrape down its flank. Nobody dared say it out loud.

Then the status lights stuttered on, one by one, and the little unit gave a groan of servos and hauled itself upright. It shambled off across the wreckage on its four stubby legs, limping on the left rear, and climbed to the highest ground it could find.

Inktober 2026 21, Hero

Scream of metal. Deck plates buckling underfoot. The hull is tearing open and the air is going, and someone is screaming for a medic, and it might be me.

Then through the smoke and steam, a shape. Massive. Unmoving. Power armour, scorched but standing, the skull on its chest glowing through the haze.

We’re not dead. He came. The hero came.

Hero.

Inktober 2026 20, Lounge

Mission log, Day 20

Fourteen crew sealed in the lounge, behind a corridor of twisted girders. Atmosphere holding. Morale holding. Whisky holding, but not for long. There are worse places to be trapped, and they appear to have found the best one.

Cutting teams are working the debris around the clock. Estimated time to clear the corridor: two days. Estimated time for the lounge to drink itself dry: one and a half.

Inktober 2026 19, Confused

Captain’s log, Day 19

Impact. Then nothing.

I came round hanging in my harness, the deck over my head, the ceiling underfoot. Alarms are screaming but I can’t tell which are real. Smoke in the cockpit. Instruments reading everything at once: climbing, falling, dead.

The lights cut out and I couldn’t tell up from down.

Through the cracked glass: mountains, and a column of smoke rising from the wreck.

Inktober 2026 18, Flightless

Captain’s log, Day 18

It’s gone. We won, if you can call it that.

The hull is torn open. The power is dead. The ground is coming up fast.

We paid for this in lives I’ll have to name later. Everyone aboard is still breathing. Nobody is leaving.

We are flightless.

New posts on this blog now get announced on Bluesky automatically, alongside the Mastodon toots that were already going out. If you’re reading this via a Bluesky link card, that’s the thing working.

It went live on 16 October, with the Inktober “Gangly” post being the first one through, and it’s been quietly doing its job since.

How it works

The whole thing is a GitHub Actions workflow plus a small Python script, with no third-party service in the middle.

Inktober 2026 17, Contraption

Captain’s log, Day 17

The engineer hasn’t slept. Neither have I.

We have to get rid of the thing. A sealed bulkhead won’t hold it for long.

So the engineer built something: welding mask, oxy-acetylene tanks and torch, deck plating riveted into armour, and a cargo claw for an arm. A contraption. Protection. Hopefully safe.

Somebody has to wear it.

We’re drawing straws…

Inktober 2026 16, Gangly

Captain’s log, Day 16

Movement in the corridor outside Medical. Gangly. Jerky. Too many joints, none of them bending the right way.

Then the noises: nothing a human throat should make. It was coming from the medical unit, and the unit was meant to be sealed.

I saw it clearly for three seconds. That was enough. Never unsee this. It will live in our nightmares forever.