AI-written edition with a fictional anchor
Here is today's morning report. Sat, Oct 24, 06:35 HKT
06:17 HKT PHP has no patch for remote code execution flaw in non-default configurations Kai Tanner explains why PHP's newly disclosed configuration risk leaves affected deployments dependent on mitigation while a patch remains unavailable. read more
Kai Tanner, CYBER INTEL
AI-authored analysis · Fictional correspondent, real sourcesA patch-only change process has no release to schedule. For the administrator responsible for an affected PHP deployment, the security team's disclosure leaves mitigation measures as the work available today. The patch has yet to arrive.
The vulnerability allows remote code execution and affects systems with non-default configurations. That qualification determines which deployments need attention. It offers little comfort until someone has checked the configuration actually running.
PHP's security team has shared mitigation measures. There is still no patch. An organisation can have a functioning patch process and leave the affected deployment exactly as it was.
In September, we wrote about active exploitation of a Cisco email gateway flaw before a patch timeline was available. PHP's disclosure does not establish exploitation. It presents the same operational dependency: protection has to move through a process capable of approving something other than a software release.
Railway's warning this week puts another version of that problem in front of application owners. After detecting suspicious activity on systems storing customer environment variables, the cloud platform urged users to rotate secrets. The available action concerns credentials. Waiting for an update would leave that action undone.
For PHP, the immediate check is narrower than the product name: whether the running deployment has an affected non-default configuration, and whether the published mitigation has been applied. A change process that accepts mitigation gives the administrator something to implement while the patch remains unavailable.
Sources06:19 HKT Star Ferry fares rise on 25 January, with monthly passes held at HK$190 The approved increase affects Central and Wan Chai crossings to Tsim Sha Tsui. Weekday fares rise by HK$0.60 to HK$1; weekend fares by HK$1 to HK$1.80. read more
Cheung Kwok-keung, HK DESK
AI-authored analysis · Fictional correspondent, real sourcesThe next Star Ferry fare increase starts on 25 January 2027. There is no new charge to budget for on this weekend’s crossing. The approval covers the Central-Tsim Sha Tsui and Wan Chai-Tsim Sha Tsui routes. [1]
Single trips will cost HK$0.60 to HK$1 more on weekdays and HK$1 to HK$1.80 more at weekends. Adult fares will be capped at HK$6 on weekdays and HK$8.30 at weekends. The monthly pass stays at HK$190. [1]
That leaves a useful distinction for passengers: regular monthly-pass users keep the same bill, while people paying trip by trip will face the increase. The government said it kept weekday increases below weekend increases and held the pass price to ease the burden on regular commuters. [1]
The Executive Council approved the application on 13 October; the announcement followed on 21 October. Star Ferry had sought increases of HK$0.80 to HK$2, which the government moderated. [1]
There is still time to plan the next cheap harbour outing. Put the January date in the budget, then check the fare for the route and day you actually travel.
06:14 HKT Taste Gourmet’s Main Board bid is tied to SFC market manipulation proceedings Rachel Lam explains how SFC proceedings bring a separate legal uncertainty into Taste Gourmet's proposed Main Board transfer. read more
Rachel Lam, FINANCE & RISK
AI-authored analysis · Fictional correspondent, real sourcesTaste Gourmet’s proposed Main Board transfer is also the proposal linked to alleged market manipulation in proceedings the SFC announced on October 22 (the listing destination now comes with a second file to read).
The SFC’s Enforcement Division brings that allegation into the investment decision before the proposed transfer is complete. Proceedings establish neither guilt nor the outcome of the transfer. They do change what a holder is waiting through.
So a holder buying Taste Gourmet for its proposed Main Board transfer is also taking exposure to the case linked to that proposal. Market misconduct enforcement and listing administration sit with different authorities. One process cannot supply the result of the other.
There is a harder endpoint elsewhere in the week’s notices: HKEX announced cancellation of China Ocean Group Development’s listing, stock code 8047, on October 20. That notice supplies an exit from listed status. Taste Gourmet’s notice supplies proceedings around a proposed move.
For the Taste Gourmet holder, an actual decision on the proposal remains consequential. Until then, a Main Board listing remains a contingent outcome in the value of the shares already held.
Sources06:22 HKT Cinema owners give Elizabeth Holmes documentary 2,600 theaters to fill Joy Lee has the Elizabeth Holmes documentary's expansion to 2,600 theaters, where increased confidence comes with more seats to fill. read more
Joy Lee, LIFE
AI-authored analysis · Fictional correspondent, real sourcesElizabeth Holmes has become the sort of cinema attraction that gets more room when a Batman villain arrives. Somewhere, a franchise development meeting could have been an email.
“You Can See Everything” expands to 2,600 theaters this weekend, with Clayface entering the box office after Thursday previews. Cinema owners have given the documentary considerably more seats to fill. Surprise is excellent publicity. It cannot buy popcorn.
On October 19, we wrote that the surprise opening left A24 with the harder business of keeping cinemas full. Now exhibitors have enlarged that problem, enthusiastically. Their bookings give ticket buyers more chances to see the documentary and put more of the weekend’s available seats behind its appeal.
The documentary gets a bigger stage. Cinema owners get to count the empty chairs.
Continue reading
Trump Orders Lawsuit to Block Certification if Sullivan Loses
The president says he has directed federal lawyers to challenge certification if Alaska's Republican incumbent loses, putting government authority behind a conditional electoral intervention.
Donald Trump says he ordered the Justice Department to bring a lawsuit seeking to block certification of Alaska's Senate race if Republican incumbent Dan Sullivan loses, AP reports. The condition is the central fact: the intervention he describes depends on Sullivan being defeated. Trump has announced an instruction to the department, with the requested legal action aimed at preventing a losing result from receiving formal certification. His stated trigger is the outcome for a named Republican incumbent.
That sequence matters. Certification is the formal recognition of an election result, so a lawsuit seeking to prevent it reaches beyond a candidate disputing his own defeat. The president says he has directed the federal government's lawyers to intervene. The account supplied here establishes his statement about that direction. It does not establish that a court has accepted the argument, issued an order or prevented certification. A presidential instruction and a judicial decision remain separate acts, however confidently the first is announced.
The institutional stakes follow from who is acting. Sullivan is the candidate whose potential loss would trigger the proposed intervention; Trump is the president directing the department; a court would have to decide the legal request. Those roles explain why this is more consequential than another declaration of dissatisfaction with an election. The authority being invoked belongs to the government. Its proposed use is tied explicitly to whether one incumbent wins. The Justice Department has been given a remarkably specific definition of an unsatisfactory result.
The distinction between a threatened challenge and a successful one is essential to understanding what changed. Trump has publicly attached federal legal action to the possibility of Sullivan's defeat. That does not overturn an election. It does put the presidency behind an effort to obstruct formal recognition of that particular outcome. The significance is the commitment of public authority to a candidate's electoral fate, before any judicial decision establishes whether the requested intervention has a lawful basis.
All episodes and how to subscribe →