> ## Content Index > Fetch the complete content index at: https://elliottbledsoe.wtf/llms.txt > Use this file to discover other available public pages before exploring further. # WTF now?! #58 – Thursday 22–Wednesday 28 October 2026 - URL: https://elliottbledsoe.wtf/wtf-now-58/ - Published: 2026-10-28T07:00:00.000Z - Updated: 2026-10-28T07:00:01.000Z - Description: A PHP vulnerability threatened the 'backbone of the internet', the movement of sound inspired Apple Music's sonic rebrand and Robert Downey Jr. joins SPECS and throws shade at other smart glasses. - Author: Elliott Bledsoe - Tags: WTF now?!, arts & culture, iPod, music, music streaming, Art Almanac, Artist Profile, Apple Music, Daft Punk, Kon Gouriotis, Lisa Havilah, Powerhouse Museum, tech & internet, bugs, cyber security, smart glasses, PHP, PHP2Shell, Meta, Ray-Ban Meta, LEGO, nostalgia, Robert Downey Jr., SPECS, Snap This week we are seeing the tail end of the PHP vulnerability that was so significant a threat to internet infrastructure that it needed a [coordinated announcement and patch release](#the-global-response-to-php-vulnerabilities-is-a-sign-of-our-ai-powered-cyber-security-reality) to ensure swift fixes before bad actors could exploit an AI discovered exploit. It may seem to be all but done, but it foreshadows an AI-powered cyber risk/cyber defence cat-and-mouse-game where exploits are found more frequently and will require increasingly rapid responses. Apple has begun rolling out a new brand identity for Apple Music literally uses [what music looks like to inform the brand’s movement](#apple-musics-new-brand-identity-is-literally-shaped-by-sound). By passing physical sound through oil floating on water they have created a simple but smooth brand look that leans right into what the brand is about. Equally fun, they have also updated their 404 page with an emulated iPod full of click wheel interactions and early 2000s tracks. Snapchat parent Snap Inc has [appointed Robert Downey Jr. as Chief Customer Experience Officer](#robert-downey-jr-joins-specs-as-%E2%80%98chief-customer-experience-officer%E2%80%99) to help shape and champion their AR hardware. They couldn’t resist throwing in subtle Iron Man vibes and shade at Meta and other smart glasses in their video content. Also this week *Artist Profile* editor Kon Gouriotis has made a public call for and released a [petition supporting embattled Powerhouse Museum CEO Lisa Havilah’s reinstatement](#artist-profile-editor-calls-for-havilah-to-be-reinstated-as-powerhouse-ceo) ahead of the Powerhouse Parramatta opening. You can get weekly [**WTF now?!*](https://elliottbledsoe.wtf/wtf-now/) round-ups in your inbox. Sign up as a free member to get it by email. [Get WTF now?! by email ](https://elliottbledsoe.wtf/signup/) --- ## Rapid-fire A short list of other things: - LEGO + Daft Punk = Rad! LEGO announced a Daft Punk collaboration and I am so excited for it! [Shoot through](https://www.lego.com/en-us/aboutus/news/2026/october/lego-group-and-daft-punk-partnership-announcement?ref=elliottbledsoe.wtf) - Head to a 404 page on the Apple Music website and give that iPod click wheel a spin for a hit of early 2000s music nostalgia. [Shoot through](https://www.theverge.com/entertainment/1017413/apple-music-ipod-404-page?ref=elliottbledsoe.wtf) --- ## WTF’s been going on? Here's WTF happened this week: ### The global response to PHP vulnerabilities is a sign of our AI-powered cyber security reality TL;DR Critical vulnerabilities in a ‘backbone of the internet’ programming language called PHP saw coordinated global alerts and patches to fix the issues. This is a foreshadowing of more frequent cyber risks of this kind needing rapid responses to address. Three months ago many people would have been blissfully unaware of the programming language PHP but recent cyber security concerns and media reportage saying that ‘the backbone of the internet’ is at risk has the term popping off all over! ⟨ Sure, you probably still don’t know WTF PHP is but you’ve heard about it no doubt! ⟩ PHP or hypertext preprocessor is an open-source, backend programming language typically run on web servers and used for dynamic actions like logging into a user account, searching or posting comments. Its reliability means it is on many servers, giving it a massive footprint made bigger by it being tied to a number of common content management systems (CMS) like WordPress, Joomla and Drupal, as well as Wikimedia’s MetaWiki. The upshot is that the majority of online publishing and e-commerce relies on it. That ubiquity has benefits but also poses risks; as we have seen this past week. A vulnerability identified by cyber security researchers at Wiz and Calif could be exploited to take control of affected web servers and steal sensitive data. The vulnerabilities called CVE-2026-109618 and CVE-2026-109619 (and collectively PHP2Shell) compromise PHP itself regardless of the application running on top of it. And they are evident in every PHP version released in the last decade, putting every using PHP at immediate risk. CVE-2026-109618 and CVE-2026-109619 were ranked 9.2 out of 10 in severity by the researchers. That's a big deal. It is such a big deal in fact that a coordinated response was needed to avoid giving bad actors time to get the jump on unprepared PHP users. The vulnerabilities were identified on 1 August and coordinated alerts were issued last Wednesday 21 October by cyber or national security agencies and other government bodies in [Australia](https://www.cyber.gov.au/alert/critical-vulnerabilities-in-php?ref=elliottbledsoe.wtf), the [United States](https://www.nsa.gov/press-room/press-releases-statements/press-release-view/article/4630238/nsa-advisory-critical-patches-recommended-for-php-vulnerabilities/?ref=elliottbledsoe.wtf), Belgium, the Netherlands, Finland and the Czech Republic. That gave the PHP Foundation – a nonprofit established in recognition that such fundamental internet infrastructure [couldn't rely solely on volunteers](https://opensourcepledge.com/blog/the-php-foundation/?ref=elliottbledsoe.wtf) that pays a pool of developers focused on critical maintenance – time to develop a fix. They [issued patches that same day](https://www.php.net/archive/2026.php?ref=elliottbledsoe.wtf#2026-10-21-5). Importantly, the issues in PHP are not new; the issues behind PHP2Shell were present in the code for over a decade, dating back to PHP 5.4.0 released in 2012\. These and other exploits in the code stem from a disconnect between how much the internet relies on PHP and the largely informal investment in maintaining it. Historically these kinds of security issues often went undetected because they are complex for humans to identify and understand. AI changes that. As [Wiz said](https://www.wiz.io/blog/php2shell-php-rce?ref=elliottbledsoe.wtf): > The vulnerable code had been present for more than a decade. Turning these flaws into working exploits required chaining multiple bugs and accounting for how PHP allocates and reuses memory across requests. Memory bugs are notoriously complex; differences in PHP versions, configurations and application behavior can break assumptions the exploit depends on. An attack that works against one deployment may need substantial adjustments to work against another, each requiring further analysis, testing and debugging. Pre-AI, this manual work would be difficult to implement and even harder to scale. While the initial flurry of large websites run by governments, companies and NGOs happened quickly, for smaller organisations with limited resources a massive vulnerability like PHP2Shell is particularly risky because of a lack of dedicated cybersecurity teams. That will only get more risky over time as AI-powered exploits like PHP2Shell become more frequent and require increasingly rapid responses to address. [Flaw in PHP computer language leads to shutdown of websites around worldPrecautionary takedowns come as experts say vulnerability in PHP, which is used by 70% of sites, could be exploited![](https://storage.ghost.io/c/69/85/69850acf-cfb0-462c-a6e8-fab23827fb03/content/images/icon/favicon-32x32-c3bc9158-4360-4d4c-be08-7992beae4911.ico)The GuardianRobert Booth and Aisha Down![](https://storage.ghost.io/c/69/85/69850acf-cfb0-462c-a6e8-fab23827fb03/content/images/thumbnail/5417-9920a382-a63e-4974-80b2-67f51bbf8130.jpg)](https://www.theguardian.com/technology/2026/oct/21/flaw-in-php-computer-language-leads-to-shutdown-of-websites-around-world?ref=elliottbledsoe.wtf) [PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | Wiz BlogCore PHP engine flaws enable remote code execution and Heartbleed-style memory disclosure across the web.![](https://storage.ghost.io/c/69/85/69850acf-cfb0-462c-a6e8-fab23827fb03/content/images/icon/favicon-2c5e80f0-8272-42eb-84e3-f6f9e50a3820.png)Wiz.ioSagi Tzadik and Shir Tamari and Nir Ohfeld and Tomer Schwartz![](https://storage.ghost.io/c/69/85/69850acf-cfb0-462c-a6e8-fab23827fb03/content/images/thumbnail/1792534907-img_7274-f07ed5b1-a9a3-41e5-877d-8e395c588b15.webp)](https://www.wiz.io/blog/php2shell-php-rce?ref=elliottbledsoe.wtf) --- ### Apple Music's new brand identity is literally shaped by sound TL;DR Apple Music's new brand expression features a kinetic identity shaped by physical sound waves created by playing music through water and oil. What results is stunningly analogue in a time of synthetic content inundation. The new Apple Music logo is literally made by sound: Video: Apple Music’s [YouTube video](https://www.youtube.com/watch?v=1XxNXkOHKZw&ref=elliottbledsoe.wtf) about the creation of the new brand identity. Fred Again and his collaborator NEST Acoustics wrote a piece of music and broke it down into individual notes. With Apple’s bespoke agency TBWA\\Media Arts Lab, they played each note through a transducer (a device that turns an audio signal into physical vibration) in water with oil floating on the surface. The resulting waves were captured on camera and used as the foundation for the rebrand. How the composition interacted with the oil 'result\[ed\] is a new, expressive musical note icon shaped by that captured movement'. A new wordmark was also created that adopts a custom version of SF Pro – Apple's unique brand typeface – with bold, lowercase letterforms. The same sonic effect was applied to it. Again's composition is also Apple Music's new sonic signature, rounding out the new brand identity. From yesterday Apple has started to roll out the new branding approach. > [ View this post on Instagram ](https://www.instagram.com/reel/DewrnLVuEUp/?utm%5Fsource=ig%5Fembed&utm%5Fcampaign=loading) > > [A post shared by Apple Music (@applemusic)](https://www.instagram.com/reel/DewrnLVuEUp/?utm%5Fsource=ig%5Fembed&utm%5Fcampaign=loading) Social media post: Apple Music’s [Instagram reel](https://www.instagram.com/reels/DewrnLVuEUp/?ref=elliottbledsoe.wtf) about the new brand identity. While highly experimental in its creation, the outcome is simple, smart and special. ⟨ In fact, in my opinion it is such a beautiful expression it should be used for more than just quick motion expressions. Even if the static logo doesn’t show artifacts of the sonic movement, I think the app icon should! ⟩ In an era where synthetic media is becoming more common place, there's something novel and charming about the analogue approach Apple took for this rebrand. [Apple Music's new logo was shaped by sound and mineral oilApple Music has rebranded for the first time since 2015\. Find out how TBWA\\Media Arts Lab, Fred again.. and a bath of mineral oil shaped the new note icon.![](https://storage.ghost.io/c/69/85/69850acf-cfb0-462c-a6e8-fab23827fb03/content/images/icon/favicon-df13ec94-9746-4f33-a294-52773453dcff.png)Creative BoomKaty Cowan![](https://storage.ghost.io/c/69/85/69850acf-cfb0-462c-a6e8-fab23827fb03/content/images/thumbnail/b62c93fdc8522ade2ae9125200ea39fa538362f8-medium-574f3aca-8c50-443e-a667-58215c5ffda4.webp)](https://www.creativeboom.com/news/apple-musics-new-logo-was-shaped-by-fred-again-and-a-bath-of-mineral-oil/?ref=elliottbledsoe.wtf) --- ### Robert Downey Jr. joins SPECS as ‘Chief Customer Experience Officer’ TL;DR AR glasses company SPECS, the sister company of Snapchat, has appointed Robert Downey Jr. as its honorary Chief Customer Experience Officer to test out the tech, increase product awareness and throw shade at competitors. Snap Inc’s AR smartglasses company SPECS has [brought on *Iron Man* star Robert Downey Jr.](https://newsroom.snap.com/robert-downey-jr-joins-specs-as-cceo?ref=elliottbledsoe.wtf) as its honorary Chief Customer Experience Officer (CCEO). He will ‘guide customers to understand and imagine what’s possible with SPECS, a new kind of computer built into a pair of see-through augmented reality glasses.’ > Building on nearly twenty years of experience imagining augmented reality, Downey Jr. will work across different parts of the SPECS organization to explore new capabilities, shape new Lens experiences and develop original content. Downey Jr. will also collaborate on hardware and in-person experiences. The ambassadorial relationship kicked off with a broadcast during the New York Knicks vs Philadelphia 76ers Tip-Off game and a [set of online videos](https://www.specs.com/robertdowneyjr?ref=elliottbledsoe.wtf) dubbed ‘experiments’ and shot in a style clearly meant to reference Downey Jr.’s Tony Stark character. Even with all the [heat Meta’s smart glasses](https://elliottbledsoe.wtf/wtf-now-54/#gen-3-meta-smart-glasses-bring-a-camera-free-model-privacy-updates-and-muse-integration) [and the product category](https://www.smh.com.au/technology/kmart-s-89-camera-glasses-removed-from-sale-online-amid-privacy-backlash-20261007-p613cz.html?ref=elliottbledsoe.wtf) have been getting, SPECS didn’t pass up a chance to throw a bit of shade at the competitors. In one of the videos Downey Jr. dumps the contents of a box labeled ‘AI glasses’ into a trash bin. ⟨ Don’t take my word for it, Downey Jr.’s comments make the point clear: ⟩ > Trying is believing. Having tested practically every wearable tech that’s come to market in the last 20 years, and been largely unimpressed, I was absolutely sold on SPECS within 40 seconds. The applications are endless. Families can share experiences instead of hunching over devices, skills can be honed, big business can streamline development. In short, it delivers on the promise of AR glasses made by a certain techno optimist superhero I portrayed. Life imitates art-imitates life! I’ve never experienced the confident, warm and creatively inviting atmosphere that Evan has cultivated at SPECS anywhere else in the tech sector. Wait’ll you see what we create for you to enjoy. Robert Downey Jr. joins [musician Imogen Heap, NBA star Jimmy Butler and other celebrities](https://newsroom.snap.com/visionaries-bring-specs-to-life?ref=elliottbledsoe.wtf) working with the company’s engineering and creative teams to push the AR technology further. [Robert Downey Jr. Joins SPECS as Chief Customer Experience OfficerDowney Jr. will work alongside the SPECS team to develop original content, Lens experiences, hardware collaborations, and more.![](https://storage.ghost.io/c/69/85/69850acf-cfb0-462c-a6e8-fab23827fb03/content/images/icon/Snap_Inc_Favicon-1e90cf04-51c7-491a-9ff9-512681042ab2.png)![](https://storage.ghost.io/c/69/85/69850acf-cfb0-462c-a6e8-fab23827fb03/content/images/thumbnail/RDJ_Hero_Image___1_-6af985ea-52a9-4057-b516-58da31cc9ddd.png)](https://newsroom.snap.com/robert-downey-jr-joins-specs-as-cceo?ref=elliottbledsoe.wtf) --- ### *Artist Profile* editor calls for Havilah to be reinstated as Powerhouse CEO TL;DR *Artist Profile* editor Kon Gouriotis has launched a petition calling on the NSW Government to reinstate Powerhouse Museum CEO Lisa Havilah ahead of the Powerhouse Parramatta opening. Yesterday arts leader and editor of contemporary visual art journal *Artist Profile* Kon Gouriotis OAM a [launched](https://artistprofile.com.au/reinstate-lisa-havilah-to-the-powerhouse/?ref=elliottbledsoe.wtf) a [change.org petition](https://www.change.org/p/reinstate-lisa-havilah-4092f123-0e08-4650-bd39-3babacc98030?ref=elliottbledsoe.wtf) calling on the NSW Government to reinstate the Powerhouse Museum’s embattled CEO Lisa Havilah. > [ View this post on Instagram ](https://www.instagram.com/p/De-mQIgow8-/?utm%5Fsource=ig%5Fembed&utm%5Fcampaign=loading) Social media post: **Artist Profile*’s [Instagram post](https://www.instagram.com/p/De-mQIgow8-/?ref=elliottbledsoe.wtf) about the petition to reinstate Lisa Havilah as CEO of Powerhouse Museum. The appeal comes almost [2 months on from when Havilah stepped down](https://elliottbledsoe.wtf/wtf-now-50/#misconduct-claims-mar-opening-of-powerhouse-paramatta) and just 10 days out from the [opening of Powerhouse Paramatta](https://powerhouse.com.au/visit/parramatta?ref=elliottbledsoe.wtf) on 7 November. To date nothing more about the misconduct investigation has been made public. Using *Artist Profile* and [*Art Almanac*](https://www.art-almanac.com.au/reinstate-lisa-havilah-to-the-powerhouse/?ref=elliottbledsoe.wtf) – both published by Bandicoot Publishing which Gouriotis co-founded in 2018 – as vehicles to share the petition, iit has attracted nearly 500 signatures as of this afternoon. Even so, the timeframe until the Powerhouse Paramatta opening, the ongoing investigation and the politics and optics makes the *Artist Profile*’s push for Havilah’s reinstatement unlikely to be successful. [Reinstate Lisa Havilah to the Powerhouse - Artist ProfileWe call on the NSW Government to lift Lisa Havilah’s suspension and reinstate her as Chief Executive of Powerhouse, allowing her to lead the opening of Powerhouse Parramatta in November 2026\. Over the past eight years, Lisa Havilah has led the renewal of the Powerhouse and the creation of Powerhouse Parramatta. She conceived and championed \[…\]![](https://storage.ghost.io/c/69/85/69850acf-cfb0-462c-a6e8-fab23827fb03/content/images/icon/cropped-AP-Icon-270x270-771350f8-e77f-459b-b9df-fc4858247b0a.jpg)Artist ProfileArtist Profile![](https://storage.ghost.io/c/69/85/69850acf-cfb0-462c-a6e8-fab23827fb03/content/images/thumbnail/Lisa-Havilah-Photographed-by-Nic-Walker-2026-Powerhouse_SQUARE-b14cc1d6-efc1-42aa-8161-7d72d931d8df.png)](https://artistprofile.com.au/reinstate-lisa-havilah-to-the-powerhouse/?ref=elliottbledsoe.wtf) --- If you are enjoying this [**WTF now?!*](https://elliottbledsoe.wtf/wtf-now/) round-up, please consider [becoming a paid subscriber](https://elliottbledsoe.wtf/subscribe/) or [making a small contribution](#/portal/support/) in support – it helps me keep creating free content like this. [Subscribe ](https://elliottbledsoe.wtf/subscribe/) --- #### Colophon ##### **Reuse** You can reuse the written content on this page under the terms of a [Creative Commons Attribution 4.0 International licence](https://elliottbledsoe.wtf/terms/#copyright-licence-reusing-elliottbledsoewtf-content) (CC BY 4.0) ##### **AI use** AI was used to generate a summary of listings and an introduction to this edition. Those summaries and that introduction were used to generate ideas. No AI-generated content was used verbatim. The banner graphic (i.e. the first image at the top of the blog post) was adapted from vector graphics generated in Adobe Illustrator using Firefly 4 with 'Subject' content type selected and the lowest level of detail set. *{ Text to Vector Graphic prompt: Seamless pattern, very large simple shapes, 80s retro style, fluid organic elements, morphing, overlapping, blurred gradients, visible layers. }* ##### **Provenance** This blog post was first published on Wednesday 28 October 2026\. It has not been updated. This is version 1.0.