Unified MemoryNews / Oct 21, 2026
Safari Blocks Email-Based Tracking, PHP's Rushed Fix, and AI 'Neurons'
Safari now cuts off hidden companies that turn your email into a tracking tag. PHP rushed out fixes for two leaked bugs. And did someone just crack open AI's black box? Not quite. Unified Memory News, 21 Oct.
- Safari vs email-based tracking
- PHP's emergency fix for leaked bugs
- Are AI 'neurons' tidier than we thought?
74 sourced claims · How we checked
1. Safari vs email-based tracking
Transcript
Here's the set-up. You sign up for a newsletter and type in your email. On a lot of sites, there's an invisible extra guest on that page: a company whose job is to turn your email into a lasting ID. Like a coat-check ticket that works at every venue in town. Same email, same ticket... so you get recognised from site to site, and across your devices.
Apple's WebKit team, who build Safari's engine, say Safari now simply won't connect to those companies. It's in this year's updates for iPhone, iPad, Mac and Vision Pro, and it's on by default. Their argument: even if each website keeps its own list, the company in the middle sees everyone's. One middleman holding the whole town's tickets.
Why it matters to you: less of your browsing gets stitched together from your email, and you don't lift a finger. Open question: does it cover other iPhone browsers, or web pages shown inside apps? Likely, but Apple hasn't confirmed it.
Now, the headlines. One trade outlet called this Apple's plan to wipe out web tracking. It isn't. It goes after one kind: the email-to-ID kind. And those lists of companies 'on Apple's list'? Apple hasn't named a single company. The names come from trade-press sources, and a bug report by an engineer at The Trade Desk, an ad company whose own ads stopped working in Safari. Yes, it found out the way the rest of us do... it filed a bug report. And 'shipped quietly'? Half true. The blocking code has been public since February. Only the list was secret.
What to do. If you use Safari: nothing. It's already on. If you pay for iCloud plus, Hide My Email gives websites a stand-in address, for another layer. If you run a website, make sure sign-up and login still work when one of these services fails to load. Developers, your checklist is in the description.
For developers
- Inventory third-party calls on sign-up and login pages; scripts that send a hashed or plain email to an ID vendor (UID2, RampID/ATS, ID5, Permutive, Audigent and similar) will likely fail in Safari 27 on iPhone and Mac.
- Fail soft: blocked requests show as network errors (status 0 / fetch TypeError). Don't let login, checkout or analytics await them; add timeouts.
- First-party analytics on your own domain and your own login provider are not the target.
- The list updates at runtime via Apple's WebPrivacy framework, so rotating domains is a stopgap.
- Test on macOS 27 Safari: Web Inspector > Network on sign-up/login pages, compare with Chrome. iPhone: Settings > Safari > Advanced > Web Inspector, then Mac Safari Develop menu.
- Reported (not Apple-confirmed) blocked domains from WebKit bug 324771: uidapi.com, adsrvr.org (appears restored in iOS 27.2 beta), id5-sync.com, eu-1-id5-sync.com, rlcdn.com, pippio.com, permutive.com, ad.gt.
Every claim and its source (23)
- Targets third parties that are 'present but invisible' on pages where users enter email addresses, and turn them into persistent cross-site IDs
- The resolver holds cross-site, cross-device and cross-party data
- Blocking is of network access to these services, done at the domain level
- Platforms: iOS, iPadOS, macOS and visionOS 27
- On by default; users need do nothing (blocking seen in normal browsing; tied to tracking prevention, which is on by default)
- Clearinghouse argument: even graphs scoped to one first party are a problem because the third-party resolver can match users across parties
- Users: nothing to do; it is on by default
- WKWebView in third-party apps and third-party iOS browsers: probably affected but unconfirmed by Apple
- 'Wipe out web tracking' is AdExchanger's headline; the post targets one category, email-based identity resolution
- WebKit post names no companies and publishes no domain list
- Known domain list comes from The Trade Desk engineer Ian Meyers' WebKit bug 324771 (21 Sep), which lists uidapi.com, adsrvr.org, id5-sync.com, rlcdn.com, pippio.com, permutive.com, ad.gt etc.
- iOS 27 blocked TTD from serving ads in Safari; TTD says adsrvr.org is its core ad delivery domain
- Wilander asked TTD to test iOS 27.2 beta on 5 Oct; bug marked RESOLVED FIXED 9 Oct; adsrvr.org appears restored in 27.2 beta, not confirmed in a shipped release
- 'Hundreds' of companies on a remotely updated list is sourced only to AdExchanger's unnamed sources
- Blocking code landed in open-source WebKit 13 Feb 2026 (bug 307853); domain list lived in a private Apple file
- For users: nothing to do; Hide My Email adds another layer (WebKit post mentions iCloud+ Hide My Email)
- Blocked requests surface as network errors; sites should not let login/checkout depend on them (fail soft)
- Safari/WebKit blocks network access to third parties that turn emails into persistent cross-site IDs
- Third parties 'present but invisible' on email-entry pages; cross-site, cross-device IDs
- iOS, iPadOS, macOS (and visionOS) 27; blocking by domain
- Targets one category (email-based identity resolution), not all web tracking
- Apple names no companies; known list from The Trade Desk's WebKit bug 324771 and AdExchanger sources
- Users: nothing to do; on by default
Sources
- https://webkit.org/blog/18438/blocking-identity-resolution-infrastructure/
- https://bugs.webkit.org/show_bug.cgi?id=324771
- https://github.com/WebKit/WebKit/commit/172f52ace994d118941140e575139d76fcb06e14
- https://www.adexchanger.com/platforms/apple-publishes-its-plan-to-wipe-out-web-tracking/
- https://www.adexchanger.com/platforms/apples-latest-operating-system-blocks-the-trade-desk-from-serving-ads-on-safari/
- https://www.adexchanger.com/privacy/apple-has-far-reaching-plans-to-block-hundreds-of-programmatic-data-companies-from-ios/
- https://bugs.webkit.org/show_bug.cgi?id=307853
- https://github.com/WebKit/WebKit/commit/e08deedb31c1
2. PHP's emergency fix for leaked bugs
Transcript
Story two. PHP is the software underneath a huge share of websites. WordPress runs on it. On Wednesday, October twenty-first, PHP shipped emergency fixes for two serious bugs, each rated nine point two out of ten. Worst case: a stranger, without logging in, could make a web server run their own commands, and read secrets from its memory. On one classic server setup, a single request can set it off before the website's own code even runs. To be fair, it's not easy to pull off. It depends on how the server's set up.
The timeline's a bit of a thriller. The fixes were due on Thursday the twenty-second. On Tuesday the twentieth, someone leaked the bugs online. PHP moved its release up by about a day, to Wednesday... and still shipped a little early.
Some of what's going around is wrong. One: 'eight point one and older get nothing.' Not quite. There's no official release for them, but PHP published do-it-yourself fixes back to seven point four, and Ubuntu, a popular flavour of Linux, already shipped a fixed eight point one. Two: 'the bug numbers came from the leak.' No. PHP reserved them itself on October twelfth. The leak just made them public early. Three: 'hackers are already using it.' Right now, that's one company's claim. Cloudflare says it has seen attack attempts against its customers. Two other security firms saw none before the release, and when we checked, it wasn't on the US government's list of bugs known to be under attack.
What to do. If your website is on a hosting plan, ask your host one question: have you updated PHP to the fixed version, and restarted it? Updating WordPress or your plugins won't fix this one. The bug's in PHP, underneath. On an old version? Move up. Even eight point two stops getting fixes at the end of December. If your server was exposed, changing its passwords and keys is sensible. And don't download 'exploit' code shared online. Some may carry malware. Developers: your checklist's in the description.
For developers
- Fixed versions: 8.5.12, 8.4.27, 8.3.36, 8.2.35, or your distro's patched package (distros often keep the old version string; check the changelog for CVE-2026-109618 / CVE-2026-109619, e.g. apt changelog php8.3 | grep 109618).
- Distro status at 15:52 UTC 21 Oct: Ubuntu fixed (USN-8948-1: 22.04 php8.1, 24.04 php8.3, plus php8.5 on newer releases). Debian 13 fixed in DSA-6574-1 (php8.4 8.4.27-1~deb13u1); Debian 12 fixed in DLA-4848-1 (php8.2 8.2.35-1~deb12u1). Red Hat: no advisory yet. Homebrew: bump PRs still open (php 8.5.11). Remi, Herd, MAMP: unconfirmed.
- Restart every worker (php-fpm, Apache). Updating the binary alone does nothing until workers restart.
- Apache mod_php is the most exposed; PHP-FPM is also exposed (session upload-progress path validated).
- 8.1 and older: take your distro/LTS backport (Ubuntu 22.04 has one) or build from PHP's EOL backport branch; better, upgrade. 8.2 is EOL 31 Dec 2026.
- Containers: Docker Hub's official php tags 8.5.12, 8.4.27, 8.3.36 and 8.2.35 are published (15:39 UTC); rebuild with --pull and verify php -v inside the running container.
- Rotate secrets on internet-facing boxes that ran unpatched mod_php or FPM (memory disclosure possible).
- Can't patch yet (reduces exposure, not a fix): in php.ini/pool config set session.upload_progress.enabled=0, and on 8.5 fatal_error_backtraces=0; restart workers. Block multipart on endpoints that don't need uploads. Consider pm.max_requests=1 on FPM.
- Mac: brew update && brew upgrade php (or php@8.4/8.3/8.2) once brew info shows the fixed version; brew services restart php; valet restart. Herd: herd php:update all once Herd ships builds. php@8.1 in Homebrew is deprecated: move to 8.2+.
- Don't run unverified PoC repos; fake PoCs may carry malware.
Every claim and its source (24)
- Fixed releases 8.5.12, 8.4.27, 8.3.36, 8.2.35 shipped 21 Oct 2026
- Two bugs, both CVSS v4.0 9.2, both unauthenticated RCE; plus memory disclosure
- Apache mod_php: demonstrated exploit where an unauthenticated request triggers the attack before any application code runs
- Vector has AC:H and AT:P: exploitation not trivial, depends on build/allocator/worker layout
- Original embargo: Thu 22 Oct, 11 AM ET (= 15:00 UTC)
- Leak: HN 'Tell HN' post on 20 Oct (a Tuesday) morning US time
- PHP advance notice set release for Wed 21 Oct 14:00 UTC
- Release went live ~13:35–13:56 UTC, about 10–25 min early
- No official releases for 8.1 and older; PHP published minimal source backports for 7.4, 8.0, 8.1 (build-it-yourself)
- Ubuntu USN-8948-1 shipped a fixed php8.1 for 22.04 (jammy)
- PHP, as its own CNA, reserved both CVE IDs on 12 Oct 2026 and published the records itself
- Leaked HN post said CVSS 10.0; official score 9.2
- Cloudflare says it observed attack traffic targeting its customers (CTO on X; Cloudflare blog posted 13:56 UTC 21 Oct, found in live re-check 14:40 UTC) — one company's claim, attempts not confirmed compromises
- watchTowr and Huntress observed no exploitation before the release
- Neither CVE in CISA KEV as of the 21 Oct 14:04 UTC catalog (version 2026.10.21, 1754 entries; re-checked 15:52 UTC)
- Fix requires updating to 8.5.12/8.4.27/8.3.36/8.2.35 or distro package AND restarting every worker
- Bug is in PHP core request lifecycle, before application code runs (so app/CMS updates don't fix it)
- PHP 8.2 reaches end of life 31 Dec 2026
- Memory disclosure possible, so rotating secrets on exposed servers is a reasonable precaution (inference, not a PHP statement)
- Unverified PoC repos on GitHub; Tenable warns fake PoCs may carry malware
- Emergency PHP security release on 21 Oct 2026
- Two bugs, CVSS v4.0 9.2 each, unauthenticated RCE
- Bug is in PHP core, before app code runs; fix = update PHP and restart workers
- PHP published minimal source backports for 7.4, 8.0 and 8.1
Sources
- https://www.php.net/archive/2026.php#2026-10-21-5
- https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
- https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
- https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/
- https://www.php.net/archive/2026.php#2026-10-20-1
- https://cveawg.mitre.org/api/cve/CVE-2026-109618
- https://ubuntu.com/security/notices/USN-8948-1
- https://github.com/php/php-src/tree/PHP-8.1-CVE-2026-109618-109619
- https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote
- https://blog.cloudflare.com/php-vulnerabilities-waf-protection/
- https://watchtowr.com/intelligence/php-cve-2026-109618-faq/
- https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities
- https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
3. Are AI 'neurons' tidier than we thought?
Transcript
Story three: looking inside AI. Chatbots run on neural networks: huge numbers of tiny dials, called neurons, each turning up or down depending on what the AI is reading. For years, researchers thought most of those dials were junk drawers, each mixing unrelated ideas. The famous example: a neuron in an image AI that fires for cat faces... and for the fronts of cars.
Last week, researcher Nick Cammarata, now at Goodfire, a start-up that studies how AI works inside, published a very long essay arguing the field had been reading these neurons wrong. He co-wrote some of the original research behind that junk-drawer picture. Now he says most neurons are a toolbox, not a junk drawer. That cat-and-car neuron? A V-shape detector. Cat ears, a car's grille, a fox, even the spray from a fireboat. We labelled the objects, and missed the shape.
Why should you care? If he's right, checking what an AI is 'thinking' could get a lot cheaper. You could read the dials it already has, instead of training a whole second AI to decode them, which is the main approach today. That could make safety checks on AI easier.
But MIT Technology Review's headline said it 'upended the AI world.' It hasn't. For chatbot-style models, his team reports that in a small sample from one free, downloadable model, about nine in ten neurons have one main job. But that's early, scored by their own AI tools, and the technical paper isn't out. Nobody's independently repeated it. One person found a neuron labelled 'Colorado' also responds to Tornado, a piece of programming software. So labels can miss things. Some people online called it historic, a few OpenAI staff among them. Other OpenAI researchers barely budged. Neel Nanda, who leads Google DeepMind's team on this, called it interesting, but not a big change to the overall picture. Fair version: a loud debate, and a real but modest update.
What it means for you: nothing changes today. Nobody can yet reliably look inside the AI you use and check its reasoning, so keep double-checking answers that matter. And when a headline says AI just got upended, wait for other researchers to repeat it. Developers: there's a Mac experiment in the description.
For developers
- Browse the interactive neuron microscopes on the essay site (already-clean.goodfire.com).
- On a Mac: load a small Qwen3 (0.6B or 1.7B) with transformers on MPS, hook one layer's MLP activation (input to down_proj), run a few thousand lines of text, print top- and bottom-activating tokens for a handful of neurons; zero a neuron to try an ablation.
- You won't reproduce the ~90% figure: that needs Qwen3-32B, systematic labelling and the unpublished method.
Every claim and its source (27)
- A neuron is one number in a hidden layer that goes up or down depending on the input
- Polysemantic neurons; superposition: models pack more concepts than neurons into overlapping combinations
- Classic example: Inception v1 neuron 4e:55 fires on cat faces and car fronts (Zoom In, 2020)
- Essay 'Neural Networks Are Already Clean' published 15 Oct 2026 by Nick Cammarata (Goodfire), labelled a working hypothesis
- Goodfire is an interpretability startup; Cammarata was previously on OpenAI's Clarity team and co-authored Zoom In (2020)
- He reinterprets neuron 4e:55 as a V-shape detector: fox, flame, fireboat water jet, etc.
- Thesis: a network's own neurons are already mostly readable
- Sparse autoencoders (training a second network to decompose activations) have been the dominant paradigm since 2023
- If raw neurons are mostly readable, models could be monitored/steered without first training a huge decomposition model, making safety monitoring cheaper
- MIT TR headline: 'We were looking at it wrong: the explosive claim that's upended the AI world'; brief judges 'upended' overstated
- Qwen3-32B audit (language work credited to Curt Tigges; paper by Cammarata and Tigges): ~90% of neuron 'poles' have one main job; approximate, threshold-dependent, small samples, AI-agent labelled
- Joshua Achiam (OpenAI): own update very small; Leo Gao (OpenAI): people are overupdating
- Baseline: OpenAI 2023 neuron-explanation project found ~1.7% of GPT-2 neurons well explained
- Companion technical paper 'forthcoming', not released as of 21 Oct; no code/labels/data; no independent replication
- @RatOrthodox: 'Colorado' neuron also tracks the Tornado Python web framework; Colorado answers 59% -> 15% with the neuron zeroed (informal)
- Enthusiast reactions on X incl. roon and Adam Majmudar (OpenAI) and Dean W. Ball
- Neel Nanda (leads Google DeepMind mech-interp team): interesting, not a significant update to the big picture
- Fair framing: set off a loud debate; researchers mostly call it a real but modest update
- Cammarata does not claim interpretability is solved; LLM results are preliminary and unreplicated
- Local experiment: small Qwen3 model, forward hook on an MLP layer, inspect top activations
- Inception v1 neuron 4e:55 (cats and car fronts) reinterpreted as a V-shape detector
- Superposition/polysemantic neurons was the field's prevailing view
- Cammarata co-authored Zoom In (2020); now at Goodfire; thesis: neurons are already mostly readable
- If true, monitoring could be cheaper without a big decomposition model
- MIT TR headline 'upended the AI world' is overstated
- Companion paper forthcoming; no replication
- Neel Nanda: not a significant update to the big picture
Sources
- https://distill.pub/2020/circuits/zoom-in/
- https://transformer-circuits.pub/2022/toy_model/index.html
- https://already-clean.goodfire.com/
- https://www.technologyreview.com/2026/10/19/1147149/we-were-looking-at-it-wrong-the-explosive-claim-thats-upended-the-ai-world/
- https://transformer-circuits.pub/2023/monosemantic-features/index.html
- https://x.com/jachiam0/status/2110852879791886480
- https://x.com/nabla_theta/status/2110862078844272677
- https://openaipublic.blob.core.windows.net/neuron-explainer/paper/index.html
- https://x.com/RatOrthodox/status/2110976835089809678
- https://thezvi.substack.com/p/i-can-see-everything
- https://x.com/NeelNanda5/status/2110875974296654062
- https://www.lesswrong.com/posts/x4kvabkF2Jk8GLZp8/linkpost-neural-networks-are-already-clean
What To Do
- Safari users: nothing, it's on.
- Website owners: ask your host to update PHP to the fixed version and restart it. WordPress/plugin updates won't fix it.
- AI users: nothing changes yet.
Chapters
00:00 Your email as a tracking ID
00:14 Three stories
00:35 1. Safari vs email-based tracking
02:34 2. PHP's emergency fix for leaked bugs
04:48 3. Are AI 'neurons' tidier than we thought?
07:18 Wrap-up
Developers
Safari / WebKit:
- Inventory third-party calls on sign-up and login pages; scripts that send a hashed or plain email to an ID vendor (UID2, RampID/ATS, ID5, Permutive, Audigent and similar) will likely fail in Safari 27 on iPhone and Mac.
- Fail soft: blocked requests show as network errors (status 0 / fetch TypeError). Don't let login, checkout or analytics await them; add timeouts.
- First-party analytics on your own domain and your own login provider are not the target.
- The list updates at runtime via Apple's WebPrivacy framework, so rotating domains is a stopgap.
- Test on macOS 27 Safari: Web Inspector → Network on sign-up/login pages, compare with Chrome. iPhone: Settings → Safari → Advanced → Web Inspector, then Mac Safari Develop menu.
- Reported (not Apple-confirmed) blocked domains from WebKit bug 324771: uidapi.com, adsrvr.org (appears restored in iOS 27.2 beta), id5-sync.com, eu-1-id5-sync.com, rlcdn.com, pippio.com, permutive.com, ad.gt.
PHP:
- Fixed versions: 8.5.12, 8.4.27, 8.3.36, 8.2.35, or your distro's patched package (distros often keep the old version string; check the changelog for CVE-2026-109618 / CVE-2026-109619, e.g. apt changelog php8.3 | grep 109618).
- Distro status at 15:52 UTC 21 Oct: Ubuntu fixed (USN-8948-1: 22.04 php8.1, 24.04 php8.3, plus php8.5 on newer releases). Debian 13 fixed in DSA-6574-1 (php8.4 8.4.27-1~deb13u1); Debian 12 fixed in DLA-4848-1 (php8.2 8.2.35-1~deb12u1). Red Hat: no advisory yet. Homebrew: bump PRs still open (php 8.5.11). Remi, Herd, MAMP: unconfirmed.
- Restart every worker (php-fpm, Apache). Updating the binary alone does nothing until workers restart.
- Apache mod_php is the most exposed; PHP-FPM is also exposed (session upload-progress path validated).
- 8.1 and older: take your distro/LTS backport (Ubuntu 22.04 has one) or build from PHP's EOL backport branch; better, upgrade. 8.2 is EOL 31 Dec 2026.
- Containers: Docker Hub's official php tags 8.5.12, 8.4.27, 8.3.36 and 8.2.35 are published (15:39 UTC); rebuild with --pull and verify php -v inside the running container.
- Rotate secrets on internet-facing boxes that ran unpatched mod_php or FPM (memory disclosure possible).
- Can't patch yet (reduces exposure, not a fix): in php.ini/pool config set session.upload_progress.enabled=0, and on 8.5 fatal_error_backtraces=0; restart workers. Block multipart on endpoints that don't need uploads. Consider pm.max_requests=1 on FPM.
- Mac: brew update && brew upgrade php (or php@8.4/8.3/8.2) once brew info shows the fixed version; brew services restart php; valet restart. Herd: herd php:update all once Herd ships builds. php@8.1 in Homebrew is deprecated: move to 8.2+.
- Don't run unverified PoC repos; fake PoCs may carry malware.
AI neurons, try it on a Mac:
- Browse the interactive neuron microscopes on the essay site (already-clean.goodfire.com).
- On a Mac: load a small Qwen3 (0.6B or 1.7B) with transformers on MPS, hook one layer's MLP activation (input to down_proj), run a few thousand lines of text, print top- and bottom-activating tokens for a handful of neurons; zero a neuron to try an ablation.
- You won't reproduce the ~90% figure: that needs Qwen3-32B, systematic labelling and the unpublished method.
SOURCES (all of them: pinned comment)
Safari:
- WebKit: Blocking Identity Resolution Infrastructure, 19 Oct 2026
https://webkit.org/blog/18438/blocking-identity-resolution-infrastructure/
PHP:
- PHP.net: security release announcement (8.5.12, 8.4.27, 8.3.36, 8.2.35), 21 Oct 2026
https://www.php.net/archive/2026.php#2026-10-21-5
AI neurons:
- Distill: Olah et al., Zoom In: An Introduction to Circuits, Mar 2020
https://distill.pub/2020/circuits/zoom-in/
How this edition was checked
This edition was fact-checked by hand before the automated gate existed; every claim above still carries its source.