erroneo.us
Search all guides⌘K

Latest in security ·

Security Digest · RSS · JSON

Patch this week · CVE-2026-109518 · No known exploitation

APT CVE-2026-109518: Package Swap to Root on Debian/Ubuntu

Nobody is known to be exploiting it and the attacker must sit between you and your mirror, but APT is the trust root for every Debian and Ubuntu machine and image you build, so update apt itself this week and rebuild base images.

Must act: Anyone running Debian 12 or later, Ubuntu 22.04 LTS or later, or a derivative, especially CI runners, Docker builds and fleets that fetch packages over plain http:// or through shared mirrors and caching proxies.

Can relax: Systems on Debian 11 or Ubuntu 20.04 and older that never set Acquire::Retries, and hosts that only install packages from a local, trusted, HTTPS-served mirror, can schedule the update normally.

First steps

  1. Update apt itself first: sudo apt-get update && sudo apt-get install --only-upgrade apt, then confirm the version with apt-cache policy apt.
  2. Rebuild Docker base images and CI runner images so they ship the fixed apt; do not rely on the next routine rebuild.
  3. Until a host is patched, install packages only from HTTPS sources or a mirror you control, and avoid untrusted networks and shared proxies.

Full brief & sources →

Check exposure · No known exploitation

Rails Active Storage: Upload-to-File-Write via ImageMagick

Only apps that run Active Storage through ImageMagick (:mini_magick) and accept untrusted uploads are exposed, but for them an unauthenticated upload can write files and, with the Disk service, read secret_key_base, so those apps should upgrade today.

Must act: Rails apps that accept uploads from untrusted users and use config.active_storage.variant_processor = :mini_magick (the default under load_defaults 6.1 or earlier) on hosts whose ImageMagick policy does not block MSL and Ghostscript coders, including stock Debian and Ubuntu.

Can relax: Apps on the :vips processor (the default from load_defaults 7.0), apps that do not use Active Storage, and apps that only accept uploads from trusted staff should still take the release but need not rush.

First steps

  1. Check your processor: bin/rails runner 'p Rails.application.config.active_storage.variant_processor'.
  2. If it is :mini_magick and users can upload files, upgrade to Rails 8.1.4.1 or 8.0.5.2 and bundle update mini_magick to 5.1 or later.
  3. If you cannot upgrade (or are on Rails 7.x or older), copy the shipped policy rules into /etc/ImageMagick-7/policy.xml (or ImageMagick-6) and at minimum deny the MSL coder, Ghostscript coders and the gs delegate.

Full brief & sources →

1 new known-exploited (KEV) · 0 critical advisories on Nov 4, 2026 — open the digest →

A reference for common errors · Updated October 2026

Get it wrong right.

A researched, source-linked reference to the mistakes people make most often — in writing, in code, in reasoning, and in what “everybody knows.” Each page shows the wrong version, the right version, and the evidence.

Play Spot the Error →Search the guides ⌘K
  • Could Couldn’t care less
  • Uncaught TypeError
  • 10% of your brain
  • HTTP 418
  • Irregardless Regardless
proofread "I could care less."
✗ could → couldn’t   misused idioms
python3 scores.py
TypeError: 'NoneType' object is not subscriptable
✓ list.sort() returns None. Use sorted().
grep "^15.5.19" rfc9110.txt
15.5.19.  418 (Unused)
✓ reserved in RFC 9110, still not a coffee pot
fact-check "We only use 10% of our brains."
✗ myth   nearly all of it is active over time

Error of the Day ·

Today’s error: Buy now, pay later is "free" until the fourth payment

Pay-in-four loans really can cost nothing. The CFPB's research shows where they stop being free: late fees, several loans running at once, and protections thinner than a credit card's. Read this before holiday shopping starts.

From the Money desk · All errors of the day · RSS

WrongIt's buy now, pay later, so it's free money. I'll split everything into four.

RightIt's interest-free only if every installment clears on time, and it's still debt. I'll use it for one planned purchase, not five at once.

Memory trick Zero interest isn't zero risk: count the loans, not just the payments.

Read today’s error →

Earlier this week

  1. ThinkingConfirmation bias: checking only the answers you hope are rightConfirmation bias is seeking and reading evidence in ways that favor what you already believe. The fix: ask what would prove you wrong, then go look.
  2. DevelopersThe Year 2038 problem: when 32 bits of seconds run outA signed 32-bit time_t overflows at 03:14:07 UTC on Jan. 19, 2038 and wraps to 1901. 64-bit systems are mostly fine; old formats and devices aren't.
  3. LanguageWho vs. whom: one test, one firm rule, and permission to relaxUse who for subjects (he) and whom for objects (him). Always whom right after a preposition. In casual speech, who is fine. Never use whom to sound fancy.

Play with your errors

Five interactive tools, built on the same cited guides. Free, no sign-up, nothing leaves your browser.

Spot the ErrorTimed rounds of sentences with one mistake. Tap the wrong word before the red pen does.HTTP Status Code ExplorerEvery registered code, searchable by number, class or keyword, with what to do next.Bias or Fallacy?Everyday scenarios. Name the cognitive bias or logical fallacy hiding inside.Error Message DecoderPaste a JavaScript or Python error. Get the plain-English meaning and the fix.Myth or Fact?Swipe through popular claims. Every verdict is backed by a cited source.

The guides

Four clusters, 21 guides, every claim linked to a source.

Language

Confused words, grammar slips, misspellings, mispronunciations and mangled idioms.

All language guides →

Developers

HTTP status codes, JavaScript and Python errors decoded, and the bugs that made history.

All developers guides →

Thinking

Cognitive biases and logical fallacies: the errors we make before we say a word.

All thinking guides →

Myths

Science, history, nutrition and money misconceptions, checked against primary sources.

All myths guides →

Most looked-up

LanguageCommonly confused wordsAffect or effect? Then or than? A skimmable table of 45 commonly confused English words with meanings, examples and memory tricks that actually stick.DevelopersHTTP status codes, explained properlyEvery HTTP status code from 100 to 511 in plain English: what each means per RFC 9110, the usual cause, and the common mistakes with 401, 404, 429 and 5xx.DevelopersCommon JavaScript errors, explainedWhat "Cannot read properties of undefined", "x is not a function", CORS and JSON.parse errors mean, with exact browser messages and fixes.ThinkingCognitive biases: the predictable ways good minds go wrongA sourced guide to 20 common cognitive biases: anchoring, confirmation bias, sunk cost, Dunning-Kruger and more, with examples, fixes and replication caveats.MythsNutrition myths: what the evidence actually saysEggs and cholesterol, MSG, detoxes, eight glasses of water, the five-second rule, best-by dates: 13 food myths, checked against FDA, USDA and research.DevelopersFamous software bugs in historyAriane 5, Mars Climate Orbiter, Therac-25, Knight Capital, the Patriot clock, Y2K and CrowdStrike: what went wrong, per official reports, and the lessons.

What this site is#

erroneo.us (say it “erroneous”) is a field guide to being wrong in predictable ways. Some errors are small and social, like writing effect when you meant affect. Some are expensive, like a unit mismatch that sends a spacecraft too deep into a planet’s atmosphere. Most sit in between: a confusing 502 on a Friday deploy, a TypeError that only appears in production, a nutrition rule you absorbed as a child and never checked.

The common thread is that these mistakes are patterned. People confuse the same word pairs, hit the same stack traces and repeat the same myths. That makes them worth documenting once, carefully, with the fix next to the failure.

How the pages work#

  • Wrong next to right. Red strikethrough for the error, green underline for the correction, and a sentence on why.
  • Sources on every claim. Specifications like RFC 9110 for HTTP, official language docs, investigation reports for historical software failures, and government or peer-reviewed sources for health and money. See sources & methodology.
  • Skimmable first, thorough second. Tables and quick answers up top, the nuance underneath, and an FAQ at the end.
  • Corrections welcome. A site named after errors has to be strict about its own. Our corrections policy explains how we fix them.

Start here#

Writers and students usually want commonly confused words or common grammar mistakes. Developers land on the HTTP status code reference, JavaScript errors and Python errors. If you want to argue better, read logical fallacies and cognitive biases. And if you suspect something you were taught is wrong, the myths section is for you.