Exhibition no. 088On view Monday, August 3, 2026Viewing time ≈ 5 min
The Forgery Wing: a special exhibition
A perfect 10 for a bug that never existed
JFrog pulled six critical SQLite advisories apart and found functions that do not exist, patches that changed no code, and exploit queries that run clean. NVD, CISA, and Red Hat had already signed the labels.
Cat. 00
Still Life with Ledgers and Balance. Oil on canvas, artist unattributed, 2026. Every plate in this exhibition is AI generated, which is rather the point.
About this exhibition
The Forgery Wing
A museum salon wall for the day the fakes cleared inspection.
Museum and gallery design runs on restraint: a dark salon wall, one spotlit frame, and labels that say only what is known. The working grammar is the wall label itself, a title, a provenance line, a short caption, repeated until it becomes navigation. Salon hangs and condition plates come from the exhibition catalogue, where the point is never display alone but attribution: who made this, and can anyone prove it.
A new GitHub repo published a batch of SQLite vulnerability advisories; NVD flagged them critical, CISA's ADP agreed, and Red Hat briefly scored one a perfect 10.0 before walking it back to 7.6. JFrog's researchers compiled the cited releases and fed every proof of concept through AddressSanitizer: nothing crashed, one advisory named a function added years after the pinned version, and another cited a patch that changed no code at all.
The whole batch reads as generated text, part of 50 plus CVEs from the same author, and the scoring pipeline caught none of it. The catch came from people doing source inspection, the security equivalent of taking the painting off the wall.
Condition report, per JFrog
CVE-2026-51302
9.8
function never existed
CVE-2026-51303
9.8
fabricated patch
CVE-2026-51300
9.1
unrelated code cited
CVE-2026-51297
8.8
function never existed
CVE-2026-51296
7.5
cited lines do not exist
CVE-2026-51304
7.5
wrong argument count
Plate I. X-radiograph. Under the paint, a different picture: the functions these advisories cite were never in the versions they pin.Plate II. Raking light. Age is easy to fake at reading distance; the crack pattern gives it away under examination.
Alibaba's new flagship leads with agentic coding and collaborative-work benchmarks rather than chat. It reached Vercel's AI Gateway within a day, so trying it inside an existing build pipeline is a one-line switch.
An open-weights video model with native audio and 2K output, supported in ComfyUI from day zero. Open weights inside a node graph puts film-grade motion in a designer's local toolchain instead of behind a rental API.
The multi-column rule properties now draw lines inside grid and flexbox gaps, in both axes, with control over how rules meet at edges and junctions. Microsoft's Edge team led the standardization and walks through what changed since the preview, so the border and pseudo-element hacks for gap lines can finally retire.
File permission checks consult only the Edit and Read rule types, so a deny rule written against Write or Glob is accepted and never fires; a sweep of 149 public configs found the pattern in one of every six, often guarding SSH keys. Issue 083 argued the agent is not reading most of the handbook; the permission file deserves the same audit.
A plea to stop pasting model output verbatim into Slack threads, reviews, and group chats. Reading it, validating it, and rewriting it in your own words is the value you add; forwarding it is not.
Design move: take one home
The wall label
A museum wall label is three lines of typed restraint: a linked title, a provenance line naming source and date, and a caption held to two sentences. As a card pattern it replaces the dot-separated meta strip and the chip row with something calmer, a quiet comma-separated fragment set small under the title.
Use it anywhere items need attribution: portfolio pieces, product cards, changelog entries, editorial indexes. It stays honest as long as the title carries the link, the provenance line holds AA contrast even while reading as secondary, and the caption never grows a third sentence.
Study Room
Prompt Lab
Build a one-page landing page for a museum special exhibition, art directed as a salon-wall gallery for a show about forgeries.
Canvas: deep plum salon wall (#38222F) with faint tone-on-tone vertical silk stripes, warm ivory text (#F1E9D7), cream label stock (#F7F1E1) carrying near-black ink (#2A1B24), gilt brass accent (#C9973F, lightened to #D6A855 for small caps on the wall), dusty mauve support text (#B49AAB), bronze (#7A5B2A) for italic and links on cream.
Type: Marcellus for the exhibition title and room headings, caps with wide letterspacing; EB Garamond for body at 20px with 1.7 line height; Cutive Mono for catalogue numbers and typed plate captions. The contrast logic: inscriptional Roman capitals over a bookish Garamond.
Structure: a running head with the museum name and two nav links; a centered on-view line in brass small caps (exhibition number, dates, viewing time) between two hairline picture-rail rules; a hero with the exhibition title and a short introduction left, and one gilt-framed artwork right, hung from a visible brass cord, with a wall-label caption beneath it; an introduction wall-text panel on cream; numbered gallery rooms as sections, each opened by a small cream plaque (ROOM I, ROOM II) beside the room title over a hairline rule; exhibits as cream wall-label cards holding a mono catalogue number, a linked title, a one-line provenance (source, date) set small and muted, then a caption of at most two sentences; one dark examination moment, two photographic plates on charcoal mats with typed captions; a centered visitor-information colophon.
Rules: square corners, 4px radius maximum on cards. Brass is for rules, plaques, small caps, and underlines, never body text on cream. Body text stays at least 18px and WCAG AA against its actual surface. No gradients, no glow, no neon, no fake search or filter chrome, no dot-separator meta strips: provenance reads as a comma-separated line. Hovering a framed plate lifts it 2px with a deeper shadow at 150ms ease, guarded by prefers-reduced-motion. Images are photographs of framed paintings or conservation plates, never screenshots with readable text.
Reproductions available in v0, Bolt, Lovable, Figma Make, and Beaver Builder AI, the publisher's own tool.
Field note
Museums learned centuries ago that attribution is labor: every label on the wall stands for hours of unglamorous checking. A severity score is only as good as whoever last took the painting down.
