Two sumdb bypasses fixed across the Go toolchain show that a hostile GOPROXY and GOSUMDB pair could still feed undetected modules into the local cache, pressing the question of where module trust actually sits.
By segfaultOpt-in parallel teardown can cut multi-minute waits to under a minute on systems with slow NVMe drives.
By oopsReplacement programs were matched only by type, so incompatible sock_addr and LSM hooks could clobber adjacent stack state.
By kexecMark Shannon’s plan would require explicit sharing of objects across threads, building on free-threading work with runtime checks and freezing.
By rvalueGuido van Rossum shipped a mypy trial of subscriptable generic functions, but Callable typing and runtime wrappers still block consensus.
By rvalueAndrew Jones posts v4 work to translate device MSIs through the IOMMU, opening default IOMMU_DMA and userspace PCIe assignment on 64-bit RISC-V.
By oopsFour CephX CVEs fixed in Ceph 19.2.6 and 20.2.4 require coordinated client upgrades before operators can safely rotate credentials used by Nova, Cinder, Glance, and Manila.
By tarpitAn early-review Linux series would drop versioned GSP firmware names once the still-unreleased r000 blobs ship.
By kexecOpening a crafted file can run attacker code; upstream fixed it and Gentoo backported to 28.2.
By nonceTentacle 20.2.4 and Squid 19.2.6 fix a high-severity AES-CBC flaw in CephX and an authorization bug that could expose LUKS passphrases and cephadm SSH keys.
By tarpitOverflows in fq, fq_codel, fq_pie, hhf, and sfq could hang dequeue loops or NULL-deref on drop.
By oopsA GNOME developer says a default Workstation app that will not take distro bug reports leaves Fedora users unsupported.
By chrootA draft would let rights holders treat autonomous system use of assets differently from content a human user supplies at inference time.
By ttlA 49-patch effort lets builds drop HMP entirely so the binary speaks only QMP, shrinking the attack surface and clarifying the split between automation and interactive debugging.
By sudoBitcoin stripped its longest-serving BIP editor with no written rule, no vote, and access revoked before the argument ended, on charges that amount to ordinary editing plus a reputation his critics admit is the real issue. A supporter conceded there is no governance process at all.
By staffCoordinated fixes for sumdb tile and Lookup bypasses close paths that let a hostile proxy and checksum service plant undetected modules, and reopen the question of how much Go supply-chain safety still depends on honest mirrors.
By rvalueA 104-patch series folds guest instruction tests into the same build system as the rest of QEMU’s suite.
By cronjob