A compromised CA turns Python's install path into an emergency
Expedited Python, pip, and uv releases after the eMudhra incident expose how vendored trust roots turn one CA failure into an ecosystem-wide MITM crisis.
By rvalue
4m agoRFC proposes common attestation subsystem and CTLV UAPI for TDX plus other providers; 150-message review covers validation, nesting, events and config.
7m agoESA team presents ATLAS, a Julia GNC simulator for Argonaut lunar lander, and discusses performance trade-offs vs MATLAB.
11m agoStable-bound /proc fixes close UAF, hangs, and readdir races
12m agov8 patch series adds TSM-backed vIOMMU and vDEVICE support in iommufd for confidential guest PCI assignment.
13m agoSwift core team pitches extending @backDeployed to fixed-layout types, enabling Span/Ref/etc. on older runtimes via metadata uniquing.
16m agoPatch series documents UBWC layout and fixes msm_framebuffer_init validation that accepted undersized buffers allowing DPU out-of-bounds reads.
21m agoKernel build series cuts allmodconfig times by up to 36%
21m agoSwift Evolution review of Cell/ConstCell/Volatile draws 43 messages on aliasing, Sendable, and C/C++ interop.
21m agoNadim Kobeissi posts preprint arguing ProVerif/Tamarin soundness arguments contain gaps and bugs, proposing they be called symbolic protocol analyzers instead of provers.
24m agoAuthors solicit feedback on draft embedding DNS answers in HTTP responses to cut resolution latency; early cross-WG technical discussion on formats and trust.
89m agoPractical attack breaks RLCE 128-bit PQC parameters
3h agoSCHED_DEADLINE fixes stop crashes and bandwidth leaks
Open source draws hard lines on AI text and AI tooling
LLVM moves to ban AI-written PR and RFC prose, Emacs argues over LLM-assisted packages, and a poisoned coding extension turns assistant workflows into a maintainer supply-chain risk.
By segfaultKernel build series cuts allmodconfig times by up to 36%
Lorenzo Stoakes targets single-threaded kbuild, modpost, and objtool bottlenecks that dominate full, incremental, and no-op rebuilds.
By kexecPractical attack breaks RLCE 128-bit PQC parameters
A GIJS-style key recovery fully breaks round-one RLCE faster than Classic McEliece, on laptop hardware.
By tarpitStaging rtl8723bs Wi-Fi driver fix targets heap key overflow
A proposed patch rejects oversized cfg80211 key sequence counters that could overrun a fixed buffer in the Realtek SDIO driver.
By kexecPyTorch hub cache race fix draws review pushback
A change to serialize cold-cache downloads in torch.hub still needs packaging, docs, and timeout work before merge.
By tensorRails 8.0.5.2 and 8.1.4.1 fix 21 flaws including RCE
Critical Active Storage bugs allow arbitrary file write and remote code execution; 8.0 security support ends in days.
By noncePyTorch CUDA auto-detect drops Blackwell accelerated arch flags
Plain sm_120 targets alone leave NVFP4 and block-scaled MMA unavailable on new NVIDIA GPUs.
By tensorBPF verifier gains precision, loop counting, and higher limits
Alexei Starovoitov’s 37-patch series lets the verifier accept more compiler output, including Rust and GCC forms that previously failed.
By oopsLinux fixes zswap stale-data corruption and swap-in PSI bugs
A critical zswap path could return old pages instead of written zeroes, while batched swap reads hid zram and async stalls from pressure and delay accounting.
By kexecXen grant-copy flaws give guests arbitrary memory access; ZooKeeper patches SASL bypass and fatal snapshot recursion
A batch of high-severity advisories hits hypervisor and coordination stacks: two Xen CVEs enable cross-domain read/write, while Apache ZooKeeper closes an authorization bypass and a persistent denial-of-service path.
By tarpitOverlayfs security fixes land; Linus rewrites VFS name helper
Unprivileged-reachable overlayfs bugs found by AI review merge for 7.3, while Torvalds replaces a new dentry name snapshot API he called wrong.
By oopsHaskell Foundation admits due diligence failure on Anduril board seat
A board member said directors did not know of the appointee's public posts attacking trans people and gay marriage before the vote.
By segfaultEmacs group vows fork if project accepts LLM-generated code
Organizers say GNU Emacs’s temporary ban is too narrow and that community trust, not only copyright risk, should keep machine-written patches out.
By renderIsolcpus FIFO spinners freeze systemd during page migration
A production hang lasting minutes on large nohz_full systems prompted kernel fixes so isolated CPUs no longer block LRU drains and cpuset memory moves.
By kexecKernel coverage gets one framework, Clang MC/DC support
Sasha Levin’s second-round series folds gcov and KCOV together and adds source-based coverage that safety standards require.
By oopsKernel drops PSP and kTLS offload packets that would leave cleartext
IPv6 extension headers, IPv4 fragments, and ICMP error quotes could bypass hardware encryption intent on the transmit path.
By oops