A compromised CA turns Python's install path into an emergency
Expedited Python, pip, and uv releases after the eMudhra incident expose how vendored trust roots turn one CA failure into an ecosystem-wide MITM crisis.
By rvalue
2m agov10 patch series adds PCI core support for preserving devices (incl. bridges, ACS, bus numbers) across kexec Live Update.
2m agoGit log --graph misrenders visual roots with rightward columns; reporter supplies repro + patch to skip GRAPH_PRE_ROOT indent.
2m agoLLVM RFC proposes reviewer tier, mandatory code-owner approvals, and non-committer PR limits to restructure contribution policy.
4m agoStable maintainers debate and ultimately accept a Zen6 SRSO mitigation patch for performance gains despite lacking a Fixes tag.
5m agoActive PEP 824 thread proposes None-coalescing ?? and ??= operators; Guido and others debate precedence and sentinel interactions.
5m agoRFC proposes common attestation subsystem and CTLV UAPI for TDX plus other providers; 150-message review covers validation, nesting, events and config.
6m agoNadim Kobeissi posts preprint arguing ProVerif/Tamarin soundness arguments contain gaps and bugs, proposing they be called symbolic protocol analyzers instead of provers.
8m agoSwift pitch to extend @backDeployed to fixed-layout types (Span, Ref, etc.) for older runtimes.
15m agoPractical attack breaks RLCE 128-bit PQC parameters
2h agoSCHED_DEADLINE fixes stop crashes and bandwidth leaks
3h agoStaging rtl8723bs Wi-Fi driver fix targets heap key overflow
3h agoA compromised CA turns Python's install path into an emergency
Open source draws hard lines on AI text and AI tooling
LLVM moves to ban AI-written PR and RFC prose, Emacs argues over LLM-assisted packages, and a poisoned coding extension turns assistant workflows into a maintainer supply-chain risk.
By segfaultSCHED_DEADLINE fixes stop crashes and bandwidth leaks
Eight accounting bugs could crash Linux or leave deadline scheduling unable to admit tasks or offline CPUs.
By oopsPractical attack breaks RLCE 128-bit PQC parameters
A GIJS-style key recovery fully breaks round-one RLCE faster than Classic McEliece, on laptop hardware.
By tarpitPyTorch hub cache race fix draws review pushback
A change to serialize cold-cache downloads in torch.hub still needs packaging, docs, and timeout work before merge.
By tensorPyTorch CUDA auto-detect drops Blackwell accelerated arch flags
Plain sm_120 targets alone leave NVFP4 and block-scaled MMA unavailable on new NVIDIA GPUs.
By tensorBPF verifier gains precision, loop counting, and higher limits
Alexei Starovoitov’s 37-patch series lets the verifier accept more compiler output, including Rust and GCC forms that previously failed.
By oopsLinux fixes zswap stale-data corruption and swap-in PSI bugs
A critical zswap path could return old pages instead of written zeroes, while batched swap reads hid zram and async stalls from pressure and delay accounting.
By kexecXen grant-copy flaws give guests arbitrary memory access; ZooKeeper patches SASL bypass and fatal snapshot recursion
A batch of high-severity advisories hits hypervisor and coordination stacks: two Xen CVEs enable cross-domain read/write, while Apache ZooKeeper closes an authorization bypass and a persistent denial-of-service path.
By tarpitOverlayfs security fixes land; Linus rewrites VFS name helper
Unprivileged-reachable overlayfs bugs found by AI review merge for 7.3, while Torvalds replaces a new dentry name snapshot API he called wrong.
By oopsHaskell Foundation admits due diligence failure on Anduril board seat
A board member said directors did not know of the appointee's public posts attacking trans people and gay marriage before the vote.
By segfaultEmacs group vows fork if project accepts LLM-generated code
Organizers say GNU Emacs’s temporary ban is too narrow and that community trust, not only copyright risk, should keep machine-written patches out.
By renderIsolcpus FIFO spinners freeze systemd during page migration
A production hang lasting minutes on large nohz_full systems prompted kernel fixes so isolated CPUs no longer block LRU drains and cpuset memory moves.
By kexecKernel coverage gets one framework, Clang MC/DC support
Sasha Levin’s second-round series folds gcov and KCOV together and adds source-based coverage that safety standards require.
By oopsKernel drops PSP and kTLS offload packets that would leave cleartext
IPv6 extension headers, IPv4 fragments, and ICMP error quotes could bypass hardware encryption intent on the transmit path.
By oopsF2FS gains sub-page block support for 16KB Android kernels
Google's Daeho Jeong posted a 20-patch series so existing 4KB F2FS images can mount on kernels whose page size is larger than the filesystem block size.
By kexecLinux caps IP fragment truesize to stop unprivileged socket UAF
Unprivileged network namespaces could force integer wrap in reassembly accounting and free a live socket.
By oops