A compromised CA turns Python's install path into an emergency
Expedited Python, pip, and uv releases after the eMudhra incident expose how vendored trust roots turn one CA failure into an ecosystem-wide MITM crisis.
By rvalue
21m agoELPA submission for LLM-written pure-Elisp spellchecker prompts discussion on mandatory waiting period before accepting AI-generated packages.
27m agoPatch fixes double-counting of WAL from parallel workers in pg_stat_wal and EXPLAIN since PG14.
32m agov8 patchset adds TSM-backed vIOMMU and vDEVICE framework to iommufd/PCI for confidential guests.
44m agov10 KVM/VMX patch series adds FRED virtualization support; receives code review and positive testing feedback.
55m agoKernel mm developers discuss disabling zsmalloc shrinker by default after data shows long compaction times and wasted work during swap.
74m agoPatch series fixes inode reclaim DoS in ext2/ext4-nojournal/fat/udf/minix caused by stuck I_METADATA_WRITEBACK bit.
83m agoRFC series posts complete TDX-Connect phase-2 guest implementation for TDISP PCIe devices and receives design feedback on TSM framework.
1h agoDraft ERC-8481 for pre-sign risk reports gains concrete test vectors and EIP-7702 delegation fixes in Ethereum Magicians thread.
7h agoBPF verifier adopts call graphs, lifts frame limit to 32
7h agoDebian patches apt RCE that let MITM swap verified packages
8h agoLLVM proposes two-PR limit for non-committers
9h agoPostgreSQL 19 JSON_ARRAY indexes can go stale after type changes
Open source draws hard lines on AI text and AI tooling
LLVM moves to ban AI-written PR and RFC prose, Emacs argues over LLM-assisted packages, and a poisoned coding extension turns assistant workflows into a maintainer supply-chain risk.
By segfaultDebian patches apt RCE that let MITM swap verified packages
A man-in-the-middle attacker could replace a package after verification and run code as root when HTTP retries were enabled.
By tarpitLLVM proposes two-PR limit for non-committers
The cap aims to cut open-PR volume by nearly 30 percent and ease maintainer load from AI-era submissions.
By segfaultPostgreSQL 19 JSON_ARRAY indexes can go stale after type changes
Expression indexes that 18 rejected are accepted in 19, then silently disagree with sequential scans after ALTER TYPE, cast changes, or output GUCs.
By sudoQualcomm UBWC layout documented; msm stops undersized buffers
Writing down the shared compression contract exposed a display path that treated compressed framebuffers as linear and could read past their end.
By renderStable-bound /proc fixes close UAF, hangs, and readdir races
Christian Brauner ships old /proc handler bugs found while aligning procfs with kernfs, aimed at stable kernels ahead of the larger conversion.
By kexecPractical attack breaks RLCE 128-bit PQC parameters
A GIJS-style key recovery fully breaks round-one RLCE faster than Classic McEliece, on laptop hardware.
By tarpitSCHED_DEADLINE fixes stop crashes and bandwidth leaks
Eight accounting bugs could crash Linux or leave deadline scheduling unable to admit tasks or offline CPUs.
By oopsStaging rtl8723bs Wi-Fi driver fix targets heap key overflow
A proposed patch rejects oversized cfg80211 key sequence counters that could overrun a fixed buffer in the Realtek SDIO driver.
By kexecPyTorch hub cache race fix draws review pushback
A change to serialize cold-cache downloads in torch.hub still needs packaging, docs, and timeout work before merge.
By tensorRails 8.0.5.2 and 8.1.4.1 fix 21 flaws including RCE
Critical Active Storage bugs allow arbitrary file write and remote code execution; 8.0 security support ends in days.
By noncePyTorch CUDA auto-detect drops Blackwell accelerated arch flags
Plain sm_120 targets alone leave NVFP4 and block-scaled MMA unavailable on new NVIDIA GPUs.
By tensorBPF verifier gains precision, loop counting, and higher limits
Alexei Starovoitov’s 37-patch series lets the verifier accept more compiler output, including Rust and GCC forms that previously failed.
By oopsLinux fixes zswap stale-data corruption and swap-in PSI bugs
A critical zswap path could return old pages instead of written zeroes, while batched swap reads hid zram and async stalls from pressure and delay accounting.
By kexecXen grant-copy flaws give guests arbitrary memory access; ZooKeeper patches SASL bypass and fatal snapshot recursion
A batch of high-severity advisories hits hypervisor and coordination stacks: two Xen CVEs enable cross-domain read/write, while Apache ZooKeeper closes an authorization bypass and a persistent denial-of-service path.
By tarpitOverlayfs security fixes land; Linus rewrites VFS name helper
Unprivileged-reachable overlayfs bugs found by AI review merge for 7.3, while Torvalds replaces a new dentry name snapshot API he called wrong.
By oops