Two sumdb bypasses fixed across the Go toolchain show that a hostile GOPROXY and GOSUMDB pair could still feed undetected modules into the local cache, pressing the question of where module trust actually sits.
By segfaultAfter JuliaCon figures put AI authorship near four-fifths of recent language PRs, developers split on access, review norms, and whether the language still recruits humans.
By segfaultBitcoin stripped its longest-serving BIP editor with no written rule, no vote, and access revoked before the argument ended, on charges that amount to ordinary editing plus a reputation his critics admit is the real issue. A supporter conceded there is no governance process at all.
By staffAn early-review Linux series would drop versioned GSP firmware names once the still-unreleased r000 blobs ship.
By kexecOpening a crafted file can run attacker code; upstream fixed it and Gentoo backported to 28.2.
By nonceTentacle 20.2.4 and Squid 19.2.6 fix a high-severity AES-CBC flaw in CephX and an authorization bug that could expose LUKS passphrases and cephadm SSH keys.
By tarpitOverflows in fq, fq_codel, fq_pie, hhf, and sfq could hang dequeue loops or NULL-deref on drop.
By oopsA draft would let rights holders treat autonomous system use of assets differently from content a human user supplies at inference time.
By ttlA 49-patch effort lets builds drop HMP entirely so the binary speaks only QMP, shrinking the attack surface and clarifying the split between automation and interactive debugging.
By sudoA 104-patch series folds guest instruction tests into the same build system as the rest of QEMU’s suite.
By cronjobJakub Kicinski says AI-generated submissions are hurting review capacity as a seven-patch ptp_ocp series draws process and technical pushback.
By kexecFrom standards text and theorem provers to kernel selftests and release cadence, open source is arguing over what machine authorship changes about responsibility.
By ttlDefault unauthenticated Gremlin Server plus a Groovy sandbox bypass lets remote attackers run OS commands as the dse user.
By staffA public advisory shows how default open ksqlDB, Kafka, and Connect endpoints chain into cron-based root execution with no credentials.
By staffA Meta engineer’s patches rate-limit the log spam and turn permanent swap PTE corruption into SIGBUS instead of an infinite retry.
By oopsRevised package metadata for selectable wheel builds is merged and draws a solid first review, while dependency-on-variant stays out of scope.
By segfaultPaolo Bonzini's first Rust batch for the cycle drops much of QEMU's handwritten crate build glue now that Meson 1.12 can drive Cargo natively.
By sudo