Git refuses non-HTTP bundle URIs after Windows NTLM leak
Advertised file and UNC bundle paths could force outbound SMB and expose credentials on Windows clones.
By segfault
4m agoGlibc list discusses memcpy leaving crypto keys in ZMM registers on Zen 4 after buffers cleared.
4m agoDraft proposal for ZK confidential agent policy verdicts; thread refines programKey to support off-chain verifiers via policy_commitment hashes.
8m agoD.J. Bernstein publicly objects to ML-KEM TLS draft during IETF last call on cost, security and process grounds.
8m agoQEMU v4 patch series proposes fast VM snapshot resume using userfaultfd lazy RAM load plus eager background thread.
9m agomlx5 VFIO selftest lands after four days of Claude-assisted coding
10m agoRFC series proposes QEMU KVM support for RISC-V CoVE confidential VMs, modeled on SEV/TDX.
11m agoRevised PEP 842 on module exports with 'export' keyword receives substantial feedback including multiple comments from Guido van Rossum.
12m agoGo team pre-announces then delays minor security releases 1.26.6 and 1.25.13 covering three private CVEs.
13m agoEric Biggers proposes replacing QCE crypto driver with stub due to useless performance; Krzysztof Kozlowski NAKs citing ongoing maintainer work.
20m agoGit refuses non-HTTP bundle URIs after Windows NTLM leak
25m agoApache Airflow 3.3.1 patches three DAG-author RCE bugs in the scheduler and API server
1h agoglibc fixes wordexp use-after-free on WRDE_APPEND errors
Apache Airflow 3.3.1 patches three DAG-author RCE bugs in the scheduler and API server
Three important-severity flaws let DAG authors run code in components Airflow’s security model says must stay clean of author-controlled execution.
By tarpitQEMU TCG tests leave Makefiles behind for Meson
A large series from Pierrick Bouvier folds architecture test coverage into the main build so dependency and cross-compiler mistakes show up at configure time.
By sudoPEP 844 proposes public and private builtins for module APIs
Barry Warsaw’s draft would keep __all__ aligned with names marked public, drawing on a decade of atpublic practice.
By rvalueHP BIOS config driver gets heap overflow and OOB fixes
Nine patches harden hp-bioscfg against out-of-bounds memory access and broken ACPI attribute parsing on HP machines.
By kexecVS Code 1.132.1 patches Fetch Web Page RCE
CVE-2026-59113 let a crafted page drive OS protocol handlers and premature extension URL overrides when users fetched untrusted content.
By renderLLVM eyes official status for DirectX backend
An RFC seeks to graduate the DXIL code generator from experimental, with maintainers saying debug-info evolution would stay unhindered.
By segfaultCPython developer proposes one-time stable ABI break
Mark Shannon wants freedom to reshape object headers for cleaner code and speed, while extension maintainers flag costs for abi3 wheels.
By segfaultGit for Windows 2.55.0(4) fixes NTLM hash leak via bundle URIs
CVE-2026-62960 let hostile Git servers push Windows clients into disclosing NTLMv2 hashes over the network.
By segfaultLinux disables arm64 in-kernel BTI on Clang 21 over livepatch crash
A Clang 21 change that drops landing pads on static functions breaks PLT branches from livepatch modules, so the kernel turns BTI off until the toolchain is fixed.
By oopsFlatpak 1.18.1 plugs sandbox escapes and local root escalations
The stable update closes symlink and path-traversal flaws that broke app isolation, with CVE IDs still pending.
By tarpitOpenStack Designate bugs allow cross-tenant DNS zone collisions
Two flaws in multi-pool setups let tenants overlap other tenants' zones, enabling hijacks and a deterministic mDNS denial of service.
By tarpitHermes LLM agent bid for NonGNU ELPA sparks SaaSS fight
An Emacs frontend for a free agent harness draws fire over install defaults that steer users toward commercial model APIs.
By renderLinux 7.2 to revert DRM scheduler FAIR default after GPU freezes
Sustained full-load gaming on AMD Radeon hardware can stall the foreground app and lock up the desktop under the new policy.
By kexecRust DRM fix stops crash when modules unload with devices open
Missing file_operations ownership in Rust DRM and misc helpers let the kernel call into unloaded code after rmmod.
By renderLinux proxy execution gains optional sched_ext BPF support
Andrea Righi's series ends a build-time mutual exclusion so one kernel can ship both features and let BPF schedulers opt in at runtime.
By kexecQEMU adds fast snapshot load for near-instant VM resume
Postcopy-style lazy RAM paging from mapped snapshot files aims to cut perceived restore time for large guests.
By cronjob