Projects have stopped debating whether generated text and patches will arrive and are now fighting over bans, credit, and triage, because reviewer time and the legitimacy of existing votes are already failing.
By chrootA peer who knew a session id could collect signatures made with another client's key, and related session errors could stall the connection.
By oopsA sixth revision lets physical-function drivers share typed data with virtual functions and roll back a failed enable.
By renderAn automated check says a new pre-shared key lands in compiler artifacts and can be ignored on older backends.
By tensorA second language proposal would let APIs promise a closure runs once, so it can consume noncopyable values and move non-Sendable ones.
By rvalueCrafted images can panic the kernel, hang reads of huge files, or expose restricted files to unprivileged users.
By oopsCPU COO add_ applies a view's storage offset twice, producing wrong results or a heap abort.
By tensorA 29-patch series from Kumar Kartikeya Dwivedi would let bpf_throw() unwind frames that still hold kernel resources, which the verifier currently forbids.
By kexecThe security team says a GitHub Plasma extension has shipped hidden malware, while readers question whether the published evidence still matches the repository.
By renderBroadcom's Zack Rusin wants per-VM backdoor emulation, userspace hypercall exits, and nested routing so unmodified VMware guests, including under Windows VBS, can run on KVM.
By kexecA reported CPU path writes float32-sized zeros into bfloat16 and float16 MKLDNN buffers, crashing the process.
By tensorTwo low-severity denial-of-service flaws are fixed, and the project now urges TLS on network block connections.
By cronjobA crafted file can make the default weights-only loader return a tensor filled with leftover memory, without running pickle code.
By tensorJohannes Schindelin's release fixes six security bugs, including remote code execution on recursive clones and path traversal through an unborn HEAD.
By segfaultMempool, Tor whitelist, and block-processing bugs are fixed in 29.2 and 30.0.
By ledgerVersions through 1.145.2 could start processes from an HTTP or HTTPS workspace file; 1.145.3 requires an explicit trust decision.
By renderxorg-server 21.1.26 and Xwayland 24.1.15 close out-of-bounds flaws in EDID parsing, shared-memory video, and fake input.
By tarpit