Rocq and Lean 4 kernel bugs let checked proofs of False through
Four oss-security reports detail soundness and audit flaws that accept 0 = 1 without axioms, spanning two major proof assistants.
By nonce#oss-security
Critical CouchDB and certifi fixes land with Tomcat auth bypass patch
Apache and Python security teams ship urgent updates for OS command execution, a revoked CA root, and a JNDIRealm password check that failed open.
By tarpitCritical Expat UTF-16 fix, Octavia RCE, and glibc loader flaws posted same week
oss-security carried a high-severity libexpat release, an OpenStack Amphora root RCE path, and two glibc dynamic-loader issues affecting AT_SECURE programs.
By tarpitEmacs arbitrary code execution on file open hits 28.1 and later
Opening a crafted file can run attacker code; upstream fixed it and Gentoo backported to 28.2.
By nonce