Fake CVEs Need Real Friction
A fabricated batch of SQLite vulnerability reports shows why security automation needs verification gates, not just faster ingestion.
// Archive
Posts
Pieces filed under Open Source.
Browse
Filter by topic
NetBSD 11 Keeps Portability Practical
NetBSD 11.0 adds RISC-V support, a fast x86 MICROVM kernel, better Linux syscall compatibility, and the kind of old-machine care that still matters.
pvcli Gives OHTTP A Debugging Handle
Cloudflare's pvcli gives OHTTP, CONNECT proxying, and future MASQUE work a curl-like test harness for privacy-preserving protocols.
Auto-CPUFreq Makes Power Tuning Visible
Auto-CPUFreq 3.1 adds GUI monitoring and tighter laptop power controls, turning Linux power tuning into something operators can inspect.
BGP Origin Loses Its Alibi
Cloudflare found widespread BGP ORIGIN rewrites, showing how an old routing attribute can still bend Internet path selection.
Dependabot Adds A Three-Day Brake
GitHub's new Dependabot cooldown waits three days before version-update pull requests, giving fresh package releases time to collect scrutiny.
PyPI Closes The Old Release Door
PyPI now rejects new files on releases older than 14 days, narrowing a supply-chain path where a compromised publisher could poison a long-stable version.
Buzz Gives Agents Their Own Keys
Block's open-source Buzz puts humans, AI agents, workflows, and Git events into one signed workspace, with scoped agent identities instead of borrowed human accounts.
Dusseldorf Gives OAST A Private Callback Plane
Microsoft's open-source Dusseldorf project turns out-of-band application security testing into private infrastructure for capturing DNS, HTTP, and HTTPS callbacks.
GNU Hurd Keeps Moving Its Small Pieces
GNU Hurd's Q2 2026 work shows progress on AArch64, 9P file sharing, storage translators, POSIX cleanup, and an early Rust path for writing Hurd translators.
KDE Gives CPU Affinity A Desktop Handle
KDE Plasma 6.8 is adding CPU affinity controls to System Monitor, turning a normally terminal-heavy scheduler override into something desktop users can inspect and apply directly.
Llamafile Turns Speech AI Into A Single File
Mozilla AI's Llamafile 0.10.4 adds Transcribefile, pushing speech-to-text into the same portable single-file pattern that made local LLMs easier to move across machines.
Self-Hosted LLMs Become Platform Workloads
A CNCF walkthrough of vLLM on Kubernetes shows what private inference really needs: persistent model weights, service discovery, secrets, restart behavior, and an API boundary apps already understand.
Debian Moves x86-32 Into The Legacy Lane
Debian 12.15 closes the normal Bookworm support window while Debian 13 documents reduced i386 support, turning x86-32 from a regular install target into a legacy compatibility lane.
LLVM Gives Native Code A Smaller Sandbox
LLVM has merged x86 and x86_64 support for Lightweight Fault Isolation, giving native C, C++, and assembly code a compiler-level path toward in-process sandboxing.
Cinnamon Makes Wayland Ordinary Without Dropping X11
Linux Mint's Cinnamon desktop is moving Wayland out of the experimental lane while keeping X11 fully supported. The interesting part is not protocol ideology. It is desktop compatibility work.
NetworkManager Gives IPv6-Mostly a Kernel Path
Red Hat's NetworkManager 1.58 work turns IPv6-mostly networking into something Linux clients can actually operate: DHCPv4 Option 108, CLAT, NAT64, and eBPF packet translation instead of endless dual stack.
OpenSSH 10.4 Hardens The Quiet Path
OpenSSH 10.4 is not a flashy remote-access release. It is the kind operators should notice anyway: stricter sandbox failure behavior, tighter rekey handling, SFTP and SCP security fixes, and a cautious post-quantum signature experiment.
Ubuntu ARM64 Stops Feeling Like A Port
Canonical's latest Ubuntu-on-ARM update is less about one flashy device and more about architecture parity: main archive delivery, Livepatch, Secure Boot laptop work, FEX-backed gaming, and a shrinking desktop software gap.
ReactOS Running Half-Life 2 Makes the NT Clone Weirdly Real
ReactOS booting Half-Life 2 with legacy Windows drivers is funny on the surface and serious underneath: the open-source NT clone is proving more of the Windows stack in public.
Box3D Makes Game Physics Feel Portable Again
Box3D is a new open-source 3D physics engine from Box2D creator Erin Catto. The interesting part is not only another physics library. It is the attempt to make hard-won game simulation knowledge portable, inspectable, and reusable across projects.
Git 2.55 Makes Change Less Expensive
Git 2.55 is not one big flashy feature. It is a release about lowering the cost of everyday source-control work: smaller repository maintenance writes, simpler history cleanup, faster status on Linux, and safer terminal output.
Security Profiles Need an API Contract
Security Profiles Operator v1 is a reminder that container hardening does not become operational until profiles can be recorded, reviewed, shipped, and bound like normal Kubernetes objects.
RAID5 Still Has a Contention Budget
A new Linux MD RAID5 patch series is a useful reminder that storage performance is not only about disks. Once an array has enough drives and enough cores, the shared bookkeeping around stripes can become the workload.
Trace Storage Is a Database Problem Again
Jaeger's new ClickHouse backend is a useful reminder that observability cost is not only about how many spans you keep. It is about which questions your storage layout can answer without turning every search into a scan.
The Race Condition Hiding in the Flush
Cloudflare's six-week hunt through a truncated image response is a reminder that observability stops at the layer you forgot to instrument.
Epic Games Gives Game Assets Their Own Git
Epic Games open-sourced Lore, a version-control system built for game studios where meshes, textures, locks, sparse workspaces, and giant binary files are the normal case.
Homebrew 6 Locks the Tap Before It Pours
Homebrew 6.0 turns third-party taps into explicit trust decisions, adds Linux sandboxing, and quietly makes the developer laptop feel less like an unattended loading dock.
Linux-Firmware Teaches Codex the Blob Rules
The linux-firmware repository just merged AGENTS.md guidance for Codex, Claude Code, and other coding agents, with a very Linux lesson: do not touch the blobs, do prove the provenance.
Microsoft Intelligent Terminal Gives Agents a Shell Seat
Microsoft's new Intelligent Terminal 0.1 turns the command line into an agent-aware workspace without forcing AI into mainline Windows Terminal.
Computer Vision Gets an Engine
OpenCV 5 is not just a library refresh. It pulls classic vision, deep neural networks, local LLM and VLM workflows, 3D tools, and hardware acceleration into one perception stack.
Vite Moves to the Edge
VoidZero joining Cloudflare is more than an acquisition note. It turns Vite, Rolldown, Oxc, and workerd into a test of how the web's build loop becomes deployment infrastructure.
Signing Keys Became Infrastructure
GitHub's Enterprise Server signing-key rotation is a reminder that update verification keys are not paperwork. They are part of the production control plane.
AI Code Needs A Paper Trail
Flathub's strict new generative AI policy is a warning to every software distribution platform: AI-written code is manageable only when humans can prove ownership, review, and build history.
Open Source Gets A Clearinghouse
IBM and Red Hat's Project Lightwell points to a new phase of open source security: AI can find more bugs, but enterprises now need a coordinated system for verified fixes.
Platforms Become Disclosure Firebreaks
A reported suspension of Windows exploit mirrors shows how code-hosting platforms are becoming part of the vulnerability disclosure control plane.
Cargo's Cache Was a Trust Boundary
Rust's Cargo fix for CVE-2026-5223 is a reminder that package managers do not just download code. They define which parts of the build machine other people are allowed to touch.
The npm Trust Signal Broke
Mini Shai-Hulud turned trusted publishing, CI cache reuse, and developer credentials into one continuous attack path. The fix is not less automation. It is stricter boundaries around the automation we already rely on.
Linux Has Another Page-Cache Root Bug
DirtyDecrypt is the latest Linux local privilege escalation tied to page-cache corruption, and public proof-of-concept code makes it a priority for rolling-release systems and exposed developer workstations.
Linux 7.1-rc4 Shows the Kernel Is Normalizing AI in the Development Loop
Linux 7.1-rc4 brings the usual pile of hardware fixes and security updates, but the more interesting shift is procedural: the kernel is documenting responsible AI use and what qualifies as a security bug.
End of list