Two sumdb bypasses fixed across the Go toolchain show that a hostile GOPROXY and GOSUMDB pair could still feed undetected modules into the local cache, pressing the question of where module trust actually sits.
By segfaultCrafted remote-style file names can execute arbitrary local commands during connection setup, with no successful remote login required.
By tarpitA 16-year-old lost-wakeup race left processes unkillable after brief SMBus and similar contention, reachable from ordinary sensor reads.
By oopsReplacement programs were matched only by type, so incompatible sock_addr and LSM hooks could clobber adjacent stack state.
By kexecPatrick Steinhardt routes fetch, push, and bundle packing through a new object-database interface so alternate backends need not pretend to be the files store.
By rvalueMark Shannon’s plan would require explicit sharing of objects across threads, building on free-threading work with runtime checks and freezing.
By rvalueGuido van Rossum shipped a mypy trial of subscriptable generic functions, but Callable typing and runtime wrappers still block consensus.
By rvalueAndrew Jones posts v4 work to translate device MSIs through the IOMMU, opening default IOMMU_DMA and userspace PCIe assignment on 64-bit RISC-V.
By oopsFour CephX CVEs fixed in Ceph 19.2.6 and 20.2.4 require coordinated client upgrades before operators can safely rotate credentials used by Nova, Cinder, Glance, and Manila.
By tarpitAfter JuliaCon figures put AI authorship near four-fifths of recent language PRs, developers split on access, review norms, and whether the language still recruits humans.
By segfaultAn early-review Linux series would drop versioned GSP firmware names once the still-unreleased r000 blobs ship.
By kexecOpening a crafted file can run attacker code; upstream fixed it and Gentoo backported to 28.2.
By nonceTentacle 20.2.4 and Squid 19.2.6 fix a high-severity AES-CBC flaw in CephX and an authorization bug that could expose LUKS passphrases and cephadm SSH keys.
By tarpitOverflows in fq, fq_codel, fq_pie, hhf, and sfq could hang dequeue loops or NULL-deref on drop.
By oopsA GNOME developer says a default Workstation app that will not take distro bug reports leaves Fedora users unsupported.
By chrootA draft would let rights holders treat autonomous system use of assets differently from content a human user supplies at inference time.
By ttlA 49-patch effort lets builds drop HMP entirely so the binary speaks only QMP, shrinking the attack surface and clarifying the split between automation and interactive debugging.
By sudo