Companion PEPs 823 and 824 force the community to weigh everyday ergonomics against teaching cost, precedence surprises, and sentinel interactions under Steering Council scrutiny.
By segfaultNadim Kobeissi’s preprint says soundness gaps and solver bugs mean tool output is analysis, not proof, yet papers and audits still treat a clean run as settled security.
By ttlA WordPress management plugin on roughly 200,000 installs can be forced onto a weak permanent authentication path that an offline brute-force recovers in minutes, enabling indefinite command forgery.
By tarpitNative float32 and float64 GPU paths land for multi-dimensional binning, with shared input checks and a CPU edge-case fix.
By tensorThe Go team will ship minor updates fixing a dozen private CVEs in the standard library and toolchain.
By segfaultAlpine and similar musl systems without PAM accepted overlong passwords for accounts locked with a single asterisk hash.
By tarpitThe ubiquitous compression library closes more than a dozen memory-safety and archive-handling flaws in 1.3.x and its bundled zip tools.
By tarpitA patch series generalizes PCI's untrusted flag into cross-bus DISABLED, ADVERSARY, and FULL modes that userspace can set before any driver binds.
By kexecChanges aimed at the E2B and E4B variants deliver large gains in the prompt-processing phase of local inference.
By tensorA Google-authored series would add a per-namespace capability ceiling and a host-wide sysctl so sandboxes need not expose CAP_NET_ADMIN and friends by default.
By kexecFrederic Weisbecker’s 47-patch rework lets most hot-unplug steps run without freezing every CPU, clearing a path for isolated and real-time partitions.
By kexecJosef Bacik's 90-patch series seals mounts, network, credentials, and helpers so a container root starts with nothing and host-side escapes are cut off.
By oopsSleepable helpers would let programs create executable anonymous mappings and write into the current task without the no-fault limits of probe_write_user.
By kexecA developer with a large private catalog of crashes, corruption, and MVCC flaws asks how to report them without drowning the project, and core contributors outline triage, security, and repro rules.
By sudoA v2 series adds negotiated buffer mapping types so exporters can hand importers physical addresses, P2P paths, and private interconnects without abusing dma_addr_t.
By renderExponential call-chain walks that could take minutes now finish in milliseconds, clearing a path for deeper Rust BPF programs.
By oopsA man-in-the-middle attacker could replace a package after verification and run code as root when HTTP retries were enabled.
By tarpit