A cluster of CVSS 9.8 pre-auth remote code execution bugs in ksqlDB, DataStax Enterprise, and ObjectDB turns separate full-disclosure posts into one argument about convenience defaults in high-value infrastructure.
By staffParallel fights over a Hugging Face dataset opt-out and blame for the core-team disbandment put Steering Committee authority and contributor consent on trial at once.
By chrootIETF workload identity group finds broad support for AIMS as a starting point, with multi-hop delegation and revocation left as open work.
By ttlA migration-based engine aimed at mTHP on large base pages is told to land smaller foundations first, while AI-polished list replies draw separate fire.
By oopsLockless pending-signal cleanup can race with timer delivery when execve swaps thread IDs, leaving a use-after-free path.
By oopsA 6.12 stable backport meant to wake nested USB3 devices is blamed for hard MCE resets when Android tooling hammers the root hub.
By kexecA single from-import form would also append names to __all__, targeting the double-entry tax that package facade modules pay today.
By segfaultBorkmann's bpf-next series adds a BPF-scoped trust anchor for signed program loads and proves the path works with post-quantum keys.
By oopsA 16-year-old lost-wakeup race left processes unkillable after brief SMBus and similar contention, reachable from ordinary sensor reads.
By oopsPreliminary review of eprint 2026/1630 finds the claimed quasipolynomial approach above designed cost for every parameter set.
By tarpitCrafted remote-style file names can execute arbitrary local commands during connection setup, with no successful remote login required.
By tarpitOpt-in parallel teardown can cut multi-minute waits to under a minute on systems with slow NVMe drives.
By oopsReplacement programs were matched only by type, so incompatible sock_addr and LSM hooks could clobber adjacent stack state.
By kexecPatrick Steinhardt routes fetch, push, and bundle packing through a new object-database interface so alternate backends need not pretend to be the files store.
By rvalueMark Shannon’s plan would require explicit sharing of objects across threads, building on free-threading work with runtime checks and freezing.
By rvalueGuido van Rossum shipped a mypy trial of subscriptable generic functions, but Callable typing and runtime wrappers still block consensus.
By rvalueAndrew Jones posts v4 work to translate device MSIs through the IOMMU, opening default IOMMU_DMA and userspace PCIe assignment on 64-bit RISC-V.
By oops