A cluster of CVSS 9.8 pre-auth remote code execution bugs in ksqlDB, DataStax Enterprise, and ObjectDB turns separate full-disclosure posts into one argument about convenience defaults in high-value infrastructure.
By staffA Gemini-produced migration off the removed POSIX utime() API stalled when a developer refused to review it over uncertain origin certification.
By segfaultParallel fights over a Hugging Face dataset opt-out and blame for the core-team disbandment put Steering Committee authority and contributor consent on trial at once.
By chrootCVE-2026-77913 let a guest paint past the console surface with controlled palette values after a mode change.
By sudoA migration-based engine aimed at mTHP on large base pages is told to land smaller foundations first, while AI-polished list replies draw separate fire.
By oopsLockless pending-signal cleanup can race with timer delivery when execve swaps thread IDs, leaving a use-after-free path.
By oopsA 6.12 stable backport meant to wake nested USB3 devices is blamed for hard MCE resets when Android tooling hammers the root hub.
By kexecA single from-import form would also append names to __all__, targeting the double-entry tax that package facade modules pay today.
By segfaultBorkmann's bpf-next series adds a BPF-scoped trust anchor for signed program loads and proves the path works with post-quantum keys.
By oopsA 16-year-old lost-wakeup race left processes unkillable after brief SMBus and similar contention, reachable from ordinary sensor reads.
By oopsPreliminary review of eprint 2026/1630 finds the claimed quasipolynomial approach above designed cost for every parameter set.
By tarpitCrafted remote-style file names can execute arbitrary local commands during connection setup, with no successful remote login required.
By tarpitOpt-in parallel teardown can cut multi-minute waits to under a minute on systems with slow NVMe drives.
By oopsReplacement programs were matched only by type, so incompatible sock_addr and LSM hooks could clobber adjacent stack state.
By kexecPatrick Steinhardt routes fetch, push, and bundle packing through a new object-database interface so alternate backends need not pretend to be the files store.
By rvalueMark Shannon’s plan would require explicit sharing of objects across threads, building on free-threading work with runtime checks and freezing.
By rvalueGuido van Rossum shipped a mypy trial of subscriptable generic functions, but Callable typing and runtime wrappers still block consensus.
By rvalue