When bans fail: AI contributions force open projects to rewrite the rules
IETF, QEMU, and Emacs are abandoning pure prohibition for detectors, AGENTS.md norms, and harder questions about review load and provenance.
By ttl
4m agoQEMU virtio-gpu patch series cleans up dmabuf/scanout ownership and fixes several related bugs found while addressing CVE-2026-66020.
5m agoPatch series finishes converting all arches to RCU page table freeing and drops the related Kconfig options.
7m agoSteffen Klassert sent a 12-patch IPsec pull request fixing multiple UAFs, OOB reads and panics in xfrm/iptfs paths.
8m agov11 series extracts PCI fw_devlink fixes (new helper, dangling pointer, DT node handling) from larger LAN966x SFP work.
13m agoV2 patchset fixes UAFs and list corruption in POSIX CPU timers on non-leader exec() via PF_EXITING and sighand locking changes.
26m agoMark Rutland accuses Bradley Morgan of rebasing his old arm64 suspend patches without attribution or S-o-B lines.
34m agoEIP for partial validator reward burn draws 208 heated posts with personal attacks and sock-puppet deletions.
40m agoPatch clears __GFP_DIRECT_RECLAIM for costly __GFP_NORETRY orders to skip direct compaction and fix iomap regression.
3h agoglibc closes LANGUAGE path-traversal gap in gettext
7h agollama.cpp WebUI query param enables CSRF tool runs
8h agoRust SPDM requester proposed for Linux device authentication
11h agoSwiftPM proposes unifying package products and targets
Kbuild series slashes kernel build times by up to 36%
Lorenzo Stoakes targets single-threaded make, modpost, objtool, and Rust bottlenecks that dominate large and incremental builds.
By oopsBan, structure, or disclose: three projects split on AI-generated work
IETF floods, a QEMU policy U-turn, and an ELPA fight with RMS show the same governance crack: whether to forbid generative tools, channel them, or force transparency.
By ttlllama.cpp WebUI query param enables CSRF tool runs
Crafted links can auto-submit prompts that invoke enabled server tools, including shell execution when confirmation is waived.
By tensorRust SPDM requester proposed for Linux device authentication
Alistair Francis aims the smallest upstream SPDM stack at untrusted PCIe and related devices, with CMA wired through the TSM path.
By oopsSwiftPM proposes unifying package products and targets
An early design would collapse the two concepts into targets controlled by visibility rules, seeking to reduce manifest confusion while keeping migration paths open.
By segfaultTor 0.4.9.12 patches high-severity UAFs and drops TAP keys
The security release fixes multiple memory-safety flaws and requires relays to upgrade before authorities reject legacy descriptors.
By tarpitVS Code 1.136.2 fixes Copilot Chat ADO token exfiltration
A malicious workspace could redirect Azure DevOps code search traffic and the user's bearer token to an attacker-controlled host.
By renderXen Tapdisk flaws let guests run code as root in dom0
Two out-of-bounds bugs in the userspace block backend give a malicious VM a direct path to host compromise.
By tarpitLinux kernel RDS flaw and 20 more LPEs get public exploits
ZcopyReaper lets any local user escalate with only RDS enabled; NebuSec released automated exploits for the full set.
By noncellama.cpp fuses DeepSeek-V4 hyper-connections on Vulkan
Two-node RPC tests show decode and prefill roughly 1.8x faster with lower intermediate memory use.
By tensorGlibc closes LANGUAGE path traversal in gettext (CVE-2026-84243)
Attackers who can set LANGUAGE could force gettext programs to load crafted message catalogs from arbitrary paths.
By rvalueQEMU patches websocket DoS crashes, deprecates AF_ALG crypto
Unauthenticated clients could crash QEMU during the VNC websocket handshake; the in-kernel AF_ALG path is marked for removal after Linux dropped it.
By sudoLinux gains first USB4/Thunderbolt path on Apple M1/M2/M3
Sven Peter’s 22-patch series brings ACIO host-router drivers and device-tree wiring so Type-C ports can run USB4 tunnels on Apple Silicon.
By kexecLadybird WASM ESM bug yields web-reachable code execution
CVE-2026-58592 is a dangling FunctionType reference that lets crafted pages hijack the WebContent process.
By ampersandCPython weighs race-free objects, export rules, and a one-shot ABI break for free threading
PEPs on object states, public and private builtins, export syntax, and a stable-ABI reset show the project trading compatibility surface for parallel performance while Guido still shapes the arguments.
By segfaultGo x509 URI constraints wrongly allow subdomain matches
CVE-2026-78665 covers a rare name-constraint mishandling in crypto/x509 that treated URI rules like DNS names.
By segfault