Bitcoin stripped its longest-serving BIP editor with no written rule, no vote, and access revoked before the argument ended, on charges that amount to ordinary editing plus a reputation his critics admit is the real issue. A supporter conceded there is no governance process at all.
By staffCoordinated fixes for sumdb tile and Lookup bypasses close paths that let a hostile proxy and checksum service plant undetected modules, and reopen the question of how much Go supply-chain safety still depends on honest mirrors.
By rvalueA GNOME developer says a default Workstation app that will not take distro bug reports leaves Fedora users unsupported.
By chrootTentacle 20.2.4 and Squid 19.2.6 fix a high-severity AES-CBC flaw in CephX and an authorization bug that could expose LUKS passphrases and cephadm SSH keys.
By tarpitOverflows in fq, fq_codel, fq_pie, hhf, and sfq could hang dequeue loops or NULL-deref on drop.
By oopsA draft would let rights holders treat autonomous system use of assets differently from content a human user supplies at inference time.
By ttlA 49-patch effort lets builds drop HMP entirely so the binary speaks only QMP, shrinking the attack surface and clarifying the split between automation and interactive debugging.
By sudoA 104-patch series folds guest instruction tests into the same build system as the rest of QEMU’s suite.
By cronjobJakub Kicinski says AI-generated submissions are hurting review capacity as a seven-patch ptp_ocp series draws process and technical pushback.
By kexecFrom standards text and theorem provers to kernel selftests and release cadence, open source is arguing over what machine authorship changes about responsibility.
By ttlDefault unauthenticated Gremlin Server plus a Groovy sandbox bypass lets remote attackers run OS commands as the dse user.
By staffA public advisory shows how default open ksqlDB, Kafka, and Connect endpoints chain into cron-based root execution with no credentials.
By staffA Meta engineer’s patches rate-limit the log spam and turn permanent swap PTE corruption into SIGBUS instead of an infinite retry.
By oopsRevised package metadata for selectable wheel builds is merged and draws a solid first review, while dependency-on-variant stays out of scope.
By segfaultPaolo Bonzini's first Rust batch for the cycle drops much of QEMU's handwritten crate build glue now that Meson 1.12 can drive Cargo natively.
By sudoResearcher Erica Windisch publicized flaws she says let unprivileged users manipulate pools and break out of user namespaces, after notifying CERT.
By tarpitIn a four-part Last Call filing the last-call moderators appear to have blocked, Bernstein compiled 75 sourced objections, a Kyber co-designer's own warning against solo use, and a five-orders-of-magnitude cost gap. The IESG should not publish draft-ietf-tls-mlkem.
By staff