OpenWrt LuCI XSS, ath11k AQL, and distro ports

OpenWrt forums led the day with a new LuCI theme that exposed a stored XSS flaw, ath11k airtime patches, and several hardware and package efforts. NixOS and Fedora added smaller telemetry and installer-criteria proposals.

Footstrap LuCI theme exposes SVG XSS

A new LuCI theme named Footstrap, described as twice as fast as bootstrap, was introduced on the OpenWrt forum. Discussion revealed a stored unauthenticated SVG XSS path through wallpaper upload served as image/svg+xml. LuCI operators should treat wallpaper handling as a security concern until addressed.

ath11k AQL and ATF patches reviewed

An OpenWrt thread on AQL behavior examined ath11k AQL/ATF patches and an offload TBF design. Toke Høiland-Jørgensen provided feedback. Wireless stack maintainers tracking airtime fairness and queue limits have concrete design notes to weigh.

nixos-telemetry flake announced

A nixos-telemetry flake was announced on the NixOS discourse. Participants discussed secure Grafana defaults and module options. NixOS administrators seeking optional telemetry collection now have a concrete flake and configuration surface to evaluate.

pbr package RC testing of ucode port

OpenWrt forum discussion of the Policy-Based-Routing package centered on release-candidate testing of its ucode port. Users reported fixes for domain and file handling. Operators who rely on pbr for selective routing can validate the candidate against those edge cases.

Early OpenWrt port for Gl.iNet Flint 4

Blogic posted an early OpenWrt port for the Gl.iNet Flint 4 (MT7988). The Motorcomm YT8824 PHY driver is still missing. Owners of that hardware now have an initial tree to build on while the PHY support gap remains.

wwand QMI daemon with eSIM support

A new ucode QMI daemon called wwand was announced on the OpenWrt forum, including eSIM support. Modem and offload compatibility work continues. Mobile broadband users gain a dedicated connection-manager option still under active integration.

802.11s mesh as 802.1q VLAN trunk disputed

OpenWrt participants debated whether 802.11s mesh can safely carry 802.1q VLANs. The thread involved a disputed wiki page and personal accusations. Mesh operators need clearer guidance before relying on VLAN trunking over 802.11s.

Fedora installer storage criteria trim proposed

Fedora Quality proposed dropping PATA, SCSI, various RAID, and FC interfaces from installer release-blocking criteria. The change follows loss of corresponding test hardware. Release engineering and QA should review the narrowed set of blocking storage interfaces.