OpenWrt NSS offload, LuCI XSS, Fedora kernel and Nix notes

OpenWrt contributors advanced IPQ5018 hardware offload on kernel 6.18 and exposed a LuCI stored XSS path, while Fedora users confirmed an AMD black-screen regression and NixOS threads pressed flake input hygiene plus Dynamic Derivations coordination. Security bug visibility and governance drafts also moved on Fedora.

NSS offload for IPQ5018 on kernel 6.18

Working NSS offload for IPQ5018 NAT now runs against the upstream stmmac ethernet stack on kernel 6.18, with public branches and functional reports on multiple boards including the GL-B3000. OpenWrt developers are driving the integration. The result gives high-throughput NAT on these SoCs without remaining tied to proprietary offload paths.

Stored XSS revealed in LuCI theme discussion

A thread presenting Footstrap, a new LuCI theme described as twice as fast as bootstrap, surfaced a stored unauthenticated SVG XSS via wallpaper upload served as image/svg+xml. Forum participants identified the flaw while reviewing the theme. LuCI theme authors and OpenWrt operators must treat wallpaper handling as an untrusted input boundary.

Fedora 7.2.5 black screen on AMD APUs

Multiple users confirmed a black-screen boot regression with Fedora kernel 7.2.5 on AMD APUs under KDE, while 7.2.4 continues to boot normally. Reports accumulated on the Fedora discussion forum. Affected Fedora 44 systems may need to remain on the prior kernel until a fix appears.

Prefer nixos.org tarballs for flake inputs

A public service announcement urged Nix flake users to pull inputs from official channels.nixos.org tarballs instead of GitHub. The change yields smaller downloads and reduces forge dependency. Twenty-one participants discussed the practical trade-offs for everyday flake consumers.

Dynamic Derivations working group proposed

A Nix contributor called for a working group to coordinate Dynamic Derivations experiments, UX refinement, and supporting infrastructure. Eleven participants joined the thread. Structured next steps would shape how Nix evolves dynamic build graphs.

Thousands of Fedora security bugs turned private

More than 2,300 Fedora and EPEL security tracking bugs switched to private status on bugzilla.redhat.com around 2026-09-07 and 08 with no explanation supplied. Only two participants noted the change. Package maintainers and external trackers lose public visibility into those issues.

Fedora conflict-of-interest policy draft

The Fedora Council published a draft conflict-of-interest policy and invited feedback on scope, necessity, and GDPR implications. Twelve participants responded. Clearer rules would govern how contributors declare and manage competing interests.

LuCI dashboard modernization pull request

A contributor opened a pull request for luci-mod-dashboard, an AI-redesigned LuCI dashboard that adds charts. Feedback centered on keeping visual style consistent with existing components. The rewrite targets a more modern administration interface for OpenWrt devices.