Latest threat reports & articles

lwn_kernel · tlp:amber · 6/24/2026, 1:13:54 PM

Security updates for Wednesday Security updates have been issued by AlmaLinux (corosync, firefox, kernel, kernel-rt, libpq, memcached, postgresql, postgresql16, postgresql:13, postgresql:16, python-urllib3, python3.14-urllib3, redis:6, skopeo, and vim), Debian (beets, gst-plugins-bad1.0, imagemagick, libmatio, python-urllib3, and u-boot), Fedora (chromium, coturn, frr, grout, materialx, perl-Crypt-DSA, and yt-dlp), Mageia (opensc, perl-Archive-Tar, and podofo), Oracle (fence…

lwn_kernel · tlp:amber · 6/23/2026, 3:53:01 PM

[$] KASAN for JIT-compiled BPF code Alexis Lothoré has been working to add support for the kernel's memory-access checker, KASAN , to just-in-time-compiled BPF code. He spoke about that work at the 2026 Linux Storage, Filesystem, Memory-Management, and BPF Summit . KASAN support is needed, he said, to help catch bugs in the BPF just-in-time (JIT) compiler. KASAN is a great tool for catching memory-management problems in the kernel, but only in code that can be monitored by i…

lwn_kernel · tlp:amber · 6/23/2026, 1:56:01 PM

Sunsetting Tor 0.4.8 The Tor Project has announced that it is planning to actively stop supporting Tor 0.4.8 and earlier C Tor versions soon. Usually, we try not to break existing releases, even if they are unsupported, unless we have a pretty good reason. In this case, we have several reasons. [...] The most important reason is this: in 0.4.9, we have made some former fields in our directory data obsolete -- specifically, TAP onion keys and family lines . Removing these fie…

lwn_kernel · tlp:amber · 6/23/2026, 1:09:28 PM

Security updates for Tuesday Security updates have been issued by Debian (ffmpeg), Fedora (erlang, ffmpeg, prometheus, python-scrapy, python3-docs, python3.14, thorvg, tigervnc, and vips), Mageia (mumble and sslh), Oracle (389-ds:1.4, dracut, firefox, hplip, kernel, openssh, postgresql:15, redis:6, and uek-kernel), Red Hat (delve, gvisor-tap-vsock, nginx, nginx:1.24, nginx:1.26, osbuild-composer, podman, rhc, skopeo, and yggdrasil), SUSE (containerized-data-importer, graphit…

lwn_kernel · tlp:amber · 6/22/2026, 8:25:07 PM

GIMP 0.54.1 in a Flatpak The GIMP project reports that GNOME contributor "balooii" has worked to package GIMP 0.54.1—released in 1996—as a Flatpak that will build and run on modern 64-bit Linux systems. This is a Motif -based version, and the same version that was used by Larry Ewing to create Tux. While not likely to be useful for serious graphics work today, it should be interesting for users who would like to see what a 30-year-old version of GIMP was capable …

lwn_kernel · tlp:amber · 6/22/2026, 3:26:54 PM

[$] Free-threaded Python: past, present, and future Probably the biggest change for Python over the last five years or so is the advent of the "free-threaded" version of the language, which removes the global interpreter lock (GIL) and allows multiple threads to run in parallel in the interpreter. At PyCon US 2026 , held in Long Beach, California in mid-May, longtime CPython core developer (and current steering council member) Thomas Wouters gave a talk about the feature. He…

lwn_kernel · tlp:amber · 6/22/2026, 1:44:52 PM

First preview release of Xfce's Wayland compositor Brian Tarricone has announced the first preview release of xfwl4, a Wayland compositor for the Xfce desktop environment. After close to six months of work, I feel like it's ready to get some wider use, even though of course there will be bugs and missing features. Think of this as an alpha release. [...] The end goal of xfwl4 is to behave as closely as possible to an Xfce desktop running on an X server. Ideally a user could …

lwn_kernel · tlp:amber · 6/22/2026, 1:26:14 PM

[$] Reports from OSPM 2026, day one The Power Management and Scheduling in the Linux Kernel Summit , which still goes by the historical acronym OSPM, was held in Cambridge, UK, in mid-April. As has become traditional, the presenters at that event have since written summaries of their sessions, and this work has kindly been made available to LWN for publication. The first day's sessions covered a wide range of topics, including idle-state selection, user-space schedulers with…

lwn_kernel · tlp:amber · 6/22/2026, 1:06:55 PM

Security updates for Monday Security updates have been issued by AlmaLinux (389-ds:1.4, kernel, and kernel-rt), Debian (gst-libav1.0, gst-plugins-good1.0, imagemagick, kernel, libconfig-inifiles-perl, libgd-perl, libhttp-daemon-perl, mediawiki, pillow, and squid), Fedora (389-ds-base, alertmanager, ansible-core, buildah, chromium, erlang-cowboy, erlang-cowlib, erlang-gun, freerdp, kubernetes1.33, kubernetes1.34, kubernetes1.35, mingw-SDL2_image, ongres-scram, ongres-stringpr…

lwn_kernel · tlp:amber · 6/19/2026, 6:56:33 PM

Systemd v261 released Systemd v261 has been released with a long list of changes, including a new cloud "Instance Metadata Service" (IMDS) subsystem, "boot secret" functionality for use on systems that lack a physical TPM, as well as support for the kernel's Live Update Orchestration (LUO) / Kexec Handover (KHO) systems when they are present and enabled. See the release notes for the full list of changes. Systemd v261 released [LWN.net] LWN .net News from the source Content…

lwn_kernel · tlp:amber · 6/19/2026, 3:55:23 PM

[$] Suspending and resuming BPF programs BPF programs can be used to extend many aspects the Linux kernel, but BPF programs must run to completion in the same context that they began. Kumar Kartikeya Dwivedi is working on changing that by allowing BPF programs to be expressed as coroutines. He spoke about his work at the 2026 Linux Storage, Filesystem, Memory-Management and BPF Summit . While still experimental, the change promises to make long-running BPF tasks significantl…

lwn_kernel · tlp:amber · 6/19/2026, 2:40:59 PM

[$] AURpocalypse now: a look at the recent AUR attacks The Arch User Repository (AUR) has been subjected to a sustained attack recently. The attacker, or attackers, have spun up a series of new accounts then used them to adopt orphaned packages and push malicious updates that would install malware on users' systems. It is unclear how many users were compromised in the attack, but the maintainers were playing Whac-A-Mole for several days to respond to each newly compromised p…

lwn_kernel · tlp:amber · 6/19/2026, 1:24:01 PM

Security updates for Friday Security updates have been issued by AlmaLinux (dracut), Debian (chromium, firefox-esr, and thunderbird), Fedora (chromium, firefox, nss, ocserv, ongres-scram, ongres-stringprep, perl-Archive-Tar, perl-GD, perl-HTTP-Daemon, perl-Net-Statsd, restic, singularity-ce, util-linux, and vorbis-tools), Mageia (gstreamer1.0-*, libupnp, luajit, opensc, and ruby-rack), SUSE (curl, dnsmasq, ffmpeg-4, frr, google-osconfig-agent, java-1_8_0-ibm, kernel, krb5, k…

lwn_kernel · tlp:amber · 6/19/2026, 12:34:38 PM

Eight new stable kernels for Friday Greg Kroah-Hartman has announced the release of the 7.1.1 , 7.0.13 , 6.18.36 , 6.12.94 , 6.6.143 , 6.1.176 , 5.15.210 , and 5.10.259 stable kernels. As usual, each contains important fixes. Users are advised to upgrade. Eight new stable kernels for Friday [LWN.net] LWN .net News from the source Content Weekly Edition Archives Search Kernel Security Events calendar Unread comments LWN FAQ Write for us User: Password: | | Log in / Subscribe…

lwn_kernel · tlp:amber · 6/18/2026, 4:00:37 PM

The Software Freedom Conservancy's LLM-backed generative AI recommendations The Software Freedom Conservancy (SFC) has announced the release of its recommendations for using LLM-backed generative AI systems for FOSS contributions . The recommendations were created by the SFC and volunteers from the free-software community. The recommendations reflect the extremely difficult dilemmas that these systems pose for FOSS contributors. SFC and its volunteers understand that FOSS de…

lwn_kernel · tlp:amber · 6/18/2026, 1:47:49 PM

[$] The first half of the 7.2 merge window The 7.2 merge window started with the 7.1 kernel release on June 14. As of this writing, just over 7,000 non-merge changesets have been pulled into the mainline for the next kernel release. Many of the core subsystems have been pulled at this point, meaning that most of the changes that can be expected in 7.2 have now come into focus.

lwn_kernel · tlp:amber · 6/18/2026, 1:28:00 PM

Mastodon 4.6 released Version 4.6 of the Mastodon fediverse platform has been released. The headliner of this release is Collections, a way to create and share curated collections of profiles. Part of Mastodon's work ethos is our commitment to trust and safety, so we've put a lot of thought and care into the design of this feature to avoid some of the pitfalls and abuse people have experienced with similar features on other platforms, while focusing on its primary goal: Help…

lwn_kernel · tlp:amber · 6/18/2026, 1:25:34 PM

[$] Single-hop block replication with RMR and BRMR How can cloud providers efficiently supply durable virtual block devices? Remote Direct Memory Access (RDMA) provides a way for servers in a cluster to share chunks of memory, but there still needs to be a protocol that operates on top of RDMA to provide the guarantees expected of a block device. The kernel's RDMA transport library (RTRS) provides a way to send messages via RDMA. I presented about two new components built on…

lwn_kernel · tlp:amber · 6/18/2026, 1:16:11 PM

Security updates for Thursday Security updates have been issued by AlmaLinux (dracut, podman, postfix, rsync, xorg-x11-server, and xorg-x11-server-Xwayland), Debian (atril, firefox-esr, and nginx), Mageia (libcap, perl, and python-pillow), Oracle (firefox, gstreamer-plugins-base and gstreamer-plugins-good, httpd:2.4, kernel, libpng12, libpng15, libxml2, libxslt, opencryptoki, openssl, postfix, rsync, webkit2gtk3, xorg-x11-server, and xorg-x11-server-Xwayland), Slackware (bin…

lwn_kernel · tlp:amber · 6/18/2026, 12:55:14 AM

[$] LWN.net Weekly Edition for June 18, 2026 Inside this week's LWN.net Weekly Edition: Front : State of Fedora; mTHP creation; overlayfs; buffer-heads cleanup; 7.1 statistics. Briefs : curl summer of bliss; 7.1 kernel; AUR compromise; Fedora election; FairScan 2.0; Firefox 152.0; Homebrew 6.0.0; KDE Plasma 6.7; LWN topic list; Quotes; ... Announcements : Newsletters, conferences, security updates, patches, and more.

lwn_kernel · tlp:amber · 6/17/2026, 3:50:07 PM

Fedora F44 election results The results are in for Fedora's F44 election cycle for seats on the Fedora Council , Fedora Engineering Steering Committee , Fedora Mindshare Committee , and EPEL Steering Committee . Miro Hrončok and Aleksandra Fedorova have won seats on the council. Neal Gompa, Fabio Valentini, Michel Lind, Maxwell G, and Simon de Vlieger have been elected to FESCo. Samyak Jain, Akashdeep Dhar, Luis Bazan, and Mat Holmes have all been elected to the Mindshare Co…

lwn_kernel · tlp:amber · 6/17/2026, 3:30:12 PM

Everything security at PyCon US 2026 The Python Software Foundation blog has a post with a summary of the security-related content at PyCon US 2026 with links to slides from important sessions. The recordings will be published to the PyCon US channel on YouTube, and the post will be updated with links to those videos as they are made available. Everything security at PyCon US 2026 [LWN.net] LWN .net News from the source Content Weekly Edition Archives Search Kernel Security…

lwn_kernel · tlp:amber · 6/17/2026, 2:05:04 PM

[$] Some buffer-heads cleanup work Jan Kara has been working on cleaning up how buffer heads are used by some kernel filesystems. In a short filesystem-track session at the 2026 Linux Storage, Filesystem, Memory Management, and BPF Summit , he gave an update on that work and where it is headed. Topics included generic infrastructure to track buffer heads for metadata, a buffer-head cleanup for the Amiga filesystem, and some planned locking fixes.

lwn_kernel · tlp:amber · 6/17/2026, 1:26:41 PM

FairScan 2.0 released Version 2.0 of the FairScan document-scanning app for Android has been released. The headline feature for this release is the addition of optical-character-recognition (OCR) support using Tesseract to produce PDFs with searchable text from scans. FairScan developer Pierre-Yves Nicolas has written a detailed blog about adding the feature and explaining why it had not been added previously. That looks nice, so why didn't FairScan have it before? That's be…

lwn_kernel · tlp:amber · 6/17/2026, 1:25:51 PM

Security updates for Wednesday Security updates have been issued by AlmaLinux (hplip, kernel, kernel-rt, libpng12, libpng15, libxml2, libxslt, mysql:8.0, mysql:8.4, opencryptoki, openssl, postfix, postgresql:15, rsync, and webkit2gtk3), Debian (asterisk, atril, gsasl, and libreoffice), Fedora (ack, bird, chromium, firefox, ldns, librabbitmq, nextcloud, nss, openslide, perl-Protocol-HTTP2, tig, vorbis-tools, and xen), Mageia (coturn, log4cxx, and python-tornado), SUSE (389-ds…

lwn_kernel · tlp:amber · 6/16/2026, 5:22:38 PM

The LWN public topics list Part of running LWN is keeping a list of potentially interesting topics that may merit the effort to turn into articles. As an experiment, we are now exposing that list to our subscribers at the Project Leader and Supporter levels. The hope is that this list will provide useful insights into what is on our radar and which might be coming to LWN in the near future. With this feature, we hope to give our most committed subscribers a look behind the c…

lwn_kernel · tlp:amber · 6/16/2026, 3:31:20 PM

[$] The state of Fedora in 2026 On June 15 at Fedora's Flock conference, held in Prague, Fedora Project Leader (FPL) Jef Spaleta delivered a short "State of Fedora" keynote that provided a bit of insight into the status of the project. Topics included the overall growth for Fedora usage, ways to increase contributions, and an alarming decline in the number of active packagers working on the project.

lwn_kernel · tlp:amber · 6/16/2026, 2:18:07 PM

Firefox 152.0 released Version 152.0 of the Firefox web browser has been released. Notable changes in this release include a brand-new look for the Firefox Settings interface, the ability to disable tracker blocking in private browsing tabs, a feature to mute browser sound from the address bar, experimental support for the JPEG XL image format, and more. Firefox 152.0 released [LWN.net] LWN .net News from the source Content Weekly Edition Archives Search Kernel Security Eve…

lwn_kernel · tlp:amber · 6/16/2026, 1:22:04 PM

KDE Plasma 6.7 released Version 6.7 of KDE's Plasma desktop has been released. Notable changes in this release include per-screen virtual desktops, faster desktop switching, introduction of the Union theming system as a tech preview, as well as many other improvements and bug fixes. The release is dedicated to Eric Laffoon, a longtime KDE supporter, who passed away in May. See the KDE wiki for a full list of new features, and the Changelog for a list of all commits in this r…

lwn_kernel · tlp:amber · 6/16/2026, 1:05:20 PM

Security updates for Tuesday Security updates have been issued by AlmaLinux (mod_http2, postfix, and webkit2gtk3), Debian (bird2, libgd-perl, and libreoffice), Fedora (7zip, ack, hugo, and perl-Mojo-JWT), Mageia (atril, evince, xreader, emacs, lcms2, libgcrypt, libinput, libsndfile, putty, and sudo), Red Hat (openssl and osbuild-composer), SUSE (cheat, chromedriver, containerized-data-importer, cyrus-imapd, freeipmi, graphicsmagick, java-11-openj9, java-17-openj9, kitty, kub…

lwn_kernel · tlp:amber · 6/15/2026, 4:36:39 PM

[$] Development statistics for the 7.1 kernel Linus Torvalds released the 7.1 kernel as expected on June 14. This development cycle brought in a lot of new features — and a lot of new developers as well. The time has come for our traditional look at where the changes in 7.1 came from, with a digression into how our community may be changing in general.

lwn_kernel · tlp:amber · 6/15/2026, 1:32:22 PM

Stenberg: curl summer of bliss Daniel Stenberg has announced that curl will not be accepting vulnerability reports from July 1 through August 3, unless the submitter has a paid support contract. He is calling it the "curl summer of bliss". As previously mentioned, we have been under a huge pressure for the last four months or so. Now we need some rest. We do not expect this deluge to be over. [...] If you and your Open Source projects also want to participate in th…

lwn_kernel · tlp:amber · 6/15/2026, 1:04:38 PM

Security updates for Monday Security updates have been issued by AlmaLinux (.NET 9.0), Debian (apache2, chromium, jpeg-xl, librabbitmq, and openssl), Fedora (apptainer, bind9-next, chezmoi, chromium, collectd, composer, dnsdist, gh, python-django5, python-python-multipart, varnish, varnish-modules, vmod-querystring, vmod-uuid, weasyprint, and xorg-x11-server-Xwayland), Mageia (cups, expat, libpng, libssh, memcached, nghttp2, openimageio, packages, proftpd, and radare2), Orac…

lwn_kernel · tlp:amber · 6/14/2026, 6:47:53 PM

The 7.1 kernel has been released Linus has released the 7.1 kernel . " So it's only Sunday morning back home, but it's Sunday afternoon where I am right now, so I'm doing the 7.1 release at the regular time - just not in the regular timezone. " Significant changes in 7.1 include the removal of support for some old 486-based architectures, some new clone() flags making process management easier, BPF support for io_uring, zero-copy-I/O support for the ublk user-space block dri…

lwn_kernel · tlp:amber · 6/12/2026, 7:38:09 PM

[$] An overlayfs update In a shortened session in the filesystem track at the 2026 Linux Storage, Filesystem, Memory Management, and BPF Summit , Amir Goldstein gave an update on the overlayfs union filesystem . There are some new features over the last few years that he wanted to mention, along with looking at the status of nesting overlayfs layers. The composefs use case that was discussed at the summit in 2023 has led to some interesting changes to overlayfs.

lwn_kernel · tlp:amber · 6/12/2026, 1:41:22 PM

Hundreds of AUR packages compromised Hundreds of orphaned packages hosted by the Arch User Repository (AUR) have been compromised by an attacker who has added a malicious npm package ( atomic-lockfile ) that can exfiltrate sensitive data. The project is currently working on cleaning up the mess. There is a list of affected packages and post (possibly NSFW domain) by "sodiboo" with additional information. Arch Linux users (or users of Arch-based distributions) that use AUR pa…

lwn_kernel · tlp:amber · 6/12/2026, 1:12:50 PM

Security updates for Friday Security updates have been issued by AlmaLinux (.NET 10.0, .NET 8.0, .NET 9.0, bind, expat, httpd:2.4, kernel, kernel-rt, mod_http2, openssl, poppler, redis, redis:7, samba, and unbound), Debian (ironic, kernel-wedge, libinput, linux-base, and neutron), Fedora (kernel, openssl, vaultwarden, and vaultwarden-web), Mageia (erlang-hex_core, erlang-rebar3, gnupg2, and sqlite3), Red Hat (buildah, podman, and skopeo), SUSE (flannel, gdk-pixbuf-loader-lib…

lwn_kernel · tlp:amber · 6/11/2026, 2:49:37 PM

Homebrew 6.0.0 released Version 6.0.0 of the Homebrew package-management system has been released. Notable changes in this release include the introduction of tap trust to improve supply-chain security, improvements in sandboxing on Linux, a number of performance tweaks, and many other changes. See the changelog for a full list. LWN covered Homebrew in November 2025. Homebrew 6.0.0 released [LWN.net] LWN .net News from the source Content Weekly Edition Archives Search Kerne…