LWN.net

The 7.4 merge window, which closed on November 1, included a record-breaking 18,591 non-merge changesets. That is almost as many as the entire 7.3 development cycle, which had 18,765, itself a record breaker. Of those, 11,838 landed after the article covering the first part of the merge window . Most of those were bug fixes of various forms; it seems as though bug fixes may be crowding out feature additions across the open-source ecosystem to some extent. Still, a good number of new features we…

The Google Threat Intelligence blog describes, in great detail , the XCPE botnet, which has just been taken down. Last week, Google and industry partners dismantled the XCPE backdoor which enrolled more than 1.3 million set-top boxes into a botnet. We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co., an Android Original Equipment Manufacturer (OEM) and Original Device Manufacturer (ODM)…

We recently looked at how the kernel community is dealing with the firehose of vulnerability reports, but said little about how users of the kernel are responding. At the 2026 Linux Plumbers Conference , Amazon employees Dylan Johnson and Justinien Bouron discussed the problem from the point of view of engineers trying to keep AWS running and secure in the face of a storm of CVE disclosures. The kernel community's longstanding advice is to run current kernels, and that turns out to work — sort …

Version 16.0 of the Tor Browser has been released. This is the first stable version based on Firefox ESR 153. Notable changes in this release include support for Linux on 64-bit Arm, redesigned settings, and a "generic window titles" feature to help prevent other applications from snooping on one's browser activity. Tor Browser for Android has had a number of interface updates to Google's Material Design 3 design language. This release also follows Firefox in ending support for 32-bit x86 Linux…

Security updates have been issued by AlmaLinux (firefox, java-17-openjdk, kernel, kernel-rt, mariadb:10.5, podman, python-jwt, python27:2.7, python38:3.8 and python38-devel:3.8, python39:3.9 and python39-devel:3.9, ruby:2.5, ruby:2.7, thunderbird, util-linux, and virt:rhel and virt-devel:rhel), Debian (chromium, eog, imagemagick, python-aiohttp, thunderbird, and vim), Fedora (asciinema, atuin, btrfs-backup-ng, clevis, gcc, janus, kernel, libheif, libreswan, mingw-expat, mupdf, nautilus, nicotin…

The 7.4-rc1 kernel prepatch is out, and the merge window is closed for this development cycle. This is a *BIG* merge window. I think the reason is the by now obvious one, but I'm actually taking it as a good sign: I'm *much* happier with the flood of AI triggered work going into the merge window than it showing up mainly as extra fixes during the -rc period. So I'm hoping that this merge window being larger than usual is a sign that the AI fixes are becoming more part of the "normal development…

Greg Kroah-Hartman has announced the release of the 7.2.15 kernel, with a handful of updates. Note, this is the LAST 7.2.y kernel release. After this one the 7.2.y kernel tree is end-of-life. Please move to 7.3.y at this time. And yes, you aren't imagining things, this one went "end-of-life" a bit sooner than normal. But based on the release cycle at the moment, and the number of pending cc: stable patches in the queue, I figured it was better this way so we can focus on the latest 7.3.y releas…

Security updates have been issued by AlmaLinux (.NET 10.0, .NET 11.0, .NET 8.0, .NET 9.0, aspell, bind, bind9.18, container-tools:1.0, container-tools:rhel8, curl, dogtag-pki, ignition, java-21-openjdk, python-pillow, tomcat, and virt:rhel, virt-devel:rhel), Debian (antiword, cyrus-sasl2, dovecot, dpdk, nss, python-git, and thunderbird), Fedora (7zip, aegisub, aom, apptainer, arm-none-eabi-binutils-cs, assimp, avr-binutils, baresip, barman, bind9-next, btrfs-backup-ng, chezmoi, chromium, cifs-u…

The Hacktron blog documents how the group was able to compromise the GNU Savannah forge and could have pushed malware into any of the projects hosted there. Using Hacktron, we found that an email address like `touch${IFS}/tmp/savane-rce-proof`@attacker.example gave any registered user code execution on its backend. From there, we made our account a superuser, impersonated Bash's maintainer, and confirmed we could add an SSH key with push access to the upstream Bash repository. An unpatched kern…

The final talk at Kangrejos 2026 was about the removal of the C implementation of Android's Binder driver , the primary interprocess communication mechanism used on Android devices. Carlos Llamas announced that he had deleted the C code to general applause, and then shared some insights about what went into replacing the C implementation. Alice Ryhl, who has worked on the Rust implementation for some years, added her own thoughts about what the most difficult and interesting parts of the transi…

PostgreSQL developer Robert Haas writes about the struggles the project has encountered in putting together its next release. In the end, I don't think that the delay in shipping PostgreSQL 19 is particularly concerning. It is not a long delay in the grand scheme of things, and it emerges directly from the project's concern for quality. The long-term picture is less clear and in some ways more troubling: given that we have forty years of bugs that humans were unable to find but LLMs are quite c…

On October 27, LLM provider Anthropic reported on a remotely exploitable use-after-free bug affecting systems with multipath TCP listeners open. The bug works by triggering a response to a retransmitted SYN packet at the same moment that the TCP connection is established in another thread, causing the first thread to access the connection's options structure after the second thread has freed it. The first thread can then disclose kernel memory or cause a buffer overflow, writing an attacker-con…

In a followup to his session at the 2025 Linux Plumbers Conference (LPC), Carlos O'Donell returned to the topic of system-call wrappers for the GNU C library (glibc) at this year's event. This time around, he was joined by Florian Weimer, who is another glibc maintainer. The idea was to give an update on what has happened over the last year with regard to Linux system calls that lack a glibc wrapper, thus are only accessible via syscall() . In addition, they wanted to hear from attendees about …

Greg Kroah-Hartman has announced the release of the 7.3.1 , 7.2.14 , 6.18.60 , 6.12.115 , 6.6.161 , 6.1.191 , 5.15.224 , and 5.10.273 stable kernels. As usual, he advises all users to update—advice that seems especially wise given the increased number of security-relevant bug fixes that the kernel is seeing these days. [Edit: the 7.2.15 stable release is already in review as well.]

Security updates have been issued by AlmaLinux (aspell, cjose, curl, gcc-toolset-15-gcc, httpd:2.4, ignition, java-21-openjdk, libX11, libXi, libXrender, libXtst, mariadb:10.11, nodejs:24, python-pillow, python3.12-urllib3, and webkit2gtk3), Debian (imagemagick, libdatetime-timezone-perl, python-git, tor, tzdata, vlc, and wordpress), Fedora (accessibility-inspector, akonadi-calendar, akonadi-calendar-tools, akonadi-contacts, akonadi-import-wizard, akonadi-mime, akonadi-search, akonadi-server, a…