Post Syndicated from jzb original https://lwn.net/Articles/1100612/

Inside this week’s LWN.net Weekly Edition:

• Front: Android vendor hooks; Reproducible builds and kernel integrity; Rust data structures; NFS server changes; Setting no_new_privs for PID 1; Rust XArray; Rust cross-crate declarations; 7.3 statistics; Nix flakes.
• Briefs: eMudhra CA compromise; PHP RCEs; Node.js and musl vulnerabilities; GNOME OS; OpenBSD 8.0; Ubuntu 26.10; TAB results; Quotes; …
• Announcements: Newsletters, conferences, security updates, patches, and more.

Post Syndicated from jzb original https://lwn.net/Articles/1094226/

Nix flakes are an
experimental feature of the Nix package-management
tool designed to build projects in a more self-contained and reproducible
way. Despite the feature’s experimental status, it has become increasingly
popular for open-source projects to publish flake.nix files that offer
predefined development environments and build automation even when those
repositories may not offer an upstream package or module for the NixOS Linux distribution. Although
Nix flakes have a complicated history, and the path for stabilization is
uncertain, flakes can provide useful capabilities for projects that choose to
include them.

Post Syndicated from jzb original https://lwn.net/Articles/1102014/

The PHP project has published PHP
versions 8.5.12,
8.4.27, 8.3.36 and 8.2.35 to address
two critical vulnerabilities that could allow unauthenticated remote code
execution.

Who is at risk: all PHP installations serving web requests,
including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We
consider the risk highest for mod_php, with a demonstrated exploit where an
unauthenticated request can trigger the attack before any application code
runs.

The vulnerabilities:

• RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory
  handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
• RCE via stale global state, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): request-owned
  internal state can survive after its backing memory has been freed. A later
  request handled by the same worker may use that stale state before normal
  initialization resets it.

PHP versions older than 8.1 will not receive updates from the project, though
the project has provided some patches for PHP
7.4, PHP
8.0, and PHP
8.1 to assist in creating backports. According to the
announcement, Linux distributions and vendors received patches in advance, so
updated packages should be coming soon.

Post Syndicated from jzb original https://lwn.net/Articles/1101758/

Greg Kroah-Hartman has announced the release of the 7.2.12,
6.18.58,
6.12.114, and
6.6.160 stable kernels. Each contains a number
of important fixes; users are advised to upgrade.

Post Syndicated from jzb original https://lwn.net/Articles/1102005/

Security updates have been issued by AlmaLinux (bubblewrap, emacs, gimp:2.8, glibc, jackson-databind, kernel, kernel-rt, librabbitmq, openexr, openssh, postgresql:16, postgresql:18, python3, resteasy, wireshark, xorg-x11-server, and xorg-x11-server-Xwayland), Debian (ca-certificates, firefox-esr, git-lfs, and libssh), Fedora (aom, assimp, bind, bind-dyndb-ldap, freerdp, ghostscript, gopass, gopass-jsonapi, ImageMagick, libpng12, libpng15, nebula, perl-GD-SecurityImage, perl-Net-IDN-Encode, perl-Net-Whois-Raw, rust-backtrace, rust-object, rust-object0.37, rust-object0.38, rust-object0.39, rust-ruzstd, and xen), Gentoo (ca-certificates), Mageia (x11-server, x11-server-wayland, tigervnc), Oracle (bubblewrap, ca-certificates, emacs, fetchmail, gimp:2.8, hostapd, jackson-databind, librabbitmq, lrzsz, openexr, openssh, openssl, postgresql:18, python-urllib3, python3, python3.12-urllib3, resteasy, webkit2gtk3, wireshark, and xorg-x11-server-Xwayland), Red Hat (.NET 8.0, dogtag-pki, flatpak-builder, ghostscript, glycin-loaders, go-toolset:rhel8, golang, gvfs, jackson-core, jackson-databind, librsvg2, multiple packages, pki-core, pki-core:10.6, sudo, xorg-x11-server, and xorg-x11-server-Xwayland), Slackware (c-ares, ca-certificates, mozilla-firefox, mozilla-nss, mozilla-thunderbird, and python-certifi), SUSE (agama, aspell, bcel, bind, bouncycastle, busybox, chromium, containerd, coredns, cosign, cpp15, cups-filters, cyrus-sasl, fetchmail, firefox, gcc13, gh, ghostscript, gitoxide, glibc, go1.26, go1.27, google-osconfig-agent, grafana, grok-build, hashcat, hawk2, helm, ImageMagick, inspektor-gadget, iperf, jupyter-jupyterlab-templates, kernel, kernel-devel, libheif, libpng16, librsvg, libX11, libXi, libxls, libXpm, libxreaderdocument3, mutt, ntfs-3g_ntfsprogs, openssl-1_0_0, openssl-3, openvpn, pacemaker, perl-DBI, perl-XS-Parse-Keyword, pgvector, podman, putty, python-anyio, python-hpack, python-joserfc, python-jwcrypto, python-oauthlib, python-PyJWT, python-tornado6, python-urllib3, python-virtualenv, python-WebOb, python3, python311, rekor, squid, strongswan, stunnel, suseconnect-ng, tinyproxy, traefik, unbound, varnish, virtiofsd, webkit2gtk3, and xwayland), and Ubuntu (ca-certificates, dotnet8, dotnet10, dotnet11, protobuf, rust-sudo-rs, squid, squid3, and xz-utils).

Post Syndicated from jzb original https://lwn.net/Articles/1100257/

Setuid (and setgid) binaries have long been a source of headaches, and security
vulnerabilities, on Linux systems. They are largely seen as something to be
avoided; SUSE’s security team, for example, forbids
the inclusion of setuid or setgid binaries in packages unless they have been
reviewed and explicitly allowed. Thorsten Kukuk wants to go a step further and
disallow them entirely. At the 2026 All Systems Go! conference, he spoke
about his work to disable setuid system-wide, as well as some of the hurdles
that remain.

Post Syndicated from jzb original https://lwn.net/Articles/1101643/

Mozilla has announced
that it has received a report that private keys associated with eight eMudhra intermediate certificates have
been compromised:

These keys could allow attackers to issue fraudulent HTTPS certificates for
websites they do not control. An attacker who could intercept a user’s
connection could use those certificates to impersonate websites and potentially
read or modify traffic.

Mozilla has blocked the affected certificates using its OneCRL
centralized list of revoked certificates, and has updated the trusted
certificate list in Network
Security Services (NSS) 3.131.1.

There is a single-page
site about the compromise that goes into more detail. According to the site
the certificates have also been blocked in Chrome since October 17, Apple
devices since the 19th, and Microsoft blocked the certificates on the
20th. There is also a table that displays whether a browser or other client
still trusts the compromised certificates.

The NetBSD foundation has issued
instructions to block the certificates on NetBSD installations. Users of
other browsers and operating systems may wish to check for updates or guidance
to disable the compromised certificates.

Post Syndicated from jzb original https://lwn.net/Articles/1101536/

OpenBSD 8.0 has been
released. There are many new features, including the addition of hibernate
support for arm64, an increase in the kernel virtual address space for amd64 to
512GB, quite a few improvements for the qwx driver that supports
Qualcomm WiFi 6 devices, and much more. See the full changelog for
details.

Post Syndicated from jzb original https://lwn.net/Articles/1101617/

Security updates have been issued by AlmaLinux (environment-modules, kernel, pcs, perl-URI, python3.14-urllib3, and webkit2gtk3), Debian (python-django), Fedora (bind, bind-dyndb-ldap, chromium, cifs-utils, curl, haveged, python3.15, qt5-qtbase, rust-rbw, rust-routinator, rust-rustls, xorg-x11-server, and xorg-x11-server-Xwayland), Mageia (firefox, firefox-l10n, nss, flatpak-builder, imagemagick, libpng, libxi, libxpm, libxtst, openssh, postgis, and thunderbird), Oracle (emacs, environment-modules, libsoup, perl-URI, python3.14-urllib3, webkit2gtk3, and xorg-x11-server), Red Hat (go-fdo-client, go-fdo-server, golang, kernel, kernel-rt, openssh, postgresql:16, postgresql:18, and rust-sequoia-sq), SUSE (alsa, AusweisApp, chromedriver, ffmpeg-4, kubernetes, libsoup2, nvidia-open-driver-G07-signed, p11-kit, perl-Net-OAuth, perl-Net-Whois-Raw, pgvector-devel, pi-coding-agent, podman, python, python3, python3-base, python3-doc, python315, python36, thunderbird, and velociraptor), and Ubuntu (cifs-utils, curl, golang-1.22, libxtst, openssh, openssh-gssapi, and php8.5, php8.3, php8.1, php7.4, php7.2, php7.0, php5).

Post Syndicated from jzb original https://lwn.net/Articles/1101483/

Mike Rapoport has announced
the release of the video recordings from the 2026 Linux Plumbers Conference (LPC),
which was held in Prague from October 5 through October 7. Find the
complete set via the YouTube playlist
or look for the video links in the schedule. See also LWN’s
coverage
of talks from LPC.

Post Syndicated from jzb original https://lwn.net/Articles/1101421/

Security updates have been issued by AlmaLinux (idm:DL1, kernel, libsoup, perl-URI, python3.14-urllib3, and webkit2gtk3), Debian (apache2, cifs-utils, haproxy, jq, kernel, and xen), Fedora (aom, chezmoi, chromium, docker-buildx, freeipa, freerdp, GitPython, httpd, jfrog-cli, kernel, knot, libheif, log4net, mongo-c-driver, nant, NetworkManager, openssl, plasma-nm, python-cairosvg, python-django5, python-django6, qt5-qtbase, radicale, rust-faster-hex, rust-onefetch, SDL3_image, syncthing, thunderbird, tor, webkitgtk, and wordpress), Mageia (curl, libreoffice, mozjs140, mutt, nodejs-braces, parted, perl-Net-Whois-Raw, perl-XS-Parse-Keyword, and python-django), Oracle (kernel, kernel-uek, python36:3.6, and wireshark), Red Hat (gvfs, kernel, and kernel-rt), Slackware (libXtst), and SUSE (agama, ansible-core, bcel, bind, buildah, busybox, cadvisor, chromium, cosign, cups-filters, distribution-registry, fetchmail, gcc13, ghostscript, gimp, glib2, go1.26, go1.27, golang-github-lusitaniae-apache_exporter, golang-github-prometheus-alertmanager, google-osconfig-agent, grype-db, hauler, hawk2, helm, ImageMagick, iperf, kernel, libheif, libpng16, librsvg, libsoup, libsoup2, libthrift-0_25_0, libx11, libxi, libxpm, mutt, ntfs-3g_ntfsprogs, nvidia-open-driver-g07-signed, nvidia-open-driver-G07-signed-check, openssl-3, openvpn, p11-kit, pacemaker, perl-xs-parse-keyword, pgvector, php8, podman, psqlodbc, python-anyio, python-hpack, python-jwcrypto, python-oauthlib, python-pyjwt, python-tornado6, python-urllib3, python-virtualenv, python313-ruff, python313-social-auth-app-django, python313-urllib3, python313-urllib3_1, python313-validators, python313-waitress, python313-zipp, qemu, qsnapper, squid, strongswan, stunnel, swtpm, unbound, virtiofsd, webkit2gtk3, xen, and xwayland).

Post Syndicated from jzb original https://lwn.net/Articles/1101057/

The GNOME Project has provided GNOME OS for some time; until now, the
project only provided a “Nightly” edition that was built from the latest commits
and was aimed solely at GNOME developers. Adrian Vovk has now announced
the release of GNOME OS Preview, which is intended for a non-developer
audience:

GNOME OS Preview is the current GNOME OS Nightly, but without the “nightly”
aspect. Instead, it’s built from the latest stable GNOME release (GNOME 51.1, at
the time of writing). GNOME OS Preview lives in the same branches on GitLab as
the stable org.gnome.Platform Flatpak runtimes.

GNOME OS Preview is only a few weeks old, so it has only seen limited
real-life testing so far. We therefore expect people will uncover some issues
initially. That said, Preview is significantly more stable than Nightly, which
dozens of people have been daily driving without major issues for over a
year. Thus, we’re feeling confident that Preview is going to be reliable enough
for daily use by non-developer enthusiasts.

While Preview is meant for non-developers, it is not considered complete or
stable for the broader public. There are a number of features, listed in Vovk’s
post, that need to be implemented before the project is ready to declare
GNOME OS “ready for prime time“. Adventurous users, who might not
mind having to reinstall the OS once a stable version is declared, can
download and start using GNOME OS Preview today.

Post Syndicated from jzb original https://lwn.net/Articles/1101015/

Security updates have been issued by AlmaLinux (ghostscript, grafana, hplip, libsoup3, lrzsz, rpcbind, and wireshark), Debian (chromium, cifs-utils, expat, gst-plugins-bad1.0, gst-plugins-good1.0, jpeg-xl, mutt, and spip), Mageia (gpsd, libx11, and roundcubemail), Oracle (389-ds-base, compat-libtiff3, environment-modules, ghostscript, grafana, gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, hplip, idm:DL1, kernel, kernel-uek, libsoup, libsoup3, lrzsz, rpcbind, and wireshark), Red Hat (gd), SUSE (alloy, amazon-ecs-init, bind, busybox, chromium, distribution, govulncheck-vulndb, iperf, jackson-annotations, jackson-core, jackson-databind, kernel, libXtst, mutt, openssh, php8, python313-python-multipart, python313-python-rapidjson, python313-python3-saml, python313-pywbem, python313-redis, python313-reportlab, python313-requests, python313-rope, python313-rpyc, python313-rsa, qemu, swtpm, the Java stack, and wpa_supplicant), and Ubuntu (golang-1.23, linux-azure, and rabbitmq-server).

Post Syndicated from jzb original https://lwn.net/Articles/1100787/

As part of KDE’s 30th
anniversary celebration, the project has released The KDE Documentary
— A Story of Free Software Underdogs (YouTube video):

The story starts in 1996, when Matthias Ettrich, a student at the University
of Tübingen, posted to a Usenet group asking for programmers to help build a
desktop for Linux. What followed became KDE, one of the largest free software
communities in the world. KDE made Linux usable as a desktop for people who
weren’t system administrators, giving it a complete, consistent graphical
environment at a time when there was none.

The film covers the highs and lows of three decades of KDE: the Qt licensing
fight and the rivalry with GNOME; the success of KHTML, the browser engine that
became the basis of Apple’s WebKit and Google’s Chrome; and the contentious
release of KDE 4 and the rebuild that followed.

Post Syndicated from jzb original https://lwn.net/Articles/1100786/

Canonical has announced
the release of Ubuntu 26.10 (“Stonking Stingray”):

Ubuntu 26.10 advances enterprise security features, completes the rollout of
the Rust-based uutils coreutils, and strengthens integrations for user
authentication using Microsoft Entra ID.

[…] Ubuntu 26.10 also ships with GNOME 51, bringing a smoother, more
responsive desktop, better display handling, improved accessibility, and
refinements across core applications. In addition, the Ubuntu App Center now
provides a more consistent experience for managing snaps and debs.

See the release notes
for a list of new features as well as incompatible
changes between 26.10 and prior Ubuntu releases.

Post Syndicated from jzb original https://lwn.net/Articles/1100785/

Security updates have been issued by AlmaLinux (environment-modules, flatpak-builder, kernel, kernel-rt, librabbitmq, libreoffice, libsoup, mod_auth_openidc:2.3, nodejs:22, nodejs:24, OpenEXR, opentelemetry-collector, pki-core:10.6, postgresql:12, python-tornado, python36:3.6, ruby:3.3, tftp, and xorg-x11-server), Debian (buildstream, firefox-esr, mariadb, and sogo), Fedora (exim, freerdp, python3-docs, and python3.14), Mageia (drakx-installer-images, kernel, kmod-nvidia-current-wopengpu, kmod-virtualbox), Oracle (curl, emacs, environment-modules, flatpak, flatpak-builder, gd, hplip, kbd, kernel, librabbitmq, libreoffice, libxml2, microcode_ctl, mod_auth_openidc:2.3, nodejs:22, OpenEXR, pcre2, perl-DBI, python-tornado, rsyslog, tftp, thunderbird, and xorg-x11-server), Red Hat (compat-libtiff3, firefox, ghostscript, idm:DL1, ipa, kernel, kernel-rt, libtiff, lrzsz, and mariadb-connector-c), Slackware (libarchive), SUSE (amazon-cloudwatch-agent, bind, container-suseconnect, containerd, glibc, google-osconfig-agent, helm, kernel, python312, python313-oletools, python313-openpyxl, python313-orjson, python313-paramiko, python313-pipreqs, python313-py, python313-pycryptodome, python313-pycryptodomex, python313-pydrive2, python313-python-engineio, webkit2gtk3, and xorg-x11-server), and Ubuntu (apache2, bind9, bluez, curl, openssh, python-urllib3, and u-boot).

Post Syndicated from jzb original https://lwn.net/Articles/1100611/

Greg Kroah-Hartman has announced the release of the 7.2.11, 6.18.57,
6.12.113, 6.6.159, 6.1.190,
5.15.223, and 5.10.272 stable kernels. This series includes,
among other things, a fix for a
critical vulnerability (CVE-2026-99999). The
flaw in skb_checksum_help()
would allow an IPv4 packet with bad checksum metadata to “corrupt the network
header and cause a bunch of mischief” in the words of patch author Michael
S. Tsirkin. As usual, all users are advised to upgrade.

Post Syndicated from jzb original https://lwn.net/Articles/1100429/

Version 6.8 of
the KDE Plasma desktop has been
released. The The KDE project has timed the release to coincide with the 30th
anniversary of Matthias Ettrich’s email announcing the
project:

Unix popularity grows thanks to the free variants, mostly Linux. But still a
consistent, nice looking free desktop-environment is missing. There are several
nice either free or low-priced applications available, so that Linux/X11 would
almost fit everybody needs if we could offer a real GUI.

Notable changes include accessibility improvements, inclusion
of the Kup backup
tool as part of Plasma, as well as the ability to include system audio and
microphone input in Spectacle
screen recordings. Plasma 6.8 also drops support for Plasma X11 sessions, as was announced
in November 2025. X11 applications are still supported via XWayland, and KDE
applications will continue to support X11 “for the foreseeable
future“.

See the KDE wiki for a
list of major user-facing changes, and the changelog
for all changes since Plasma 6.7.5.

Post Syndicated from jzb original https://lwn.net/Articles/1100426/

Security updates have been issued by AlmaLinux (bind9.18, dovecot, flatpak, gd, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base, kernel, opentelemetry-collector, pcre2, and tftp), Debian (curl and keystone), Fedora (aegisub, arm-none-eabi-binutils-cs, avr-binutils, chromium, curl, firefox, kernel, python-jupytext, and xdg-dbus-proxy), Mageia (apache, freeciv, gnumeric, mingw-gdk-pixbuf, and patool), Red Hat (cockpit-image-builder, fence-agents, firefox, ipa, kernel, kernel-rt, pcre2, python-tornado, qt6-qtdeclarative, thunderbird, and webkit2gtk3), Slackware (expat), SUSE (bind, busybox, containerd, cups-filters, fixme, gimp, glibc, google-osconfig-agent, kernel, libtcnative-2-0, openssh, openssl-3, php8, podman, python-oauthlib, python-PyJWT, python-urllib3, python-virtualenv, python311, python313-jupyter-server, python313-kubernetes, python313-logilab-common, python313-markdown-it-py, python313-markdown2, python313-marshmallow, python313-mpmath, python313-mysql-connector-python, python313-oci-sdk, python313-oic, unbound, wpa_supplicant, xen, and xorg-x11-server), and Ubuntu (kernel, libyaml-perl, linux, linux-aws, linux-aws-fips, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-azure-fips, linux-fips, linux-gcp, linux-gcp-4.15, linux-gcp-fips, linux-hwe, linux-kvm, linux, linux-aws, linux-aws-fips, linux-fips, linux-gcp, linux-gcp-fips, linux-gke, linux-gkeop, linux-ibm, linux-lowlatency, linux-oracle, linux-realtime, linux, linux-aws, linux-azure, linux-azure-5.4, linux-fips, linux-gcp, linux-gcp-5.4, linux-gcp-fips, linux-hwe-5.4, linux-iot, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4, linux-xilinx-zynqmp, linux, linux-aws, linux-fips, linux-kvm, linux-lts-xenial, linux-aws-5.4, linux-aws-fips, linux-azure-fips, linux-ibm, linux-ibm-5.4, linux-azure, linux-azure-fde, linux-azure-fips, linux-oracle, and pyjwt).

Post Syndicated from jzb original https://lwn.net/Articles/1099486/

KDE Linux, the KDE Project’s second
stab at creating its own distribution, was first introduced as “Project Banana”
at the Akademy conference in 2024 by
Harald Sitter. Nate Graham announced
the first alpha-quality release during Akademy 2025. Graham and Sitter
paired up at Akademy 2026 to
provide an update on its progress, lay out plans for refining the distribution to
address user feedback, and discuss some of the problems that still need to be
dealt with. KDE Linux is still not-quite-ready for prime time, but Graham hopes
that it will be suitable for widespread use soon—for an undefined value of
“soon”.