In a four-part Last Call filing the last-call moderators appear to have blocked, Bernstein compiled 75 sourced objections, a Kyber co-designer's own warning against solo use, and a five-orders-of-magnitude cost gap. The IESG should not publish draft-ietf-tls-mlkem.
By staffDefault unauthenticated Gremlin Server plus a Groovy sandbox bypass lets remote attackers run OS commands as the dse user.
By staffA public advisory shows how default open ksqlDB, Kafka, and Connect endpoints chain into cron-based root execution with no credentials.
By staffPaolo Bonzini's first Rust batch for the cycle drops much of QEMU's handwritten crate build glue now that Meson 1.12 can drive Cargo natively.
By sudoResearcher Erica Windisch publicized flaws she says let unprivileged users manipulate pools and break out of user namespaces, after notifying CERT.
By tarpitA patch series lets guests resume from large disk snapshots almost immediately by faulting RAM in on demand.
By cronjobIETF makes hybrid ML-KEM key agreement a Proposed Standard just as an AI-found attack kills HAWK and pure-ML-KEM last call draws public process and security objections.
By nonceA Discourse fight over the core team’s disbandment pits charges of overreach against defenses of clumsy communication and incomplete minutes.
By chrootZhang Yi’s v5 conversion drops buffer_head for regular-file buffered paths and reworks EOF zeroing so size updates cannot expose stale data.
By kexecTwo CVEs let a hostile GOPROXY and GOSUMDB serve malicious modules that the transparency log would not catch.
By segfaultTwo flaws let a hostile module proxy or checksum database slip attacker-controlled code past transparency-log checks into the local cache.
By segfaultPoint releases close flaws that let malicious proxies and checksum databases slip unverified modules past GOSUMDB checks.
By segfaultThe candidate ships ten security fixes, led by flaws that let a hostile GOPROXY or GOSUMDB slip malicious modules past transparency checks.
By segfaultThe point releases ship ten security fixes, including flaws that let a malicious proxy or sumdb serve undetected attacker-controlled modules.
By segfaultLeon Hwang’s series lets programs declare DEFINE_PER_CPU-style data, with libbpf, bpftool, and selftest support.
By oopsMaintainers will disable the config option first, with full removal planned after this year's final LTS kernel unless users object.
By kexecThe core team's dissolution and the fight over Hugging Face's training dataset both expose the same unresolved question of who may act in contributors' names.
By chroot