Company

Red Hat

6 articles First covered Apr 30, 2026, latest Jul 25, 2026

Codeberg banned LLM-generated projects, and Debian is voting on the same question

Codeberg's terms now bar projects that mostly consist of AI-written code. Debian's open resolution puts three answers on one ballot. Provenance is the crux.

Close-up of an AT motherboard showing the socketed BIOS chip and real-time clock, the low-level firmware where Secure Boot certificates live.

Security·last month

Secure Boot's 2011-era keys start expiring, cutting off boot updates on unpatched PCs

Microsoft's 2011 Secure Boot certificates started expiring in June 2026. Here's what breaks on Windows and Linux, and the one update that fixes it.

Cargo loader moving freight onto an aircraft, a stand-in for the software supply chain

Security·2 months ago

Red Hat's npm namespace and Arch's AUR were both backdoored within two weeks of each other

A worm hijacked Red Hat's npm namespace, a rootkit spread through 1,500 Arch AUR packages, and a SOC 2-certified AI gateway shipped malware. Registries are under fire.

A source-code editor open to C++ code, evoking the debate over AI-written contributions to open source

Open Source·2 months ago

SQLite won't accept AI-written code, but QEMU just opened the door to it

Two of the most cautious C projects split on AI contributions in the same week. The real fight is over copyright provenance and who cleans up the slop.

Wiz Research's disclosure page for the Dirty Frag Linux kernel privilege escalation vulnerability

Security·3 months ago

A nine-year-old Linux kernel bug gives root in one command. No patch exists yet.

Dirty Frag chains two page-cache flaws in the ESP and RxRPC subsystems into a deterministic privilege escalation that hits every major distro. A PoC exploit is public.

The Copy Fail launch graphic showing a stylized terminal prompt and the title text on a dark background.

Security·3 months ago

'Copy Fail' lets a 732-byte script grab root on Ubuntu, RHEL, and SUSE. Patched April 29.

CVE-2026-31431 chains AF_ALG and splice() to write into the page cache of /usr/bin/su. Xint Code disclosed it on April 29, nine years after the bug shipped.