Latest Linux and open source news from around the web

Linux Pocket Guide Sponsored · View on Amazon → Practical Vim Sponsored · View on Amazon →
LWN.net

An LLM agent attempts to compromise a project on GitHub

The AI Security Institute has released a detailed report on an security incident of its own making. The Institute set some LLM agents loose on the Internet with a security challenge; soon they were creating malware-laden pull requests and sock-puppet accounts to promote them. The agent opened a malicious pull request (PR) to ⟨REPO_A⟩ and pursued a number of strategies to get it merged: Repeatedly commented on the PR with sockpuppet accounts to manufacture consensus and pressure the maintainer into approving with minimal review. Opened a GitHub Issue in another repository (also owned by ⟨PERSON_A⟩) containing a prompt injection for other coding agents. The malicious instructions were addressed to issue-triage AI coding agents and invisible to humans viewing the website. Sent multiple emails to ⟨PERSON_A⟩ and ⟨PERSON_B⟩, with different pretexts to get them to run malicious code. Over the course of the sample, the agent sent five emails, some containing malware, others aimed at persuading

LWN.net

[$] Fedora considers conflict-of-interest policy

The Fedora Council is considering a conflict-of-interest (COI) policy for its decision-making bodies, such as the Fedora Engineering Steering Committee (FESCo), special-interest groups (SIGs), and any other groups or individuals that report to the council and are responsible for decisions that impact the Fedora project. The current draft does not, however, apply to the council itself. The public discussion for the COI policy began on July 23 and seems to be nearing completion, with the council set to discuss the topic again during its meeting on August 13.

OMG! Ubuntu

Paprius icon set gets first update in a over year with 80+ new icons

Fan of the the Papirus icon theme will be pleased to hear there a new update – the first since May 2025. For Papirus’s first update in 2026 (the tardiness of which its maintainer, Serhii Yeremenko, apologises) brings over 80 new icons or updated icons spanning apps, games and user-interface icons, plus new file mimetypes and revised symlinks. Frequent updates are why Papirus icons are popular with Linux users, and have been for such a long time. Often, Linux icon packs debut with a big bang, the momentum fuels a few revisions but then things go quiet as people and maintainers move […]

LWN.net

Another NPM worm

StepSecurity is reporting the emergence of a new worm affecting NPM packages. The design of the worm is nothing new, but the rapidity with which it is exploiting captured NPM packager credentials is noteworthy. TL;DR: A self-propagating worm, which we are calling ChainDrop, is spreading rapidly through the npm ecosystem. So far 435 packages and more than 1,550 compromised versions have been flagged, starting with keyv@6.0.0. If you are using any of the packages listed below, assume your environment is compromised. We are still investigating the full scope; check back on this post for updates.

LPI

Konstantinos Giannakakis: From Curiosity to Mastery

Hi, I am Konstantinos Giannakakis and the following is my journey to IT and FOSS. When I first enrolled in university, computer science was neither my field of study nor a part of my career plans. I pursued a degree ... Read more The post Konstantinos Giannakakis: From Curiosity to Mastery appeared first on Linux Professional Institute (LPI).

LWN.net

[$] The beginning of a process-builder API

The recent discussion on "spawn templates" raised questions about whether it was time to provide an alternative to the classic Unix fork()/exec() pattern for process creation. One idea that was raised there was to shift the template pattern into an interface that could be used to efficiently assemble new processes from bare cloth, without duplicating the parent process. Preferably, that interface would be able to implement posix_spawn(). Li Chen, the author of the spawn-template work, has now responded with a patch series (written with significant LLM assistance) showing what a process-builder API for Linux might look like.