Latest Linux and open source news from around the web

Designing Data-Intensive Applications Sponsored · View on Amazon → Ubiquiti UniFi U6+ Sponsored · View on Amazon →
LWN.net

Larson: Are insecure code completions a vulnerability?

Seth Larson, the Python Software Foundation's security developer-in-residence, has written about the difficulty in classifying insecure code completion in the PyCharm IDE using its Full Line code completion plugin. Larson discovered that the plugin, which uses a local "deep learning module" to offer code completions, suggests code that would lead to severe vulnerabilities. He was unsure whether it warranted a CVE or not, however: I reported this behavior to JetBrains for "Full Line Code Completion" v253.29346.142 and clearly their support staff weren't certain whether this defect was a security vulnerability or not either. When I asked to publish a blog post about this behavior after they confirmed this report wasn't a "direct security vulnerability" (which I agree with) but then was asked not to publicize my report and referred to PyCharm's Coordinated Disclosure Policy so... which is it? Security vulnerability or not? I ended up waiting the 90 days anyway and I didn't hear back with

OMG! Ubuntu

Microsoft brings Coreutils to Windows โ€“ natively

Microsoft has released Coreutils for Windows, allowing a stack of familiar โ€œLinux-likeโ€ command-line utilities to run natively on Windows. The project is based on uutils, the Rust-based reimplementation of GNU coreutils that Ubuntu (mostly) has adopted in recent releases. Microsoftโ€™s package bundles uutilsโ€™ coreutils and findutils as well as a GNU-compatible grep in a single binary. It offers tools like cat, cp, ls, mv and uptime. Commands that use POSIX-only features are excluded, meaning chmod, chown, kill and others arenโ€™t included. Whatโ€™s notable โ€“ *nix tools working their way into the Windows ecosystem is notable โ€“ is that this isnโ€™t [โ€ฆ]

LWN.net

[$] AI agent runs amok in Fedora and elsewhere

Agentic AI systems can be used to do a variety of things autonomously on behalf of a human user: open or manage bugs, generate code, submit pull-requests, and (apparently) even complain about rejection. In May, a Fedora developer discovered that an allegedly rogue agent had been pestering the project in a number of ways: reassigning bugs, fabricating unhelpful replies to bugs, and even persuading maintainers to merge questionable code into the Anaconda installer. It also submitted a number of pull requests (PRs), some accepted, to several upstream projects. The Fedora account associated with the agent has had its group privileges revoked and the messes have been mopped up, but the motive behind the agent's actions is still a mystery.

LWN.net

Buildroot 2026.05 released

Version 2026.05 of the Buildroot tool has been released. Buildroot simplifies and automates the process of building embedded Linux systems using cross-compilation. Notable changes in this release include support for Arm Neoverse cores, addition of XFS rootfs generation, as well as many package updates and bug fixes. See the CHANGES file for the full list.

LWN.net

Security updates for Wednesday

Security updates have been issued by AlmaLinux (poppler), Debian (dnsmasq, mistral, okular, openssl, poppler, and strongswan), Fedora (exim, firefox, pcs, putty, and xorg-x11-server), Mageia (freeciv, golang-x-net, jq, libssh, libxmp, libxpm, minetest, ruby-net-ssh, tor, and wireshark), SUSE (389-ds, ack, agama-web-ui, amazon-ssm-agent, avahi, dpkg, elemental-register, elemental-system-agent, elemental-toolkit, ggml-devel-9500, go1.25, go1.26, kernel, kubernetes1.23, kubernetes1.24, kubernetes1.26, libsoup, mariadb, netty, netty-tcnative, NetworkManager, nginx, perl-CryptX, perl-XML-LibXML, podofo, polkit, python-Django, python-requests, samba, strongswan, vim, and xen), and Ubuntu (cyborg, gdk-pixbuf, golang-golang-x-net-dev, nginx, node-lodash, openssl, openssl, openssl1.0, qemu, tomcat9, tomcat10, and vim).

Phoronix

Intel Arc Pro B70 Showing Off Some Performance Wins With Linux 7.1

After recently noticing the Intel Arc B580 performing better on Linux 7.1 for that kernel version soon to be released as stable, I was curious if there were performance gains also to be found with the new flagship Arc Pro B70 BMG-G31 workstation graphics card. Here are some benchmarks of the Intel Arc Pro B70 in relevant workloads between Linux 7.0 and the near-final Linux 7.1 kernel.

Phoronix

NVIDIA Engineer Devises Patch To Significantly Reduce GCC Bootstrap Time

NVIDIA engineer Kyrylo Tkachov posted a patch for testing yesterday to significantly reduce the amount of time it takes the GNU Compiler Collection (GCC) for conducting a native bootstrap. The time spent in the configure process for native GCC builds is reduced by around 43% while the overall bootstrap wall time is lowered by around 15%...