Latest Linux and open source news from around the web

Logitech MX Master 3S Mouse Sponsored · View on Amazon → The Art of UNIX Programming Sponsored · View on Amazon →
LWN.net

[$] The second part of the 7.4 merge window

The 7.4 merge window, which closed on November 1, included a record-breaking 18,591 non-merge changesets. That is almost as many as the entire 7.3 development cycle, which had 18,765, itself a record breaker. Of those, 11,838 landed after the article covering the first part of the merge window. Most of those were bug fixes of various forms; it seems as though bug fixes may be crowding out feature additions across the open-source ecosystem to some extent. Still, a good number of new features were included, and a handful removed, in the tail end of the merge window.

LWN.net

Shutting the Door on the XCPE Botnet (Threat Intelligence)

The Google Threat Intelligence blog describes, in great detail, the XCPE botnet, which has just been taken down. Last week, Google and industry partners dismantled the XCPE backdoor which enrolled more than 1.3 million set-top boxes into a botnet. We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co., an Android Original Equipment Manufacturer (OEM) and Original Device Manufacturer (ODM). Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affiliates' malware modules onto infected devices. These secondary modules were conducting ad-fraud; silently enrolling infected devices into residential proxy networks; and loading additional malware onto XCPE-compromised devices.

LWN.net

[$] Managing the kernel CVE flood

We recently looked at how the kernel community is dealing with the firehose of vulnerability reports, but said little about how users of the kernel are responding. At the 2026 Linux Plumbers Conference, Amazon employees Dylan Johnson and Justinien Bouron discussed the problem from the point of view of engineers trying to keep AWS running and secure in the face of a storm of CVE disclosures. The kernel community's longstanding advice is to run current kernels, and that turns out to work β€” sort of.

LWN.net

Tor Browser 16.0 released

Version 16.0 of the Tor Browser has been released. This is the first stable version based on Firefox ESR 153. Notable changes in this release include support for Linux on 64-bit Arm, redesigned settings, and a "generic window titles" feature to help prevent other applications from snooping on one's browser activity. Tor Browser for Android has had a number of interface updates to Google's Material Design 3 design language. This release also follows Firefox in ending support for 32-bit x86 Linux systems. See the full changelog for all of the updates and bug fixes.

LWN.net

Security updates for Monday

Security updates have been issued by AlmaLinux (firefox, java-17-openjdk, kernel, kernel-rt, mariadb:10.5, podman, python-jwt, python27:2.7, python38:3.8 and python38-devel:3.8, python39:3.9 and python39-devel:3.9, ruby:2.5, ruby:2.7, thunderbird, util-linux, and virt:rhel and virt-devel:rhel), Debian (chromium, eog, imagemagick, python-aiohttp, thunderbird, and vim), Fedora (asciinema, atuin, btrfs-backup-ng, clevis, gcc, janus, kernel, libheif, libreswan, mingw-expat, mupdf, nautilus, nicotine+, ntpd-rs, openscap, perl-DBI, python-streamlink, python3.12, retsnoop, ruby, rust-cargo-deny, rust-cargo-rpmstatus, rust-ctutils, rust-gst-plugin-reqwest, rust-rbspy, rust-resctl-bench, rust-rpki, rust-rustls-webpki, rust-sequoia-chameleon-gnupg, rust-sequoia-git, rust-sequoia-octopus-librnp, rust-webpki-root-certs, rust-webpki-roots, tpm2-tss, and vhs), Oracle (.NET 8.0, .NET 9.0, aspell, bind9.18, curl, httpd:2.4, java-1.8.0-openjdk, kernel, libXi, mod_auth_openidc:2.3, nodejs:24, python-pil