Latest Linux and open source news from around the web

Beelink EQ14 Mini PC Sponsored · View on Amazon → Cat6 Ethernet Cable 5-Pack Sponsored · View on Amazon →
LWN.net

Today's PHP Security Release, and How We're Strengthening PHP Security (PHP Foundation)

The PHP Foundation has put out a blog entry explaining how the vulnerabilities disclosed today came about and why they took so long to fix. To fix the OOM problem, the PHP security team developed several competing approaches, but each came with its own trade-offs: backward compatibility breaks, new denial-of-service potential, or requiring changes to many third-party extensions which seemed impossible to coordinate. The PHP security team, operating on consensus, struggled to choose between these and feared the repercussions of shipping the wrong choice. Combined with the lack of a known path to remote code execution and the small team of core developers with the necessary deep knowledge of the engine occupied with many responsibilities, this decision process caused work on a fix to stall and restart repeatedly over months. We won't pretend otherwise: the delay was a structural failure, caused by both the security team's decision process and its lack of resources.

LWN.net

More vulnerabilities in widely deployed software

The Node.js project has released a number of security updates to fix, among other vulnerabilities, a remote-code-execution bug affecting programs that use Brotli compression. And, in case any programmers who use compiled languages thought they could relax, the musl libc project has also announced a new vulnerability: an out-of-bounds write that could potentially lead to remote code execution, although that has not been demonstrated.

LPI

Linux in Every Chapter: Jeferson Salles’s Journey

Since I was a boy, I have been passionate about technology. I wanted to understand how computers worked, how systems talked to each other, and what existed behind every screen. I did not yet know all the paths technology could ... Read more The post Linux in Every Chapter: Jeferson Salles’s Journey appeared first on Linux Professional Institute (LPI).

LWN.net

[$] Hash-based module integrity for reproducible distributions

We last looked in on hash-based integrity checking for kernel modules just over a year and half ago. Since that time, the patch set has undergone multiple revisions. At the 2026 Linux Plumbers Conference (LPC), Thomas Weißschuh described the need for kernel-module integrity guarantees while still providing reproducible builds, how his patches implement that, and some ideas for possible further work.

LWN.net

Upstreaming Tyr: Rust, DRM, and the Linux Kernel (Collabora)

The Collabora blog provides an update on Tyr, a driver for Arm Mali GPUs. One of our biggest challenges has been developing Tyr while the Rust kernel abstractions and driver interfaces are also being developed. As the driver interfaces are naturally revised and improved, we have rewritten Tyr several times to adapt to the larger Rust ecosystem. This not only makes progress much slower than it would be with a mature API, but also stalls progress for capabilities, such as job scheduling, while the abstraction is properly designed, reviewed, tested, and merged upstream. But working in this evolving environment is also precisely where Tyr is able to provide the most value. As a user of these new Rust abstractions, Tyr helps to expose their requirements and limitations.