Latest Linux and open source news from around the web

Practical Vim Sponsored · View on Amazon → CanaKit Raspberry Pi 5 Starter Kit Sponsored · View on Amazon →
LWN.net

Larson: Are insecure code completions a vulnerability?

Seth Larson, the Python Software Foundation's security developer-in-residence, has written about the difficulty in classifying insecure code completion in the PyCharm IDE using its Full Line code completion plugin. Larson discovered that the plugin, which uses a local "deep learning module" to offer code completions, suggests code that would lead to severe vulnerabilities. He was unsure whether it warranted a CVE or not, however: I reported this behavior to JetBrains for "Full Line Code Completion" v253.29346.142 and clearly their support staff weren't certain whether this defect was a security vulnerability or not either. When I asked to publish a blog post about this behavior after they confirmed this report wasn't a "direct security vulnerability" (which I agree with) but then was asked not to publicize my report and referred to PyCharm's Coordinated Disclosure Policy so... which is it? Security vulnerability or not? I ended up waiting the 90 days anyway and I didn't hear back with

OMG! Ubuntu

Microsoft brings Coreutils to Windows – natively

Microsoft has released Coreutils for Windows, allowing a stack of familiar β€œLinux-like” command-line utilities to run natively on Windows. The project is based on uutils, the Rust-based reimplementation of GNU coreutils that Ubuntu (mostly) has adopted in recent releases. Microsoft’s package bundles uutils’ coreutils and findutils as well as a GNU-compatible grep in a single binary. It offers tools like cat, cp, ls, mv and uptime. Commands that use POSIX-only features are excluded, meaning chmod, chown, kill and others aren’t included. What’s notable – *nix tools working their way into the Windows ecosystem is notable – is that this isn’t […]

Phoronix

Framework Laptop 13 Pro To Begin Shipping In July

Framework Computer began informing those that pre-ordered the new Framework Laptop 13 Pro that it will begin shipping in July rather than their original June target. The setback is coming to address two issues that came up in their testing process that delayed the start of mass production...

LWN.net

[$] AI agent runs amok in Fedora and elsewhere

Agentic AI systems can be used to do a variety of things autonomously on behalf of a human user: open or manage bugs, generate code, submit pull-requests, and (apparently) even complain about rejection. In May, a Fedora developer discovered that an allegedly rogue agent had been pestering the project in a number of ways: reassigning bugs, fabricating unhelpful replies to bugs, and even persuading maintainers to merge questionable code into the Anaconda installer. It also submitted a number of pull requests (PRs), some accepted, to several upstream projects. The Fedora account associated with the agent has had its group privileges revoked and the messes have been mopped up, but the motive behind the agent's actions is still a mystery.

LWN.net

Buildroot 2026.05 released

Version 2026.05 of the Buildroot tool has been released. Buildroot simplifies and automates the process of building embedded Linux systems using cross-compilation. Notable changes in this release include support for Arm Neoverse cores, addition of XFS rootfs generation, as well as many package updates and bug fixes. See the CHANGES file for the full list.