Do Son NVIDIA open-sources its Audio2Face model and SDK, allowing devs to easily create lifelike, real-time facial expressions and lip sync from any audio.Export to Sheets
open-source
A new phishing campaign is targeting PyPI maintainers with emails from a fraudulent pypi-mirror.org domain to steal credentials and compromise accounts.
OpenSSF and other foundations warn that they can no longer be the unpaid gatekeepers of the software supply chain and that enterprises must contribute financially.
Meta has open-sourced its MobileLLM-R1 series, a new family of models designed for on-device reasoning in math, coding, and science.
A sophisticated supply chain attack has compromised over 40 npm packages, including the popular TinyColor library, to steal developer credentials.
Google unveils VaultGemma, the first LLM trained with differential privacy. The open-source model achieves near non-private performance, setting a new standard for privacy-first AI.
New patches for CUPS, the open-source Linux printing system, fix two flaws that can lead to remote DoS and authentication bypass.
After an 8-year wait, Firefox is finally adding native support for MKV video. The feature is available in Nightly builds and will support AVC/H.264 and AAC codecs.
CERT/CC warns of critical flaws in the Hiawatha web server. The vulnerabilities could allow attackers to bypass authentication and hijack sessions.
A critical SQL injection flaw (CVE-2025-58450) in pREST allows attackers to read sensitive files, steal credentials, and manipulate databases. Patching is urgent.
The future of Nova Launcher is in doubt after its founder, Kevin Barry, left the company, and the new owner, Branch, blocked plans to open-source the project.
The GNU Guix team has issued an urgent advisory for a privilege escalation flaw in guix-daemon. Local users could gain control of build outputs, risking system integrity.
A new report reveals that Stealerium, an open-source infostealer, is being used in phishing campaigns to steal credentials, crypto wallets, and sensitive data.
A new report reveals that malicious npm packages are using Ethereum smart contracts as resilient command-and-control servers, a new tactic in open-source attacks.
Ubuntu is replacing the classic sudo with sudo-rs, a memory-safe reimplementation in Rust. The change aims to enhance security and prevent vulnerabilities.
JetBrains has made its RubyMine IDE free for non-commercial use. The move is designed to lower the barrier for new developers and content creators.
The makers of 2Fas Auth have launched 2Fas Pass, a local-first password manager with a zero-knowledge architecture and tiered security for maximum protection.
Switzerland launches Apertus, a fully open-source LLM. The model is built as public infrastructure, emphasizing transparency and compliance over commercial goals.
JetBrains has announced that its Language Server Protocol (LSP) API will be available free of charge, a move that will benefit plugin developers and users.
A critical flaw in NeuVector (CVE-2025-8077) allows attackers to bypass authentication with a hardcoded password, exposing Kubernetes clusters to full compromise.
A new vulnerability (CVE-2025-8067) in the Linux UDisks daemon allows unprivileged users to escalate privileges or cause a denial of service. Admins are urged to patch.
ImageMagick has a format string bug (CVE-2025-55298) that can lead to RCE. A PoC is public, and an urgent patch is available for versions 7.1.2-2 and 6.9.13-28.