Do Son A critical SQL injection flaw (CVE-2025-50979) in NodeBB allows remote attackers to access sensitive data. Admins are urged to patch immediately.
open-source
Broadcom and Canonical have partnered to integrate Ubuntu into VMware Cloud Foundation, providing streamlined, secure, and efficient AI and cloud-native application deployment.
A new report reveals a critical SSRF vulnerability in the PhpSpreadsheet library. The flaw could allow attackers to access internal networks and sensitive data.
Two critical flaws in the open-source BI tool DataEase allow attackers to achieve remote code execution and arbitrary file writes, exposing unpatched systems to compromise.
Elon Musk's xAI has open-sourced the Grok 2.5 model. However, the custom license imposes significant restrictions, limiting its use for commercial purposes and model training.
A dangerous Go package, disguised as a fast SSH brute-force tool, is secretly stealing login credentials and sending them to an attacker via a Telegram bot.
A critical vulnerability in the Directus API (CVE-2025-55746) allows unauthenticated attackers to silently upload and modify files, leading to webshells and RCE.
AMD accidentally uploaded the FSR 4 source code to GitHub before pulling it, sparking speculation about unofficial support for older graphics cards.
A new report reveals a malicious Python package on PyPI that uses a stealthy dependency and DLL sideloading to deliver a multi-stage malware.
PyPI is now checking for expired domains to prevent "domain resurrection attacks," a major step in securing the Python Package Index from account takeovers.
Google’s new Gemma 3 270M model packs powerful performance into a tiny 270M-parameter size, perfect for on-device AI and edge computing.
GitLab has released patches for multiple high-severity vulnerabilities, including several XSS flaws that could lead to account takeover. All users should update immediately.
Linus Torvalds rejected a late code submission from a Google engineer for Linux 6.17, calling it "garbage" and criticizing its timing during the merge window.
Elon Musk's xAI will open source the Grok 2 model next week, finally fulfilling a long-standing promise amid new competition from OpenAI's own open-weight GPT-OSS models.
NVIDIA has finally acknowledged long-standing performance issues for VKD3D/DirectX 12 games on Linux, with engineers confirming a fix is in development for a future driver update.
OpenAI has released gpt-oss-120b and gpt-oss-20b, its first open-weight models since GPT-2. The release, under an Apache 2.0 license, aims to democratize access to AI.
A study reveals Python's ecosystem is a "labyrinth of dependencies" that propagates vulnerabilities. Over 145,000 packages are at risk, with urllib3 accounting for 41% of all exposures.
Proton introduces a new, open-source MFA app, Proton Authenticator, designed to separate 2FA codes from passwords for enhanced security with end-to-end encryption.
North Korea's Lazarus Group is waging a covert cyberespionage campaign, poisoning 234+ open-source packages on npm/PyPI to steal secrets from CI/CD pipelines and developer environments.
A critical vulnerability (CVE-2025-54576, CVSS 9.1) in OAuth2-Proxy allows attackers to bypass authentication by manipulating query parameters that match skip_auth_routes regex patterns.
NVIDIA's Sasha Levin proposes new guidelines for AI in Linux kernel development, including a "Co-developed-by" tag and standardized configurations for AI coding tools like Claude and Copilot.
Linux Kernel 6.16 is officially out, bringing significant enhancements to hardware support, new drivers, and optimizations for filesystems and networking, including Intel TDX and Nvidia GPU support.