Do Son The Ubuntu 26.10 release delivers GNOME 51, Rust-powered uutils core tools, local Myna voice AI, and expanded TPM hardware encryption.
Rust
A uutils coreutils vulnerability in stdbuf uses a world-writable libstdbuf.so via LD_PRELOAD, letting local users execute arbitrary code.
A Rust supply chain attack poisoned arrayref and two other crates to run malware at build time. Wiz ties the infrastructure to DPRK campaigns.
Google’s Pixel 10 series is the first to use a memory-safe Rust DNS parser in its modem. Learn how this proactive shift eliminates critical cellular exploits.
North Korea’s "Contagious Interview" campaign expands to 1,700+ malicious packages across npm, PyPI, and more. Learn how to protect your dev environment.
Ubuntu 26.04 LTS is moving to sudo-rs and enabling visual password feedback by default. Discover why Canonical is ending 45 years of terminal silence in 2026.
The Rust-Powered Brain: Why OpenAI Just Acquired Astral to Build the First True AI Software Engineer
The Rust-Powered Brain: Why OpenAI Just Acquired Astral to Build the First True AI Software Engineer
OpenAI acquires Astral, the creators of Ruff and uv. Discover how Rust-powered tools will transform Codex from a code generator into a full AI software engineer.
WhatsApp launches Strict Account Settings in Jan 2026. A "lockdown mode" to protect high-risk users from Pegasus spyware and zero-click attacks.
Microsoft clarifies it won’t rewrite Windows 11 in Rust with AI, despite bold claims by a senior engineer about replacing C and C++ by 2030.
Microsoft's CoreAI team aims to eliminate all C/C++ code by 2030. Using AI agents, they plan to rewrite 1 million lines of code per engineer, every month.
Linux logs its first Rust CVE (CVE-2025-68260): a race condition in the Android Binder driver causing kernel crashes. Fixed in 6.18.1 and 6.19-rc1.
New 01flip ransomware (written in Rust) targets APAC critical infra across Windows/Linux. The attackers use Sliver for C2 and older exploits for access. A curious "lockbit" ignore list was found in the code.
A Rust supply chain attack used typosquatting (finch-rust) and an unpinned dependency to silently update the sha-rust payload over two weeks, stealing credentials and private keys from developers.
A malicious Rust package (evm-units) was live on Crates.io for 8 months, hiding RCE in a version check function. The loader uses VBScript and checks for Qihoo360 to compromise crypto developers on Windows/Linux/macOS.
The Tor Project is developing the Counter Galois Onion (CGO) algorithm to replace the vulnerable Tor1 protocol, enhancing security against tagging attacks and key reuse.
Google's Quick Share now works with Apple AirDrop for seamless file transfer between Pixel 10 and iPhone/Mac. Built with secure Rust for peer-to-peer sharing.
A bug in Ubuntu 25.10's Rust coreutils prevents automatic system updates on desktop, server, and cloud deployments. Manual patch required.
eSentire discovered ChaosBot, a Rust-based malware deployed via DLL sideloading that uses Discord channels as a covert C2 platform to perform reconnaissance and command execution.
Malicious Rust crates, downloaded 8,400+ times, were found to be typosquatting legitimate libraries to scan source code and steal Solana and Ethereum private keys.
Ubuntu is replacing the classic sudo with sudo-rs, a memory-safe reimplementation in Rust. The change aims to enhance security and prevent vulnerabilities.
xAI has launched grok-code-fast-1, a new AI coding model optimized for speed and efficiency. Learn how it plans to challenge Microsoft and OpenAI.
Gen Digital has released a free decryptor for FunkSec ransomware, allowing victims to recover files. The group appears dormant, with no new victims since March 2025.