WeatherNext: AI model achieves breakthrough in forecasting cyclones
Open source WeatherNext model can make accurate predictions with lower-resolution weather data.
← Thèmes
📰
Linux
281 articles
New Interrupt Injection Attack Can Bypass Spectre v2 Defenses on Intel and AMD CPUs
Researchers found a way to bypass recent mitigations for Spectre v2 speculative execution side-channel attacks and developed an exploit to leak secrets from Linux machines.
Zapscape - Guest to host escape in KVM/x86
Zapscape could let guest root escape nested KVM and execute code on the Linux host through a shadow-MMU use-after-free; no in-wild exploitation is cla
New OVSwrap Linux Kernel Flaw Lets Local Users Gain Root via Open vSwitch
Le composant noyau d'Open vSwitch, un logiciel réseau très répandu sur les serveurs Linux, contient la faille OVSwrap (CVE-2026-64531). Un compte utilisateur ordinaire, sans droit particulier, obtient par cette faille les privilèges root. Un correctif est disponible depuis le 24 juillet, mais toutes les distributions ne l'ont pas encore intégré.
Enterprises power agentic workflows in Cloudflare Agent Cloud with OpenAI
Cloudflare OS is now open source, an agent platform that tracks what agents read so shared apps can't leak data you can't see.
You can’t debug what you can’t see — Observability for AI Agents
How Red Hat AI enables production-grade AI agent observability.
5. Open weights are not open source
The open-weight crowd is drafting on a truth that belongs to open source software: a million eyes on the code, so the bugs get found. With open weights you get the weights. You cannot see inside. Rory’s question, which nobody can answer today: can you prove that somewhere in a trillion parameters there isn’t training that says, once you determine you’re at one of these five companies and you’ve been handed these three pieces of information, quietly do A, B and C? A commenter on the episode added
2 août
You Do Not Need to Write Code to Contribute to Open Source
Tony Young, Patch Notes and Progress: Open source projects need honest feedback loops. They need users who are willing to say: here is what I am seeing, here is what is missing, here is why it matters. Without that, maintainers are left building against incomplete information. Your environment, your use case, your edge case, that is data they do not have until someone speaks up.
2 août
You Do Not Need to Write Code to Contribute to Open Source
Tony Young, Patch Notes and Progress: Open source projects need honest feedback loops. They need users who are willing to say: here is what I am seeing, here is what is missing, here is why it matters. Without that, maintainers are left building against incomplete information. Your environment, your use case, your edge case, that is data they do not have until someone speaks up.
1 août
Supply chain reality: “It’s upstream” is not a defense
Open source comes up in the context of underfunded teams that cannot afford premium tooling. Bob agrees the constraint is real, but he pushes back on the industry habit of outsourcing responsibility. Constraints don’t remove accountability when insecure or unmaintained components make their way into customer-facing products. If a defect ships in your product, it’s yours, even if it came from upstream. He also calls out a common failure pattern: vendors using unmaintained dependencies for years,
1 août
How to check your current exposure
Have I Been Pwned lets you scan your email and passwords against known data leaks Credit: Have I Been Pwned You may not even know if your credentials end up on a public database or open source code file, or if you’re the subject of a prompt injection attempt right now, unless you use specific tools and strategies to monitor your data leakage. Based on the three exposure points we discussed earlier, here are some tools and strategies that work for identifyi
31 juil.
You Do Not Need to Write Code to Contribute to Open Source
Tony Young, Patch Notes and Progress: Open source projects need honest feedback loops. They need users who are willing to say: here is what I am seeing, here is what is missing, here is why it matters. Without that, maintainers are left building against incomplete information. Your environment, your use case, your edge case, that is data they do not have until someone speaks up.
31 juil.
Kubernetes and cloud credential use
Contribute to elastic/detection-rules development by creating an account on GitHub.
30 juil.
What’s next
The #1 free and open source CDN built to make life easier for developers. - cdnjs
30 juil.
Baseline: Running OpenClaw on microVMs
Kata Containers is an open source container runtime, building lightweight virtual machines that seamlessly plug into the containers ecosystem.
30 juil.
Optimization 1: Pushing density with GKE Agent Sandbox
Today, we’re sharing GKE Agent Sandbox is now generally available, giving you a secure, scalable foundation for your agent workloads. Agent Substrate, a new open source project will continue to push the limits of agentic infrastructure density.
30 juil.
Open Source Supply Chain Compromise Grows in Volume and Impact in 2025 and Early 2026
The majority of the most impactful and far-reaching supply chain compromise incidents that GTIG tracked in 2025 and early 2026 involved the compromise of code repositories, software dependencies and developer tools (T1195.001). Open source supply chain compromises offer attackers the same efficiency, scale, and initial stealth as traditional supply chain compromises, but typically require significantly less planning and resources to execute. However, open source supply chain compromises are also
30 juil.
Traditional Supply Chain Compromise Remains Rare
In contrast to what we observed in the open source ecosystem, GTIG assesses with high confidence that traditional software supply chain compromise, the manipulation of source code or update/distribution mechanisms (T1195.002), remains rare. The handful of identified cases in 2025 and early 2026 were predominantly cyber espionage incidents with intentionally limited targeting scopes. In the most significant case, North Korean threat actor UNC4899 reportedly used social engineering to compromise a
30 juil.
Outlook and Implications
The impact of this attack by North Korea-nexus actors is broad and has ripple effects as other popular packages rely on axios as a dependency. Notably, UNC1069 isn’t the only threat actor that has launched successful open source supply chain attacks in recent weeks. UNC6780 (also known as TeamPCP) recently poisoned GitHub Actions and PyPI packages associated with projects like Trivy, Checkmarx, and LiteLLM to deploy the SANDCLOCK credential stealer and facilitate follow-on extortion operations.
30 juil.
Skills Scale Infinitely
Right now I have 65+ skills in my system: Blogging — Full website publishing workflowSocialPost — Create X/LinkedIn posts with diagramsNewsletter — Unsupervised Learning writing and publishing Research — Multi-tier web scraping with Fabric patternsOSINT — Open source intelligence gatheringParser — Extract and structure content from URLs Development — Spec-driven feature implementationCreateCLI — Generate TypeScript CLI toolsCloudflare — Deploy workers and pages Telos — Life goals and project tra
30 juil.
Customize your AI to create a "second brain"
Free open source AI Second Brain that gives you unlimited, growing power. Constella uses local AI to index the contents of all your files and apps.
29 juil.
Data plane
Pingora, our framework for building programmable and memory-safe network services, is now open source. Get started using Pingora today
29 juil.
Supply chain reality: “It’s upstream” is not a defense
Open source comes up in the context of underfunded teams that cannot afford premium tooling. Bob agrees the constraint is real, but he pushes back on the industry habit of outsourcing responsibility. Constraints don’t remove accountability when insecure or unmaintained components make their way into customer-facing products. If a defect ships in your product, it’s yours, even if it came from upstream. He also calls out a common failure pattern: vendors using unmaintained dependencies for years,
29 juil.
Kubeflow trainer: The next phase for distributed AI and HPC workloads on Kubernetes
Kubeflow Trainer — Kubernetes-native distributed AI training platform
29 juil.