Linux

Outlook and Implications

The impact of this attack by North Korea-nexus actors is broad and has ripple effects as other popular packages rely on axios as a dependency. Notably, UNC1069 isn’t the only threat actor that has launched successful open source supply chain attacks in recent weeks. UNC6780 (also known as TeamPCP) recently poisoned GitHub Actions and PyPI packages associated with projects like Trivy, Checkmarx, and LiteLLM to deploy the SANDCLOCK credential stealer and facilitate follow-on extortion operations.

Disrupting supply chain attacks on npm and GitHub Actions

In the past year, there’s been a pattern of supply chain attacks that target weaknesses in package repositories and CI/CD systems to quickly spread malware to hundreds of open source projects. This malware seeks to exfiltrate credentials both to broadly spread the attack, as well as for later exp...

github.blog28 juil.

CVE-2025-71267

In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata We found an infinite loop bug in the ntfs3 file system that can lead to a Denial-of-Service (DoS) condition. A malformed NTFS image can cause an infinite loop when an attribute header indicates an empty run list, while directory entries reference it as containing actual data. In NTFS, setting evcn=-1 with svcn=0 is a valid way to represent an empty run

Outlook and Implications

The impact of this attack by North Korea-nexus actors is broad and has ripple effects as other popular packages rely on axios as a dependency. Notably, UNC1069 isn’t the only threat actor that has launched successful open source supply chain attacks in recent weeks. UNC6780 (also known as TeamPCP) recently poisoned GitHub Actions and PyPI packages associated with projects like Trivy, Checkmarx, and LiteLLM to deploy the SANDCLOCK credential stealer and facilitate follow-on extortion operations.

What does the HWE stack mean for Ubuntu users?

For users building confidential computing environments, the virtualization HWE stack means they do not need to choose between two bad options: they do not need to leave LTS just to access newer virtualization capabilities. They also do not need to wait for the next LTS before they can benefit from features that are already moving through the upstream stack. Instead, they can stay on Ubuntu 26.04 LTS and opt into a newer virtualization stack when their hardware, workload or feature requirements d

Why Ubuntu can stay ahead

Confidential computing will continue to evolve over the next several years. The industry still has work to do around live migration, trusted I/O, accelerator enablement, attestation, orchestration, and operational tooling. These features will not become real for users the moment they appear in a processor specification. They become real when the full software stack supports them. The virtualization HWE model gives Ubuntu a structured way to bring new virtualization capabilities into the LTS life

Au secours des modèles ouverts

La lettre en question est donc signée NVIDIA, mais aussi Microsoft, Mozilla, Meta (qui a pourtant arrêté de publier des modèles open source depuis Muse), Mistral, Hugging Face, Perplexity, Palantir, Dell, IBM, la Linux Foundation, Box, Crowdstrike… Le texte rappelle le rôle essentiel des logiciels open source qui font fonctionner une grande partie d’internet et « au cœur de systèmes » utilisés par les organisations les plus importantes au monde. Les signataires listent les (nombreux, à leurs yeu

Trois fois plus de signataires ce week-end, avec OpenAI, Google, AMD

i want the US to win in AI both in open source and proprietary models, and i am glad to see this

Supply chain reality: “It’s upstream” is not a defense

Open source comes up in the context of underfunded teams that cannot afford premium tooling. Bob agrees the constraint is real, but he pushes back on the industry habit of outsourcing responsibility. Constraints don’t remove accountability when insecure or unmaintained components make their way into customer-facing products. If a defect ships in your product, it’s yours, even if it came from upstream. He also calls out a common failure pattern: vendors using unmaintained dependencies for years,

You Do Not Need to Write Code to Contribute to Open Source

Tony Young, Patch Notes and Progress: Open source projects need honest feedback loops. They need users who are willing to say: here is what I am seeing, here is what is missing, here is why it matters. Without that, maintainers are left building against incomplete information. Your environment, your use case, your edge case, that is data they do not have until someone speaks up.

Outlook and Implications

The impact of this attack by North Korea-nexus actors is broad and has ripple effects as other popular packages rely on axios as a dependency. Notably, UNC1069 isn’t the only threat actor that has launched successful open source supply chain attacks in recent weeks. UNC6780 (also known as TeamPCP) recently poisoned GitHub Actions and PyPI packages associated with projects like Trivy, Checkmarx, and LiteLLM to deploy the SANDCLOCK credential stealer and facilitate follow-on extortion operations.

You Do Not Need to Write Code to Contribute to Open Source

Tony Young, Patch Notes and Progress: Open source projects need honest feedback loops. They need users who are willing to say: here is what I am seeing, here is what is missing, here is why it matters. Without that, maintainers are left building against incomplete information. Your environment, your use case, your edge case, that is data they do not have until someone speaks up.

Outlook and Implications

The impact of this attack by North Korea-nexus actors is broad and has ripple effects as other popular packages rely on axios as a dependency. Notably, UNC1069 isn’t the only threat actor that has launched successful open source supply chain attacks in recent weeks. UNC6780 (also known as TeamPCP) recently poisoned GitHub Actions and PyPI packages associated with projects like Trivy, Checkmarx, and LiteLLM to deploy the SANDCLOCK credential stealer and facilitate follow-on extortion operations.

Outlook and Implications

The impact of this attack by North Korea-nexus actors is broad and has ripple effects as other popular packages rely on axios as a dependency. Notably, UNC1069 isn’t the only threat actor that has launched successful open source supply chain attacks in recent weeks. UNC6780 (also known as TeamPCP) recently poisoned GitHub Actions and PyPI packages associated with projects like Trivy, Checkmarx, and LiteLLM to deploy the SANDCLOCK credential stealer and facilitate follow-on extortion operations.

The role of Canonical and Ubuntu

Contact information for Canonical, the publisher of Ubuntu.

OpenSearch investigation

🔎 Open source distributed and RESTful search engine. - opensearch-project/OpenSearch

Why an LFX mentorship?

There is a common misconception that the LFX Mentorship program is only for students or early-career engineers. With five years of experience in cloud native API gateways and networking, I was already comfortable working with Go, Kubernetes, and Envoy Proxy. However, joining a mature open source ecosystem as a newcomer can still be challenging. Every project has its own architecture, governance model, testing practices, and community norms that take time to understand. At the same time, balancin

The value of open source mentorship

The LFX Mentorship Program demonstrates something important about open source communities: great contributors are developed, not discovered. Many engineers have the technical skills to contribute, but they often lack the guidance or confidence needed to take the first step. Mentorship programs create an environment where new contributors can learn, grow, and eventually become leaders within the community. My experience is a perfect example of that progression. What began as a mentorship project

Looking ahead

Today, I continue contributing to kgateway and am actively working toward becoming a maintainer. The project sits at the intersection of several technologies that I am deeply passionate about: Kubernetes, Envoy Proxy, API gateways, and cloud native networking. Being able to contribute to a project that aligns so closely with my professional interests makes the experience particularly rewarding. Looking back, applying for the LFX mentorship was one of the best decisions I made in my open source j

Running asbmutil in Ubuntu CI to Drive Apple School & Business Manager

talking to Apple School and Business Manager (ASBM) from a headless Linux job.

You Do Not Need to Write Code to Contribute to Open Source

Tony Young, Patch Notes and Progress: Open source projects need honest feedback loops. They need users who are willing to say: here is what I am seeing, here is what is missing, here is why it matters. Without that, maintainers are left building against incomplete information. Your environment, your use case, your edge case, that is data they do not have until someone speaks up.

IA et Open Source, Kubernetes Statistiques Exportateur, IA Exploites

TLDR Data24 juil.

Avec Moshi, vous avez développé une IA vocale capable de conversations très naturelles. Quelle ét...

Moshi est un modèle conversationnel vocal qui permet une interaction sans tour de parole imposé. La machine peut couper la parole à bon escient, comme dans une vraie conversation. Pour y arriver, nous avons évité de passer par une transcription textuelle intermédiaire de la parole, ce qui permet d’aller plus vite et de conserver des informations importantes comme le timbre, l’émotion ou l’accent de la voix.

Mission and Activities

CNCF community in Open Community Groups, where Open Source communities thrive.