The cURL vulnerability reporting policy now routes low and medium severity bugs to public GitHub issues to alleviate maintainer triage burdens.

#cURL #OpenSource #Cybersecurity #HackerOne #BugBounty

https://securityonline.info/curl-vulnerability-reporting-policy-github/?utm_source=mastodon&utm_medium=jetpack_social

We're organising a community mapping event in Llanfairfechan in November!

Whether you have never mapped before or whether you are an experienced mapper, come along for an evening of mapping and fun! 💚

https://osmcal.org/event/5373/

#openstreetmap #osm #mapathon #cymru #wales #opensource

Alt...

Poster with information about the mapping event in Llanfairfechan Library on the 23rd of November at 6PM and QR codes to the event (link is in the post)

Guten Morgen

CachyOS Hello ist das Willkommensfenster, das sich nach der Installation beim ersten Anmelden öffnet. Später findest du es im Startmenü wieder. Es bündelt die wichtigsten ersten Schritte an einer Stelle, damit du nicht durch mehrere Programme suchen musst.

Der Bereich Optimierungen zeigt dir einzelne Dienste mit einer kurzen Beschreibung. Du kannst Bluetooth einschalten, RAM für Browserprofile nutzen, Prozesse bei knappem Speicher beenden lassen, die Prozessprioritäten automatisch anpassen oder einen Hinweis auf Updates im Benachrichtigungsfeld aktivieren. Jeder Schalter lässt sich später wieder ausschalten.

Die Dienstprogramme decken typische Reparaturen und Wartungsaufgaben ab. Dazu gehören eine Aktualisierung des Systems, das Entfernen verwaister Pakete, das Leeren des Zwischenspeichers, das Bewerten der Mirrors, das Zurücksetzen der Schlüsselringe und notfalls eine Neuinstallation aller Programme. Dort sitzen auch die Einstellungen für DNS und die Hilfen bei hängenden Updates.

Der letzte Punkt installiert zusätzliche Anwendungen aus einer sortierten Liste. Für den Einstieg reicht meist ein Blick auf die Schalter und eine Aktualisierung. Ich habe beim ersten Öffnen nur geschaut und später einzelne Punkte ausprobiert. Warst du am Anfang mutiger und hast gleich etwas umgestellt?

#Linux #morgen #CachyOS #OpenSource

#PwnEscape: Kritische Lücke in #LinuxKernel erlaubt VM-Ausbruch | Security https://www.heise.de/news/PwnEscape-Kritische-Luecke-in-Linux-Kernel-erlaubt-VM-Ausbruch-11492131.html #Patchday #Linux #OpenSource

A study by Terra Security reveals flawed security patches surged in 2026, creating recurring bypasses and new vulnerabilities in open source software.

#Cybersecurity #OpenSource #SoftwareSecurity #LinuxKernel #PatchManagement

https://meterpreter.org/flawed-security-patches-surge/?utm_source=mastodon&utm_medium=jetpack_social

Well, it happened. My first security update for my first serious app.

This week the private keys of eight intermediate CA certificates leaked. Browsers blocked them within hours, but software that ships its own certificate list needs its own update. Mine does, so v0.3.4 is out.

Somehow it feels like a rite of passage.

https://github.com/ColorcodedNL/local-transcribe-for-iconik/releases/tag/v0.3.4

#security #opensource

Spell checking without sending everything you type to the cloud

A grammar checker in the browser reads everything you write: mails, chat messages, internal documents, notes about customers. With most tools, all of that goes to a vendor's cloud.

For a long time, LanguageTool was the friendly exception. Its checking engine is open source (LGPL-2.1), it is still actively developed, and you can run it on your own machine. The browser add-on took a different path:

- 2019: the add-on became closed source. The team said they had to pay people to work on it.
- April 2023: Learneo, the parent company of QuillBot, bought LanguageTool. The open-source engine was promised to stay unaffected, and so far it has.
- March 2026: the browser extension became Premium-only. After a 14-day trial, it stops underlining mistakes for free users. The reason given: "The rise of generative AI has made it more challenging to sustainably monetize our offering." Free users are pointed to QuillBot.

So I built Inkling. It is an open-source (Apache-2.0) extension for Chrome and Firefox that talks only to the LanguageTool server you choose. It needs no account and has no trial. It is a fork of the browser extension of Harper by Automattic. The Harper team did the hard work of placing marks correctly in Google Docs and the common rich-text editors.

Running your own server takes one command:

podman run -d -p 8010:8010 docker.io/erikvl87/languagetool

(Docker works the same way.) Then install Inkling, enter http://localhost:8010 and click "Save and Test". Your text never leaves your laptop. A team can also share one server on its internal network.

Chrome: https://chromewebstore.google.com/detail/inkling/lncfkjkgeoepkinifaggpblhpbenemej
Firefox: https://addons.mozilla.org/firefox/addon/inkling/
Source: https://github.com/oetiker/inkling

Thanks to the LanguageTool developers for keeping the engine open, and to the Harper team for the browser integration.

#privacy #opensource #languagetool

Alt...

inkling settins screen

Alt...

inkling demo screen

Alt...

inklink ad

Wie steht ihr zu den geclonten Adobe Programmen von Artcraft?
Hab mich kaum damit befasst aber finde es schon eine krasse Ansage gegen diesen Konzern. Die Frage ist aber auch ob das rechtlich standhalten kann.

#opensource #linux

As I reflected on what I experienced at #FOSDEM, the idea of organizing a devroom dedicated to #diversity was born.

Together with @Gina @_elena we submitted the proposal to organise a #DEI devroom at #FOSDEM27. It got rejected. 😢💔

Every year we leave #FOSDEM inspired by the people we meet & the passion for #opensource. And every year we also find ourselves thinking about how much greater it could be if more people with different perspectives were part of those conversations.

Alt...

An email notification regarding the rejection of the devroom proposal titled "Diversity, Equity, Inclusion and Belonging in FOSS" for FOSDEM 2027. The message emphasizes that the proposal was not accepted and aims to clarify previous communications.

Here's how to automatically post to Mastodon: https://cromwell-intl.com/open-source/python-social-media-automation/?s=mb #OpenSource #Python #TwitterMigration

2026 so far:

• DEF CON 34 — live demo
• RootedCON, Madrid
• HKOSCon, Hong Kong

The roadmap is community-driven — what should we build next?

Discord → discord.gg/5HjujkScC
Code → github.com/BugTraceAI

#infosec #opensource #community #agenticAI

An AI scanner that only guesses is a liability.

In BugTraceAI:

• AI plans and reasons
• Real tools validate
• Evidence kept for every finding — requests, code, traces

Verify first. File second.

→ github.com/BugTraceAI

#appsec #agenticAI #infosec #opensource

Crypto, Mixers, and Traceability: Why Bitcoin Was Never Anonymous

The fifth installment in a series about the darknet. In previous installments, I’ve debunked myths about the darknet, explained how darknet marketplaces work, and discussed the lifecycle of leaked data…

https://vsx.global/traceability-of-cryptocurrencies/

#infosec #privacy #opensource #digitalsovereignty

Time for a new #introduction

Been offline for some time now but getting tired of Instagram again so here we are.

- #union member and #activist from #germany ( #igmetall )
- #coding on #macbook #m1
- Google pixel 7 running graphene os
- lover of #foss / #opensource
- #selfhosting my own services
- #traveling europe in my #oldtimer caravan #vanlife

Wanting to post on #privacy, #coding, #selfhosting.
Lobbying for open software and real social networks with organisations, unions, councils etc.

Some politics may slip in here or there, wanted to do two different accounts but don't have the time to maintain one.

Happy to meet you all!

RT @Marktechpost: ▲ Google hat gerade TorchTPU open-sourced, ein natives PyTorch-Backend, das Google TPUs zu einem gewöhnlichen PyTorch-Gerät macht.

mehr auf Arint.info

#AI #Google #MachineLearning #OpenSource #PyTorch #TPU #arint_info

https://x.com/Marktechpost/status/2112565996674535740

ICS[AP] updated CISA ICS Advisories Master File for 10/20/2026 & the following year's CSVs:

CISA_ICS_ADV_2026_10_20_26.csv

Available @ ICS[AP] GitHub:
https://github.com/icsadvprj/ICS-Advisory-Project/tree/main

#opensource
#vulnerabilitymanagement
#icssecurity

A new repository is now live at Codeberg.org/NoiseBoxWorks/WyseCrawler. All the stuff you need to make a Dell Wyse 3040 Thin Client into a stand-alone router-based data obfuscater.
Stand up to Big Data! Poison your data with NoiseBox.
https://youtu.be/PmEvlzuw-JQ?si=X3fiZHm0hZQYqsqC
#NoiseBox #Privacy #DataPrivacy #OpenSource #SelfHosted #Homelab #Infosec #DellWyse #Wyse3040 #ThinClient #Linux #Python

Brigade 0.30.0 is out. It's my open source tool for tracking and verifying work across coding agents, and as of this release the agents can message each other through one hub.

If you let agents touch real repos: each one can now get a charter saying what it owns, what it must never touch, and how work reaches it. An owners page shows each charter beside its live claims and sessions. Work no charter matches lands in Unassigned.

https://git.brigade.tools

#OpenSource #AIAgents #DevSecOps

Alt...

Slide titled "Every agent gets a charter." A card for Grok Bot, labeled as a charter in the fleet policy. Owns: issues labeled build-approved, and merging its own green PRs. Never touches: deploys, releases, secrets. How work reaches it: an approval label and a builder wake webhook. Beside it, a Live work card lists claims, Grok Bot jobs, sessions, and delegations. A dashed card below reads "Unassigned: work no charter matches." Footer: Brigade 0.30.0, /deck/owners.

Alt...

Slide titled "Codex Cloud, on your board," subtitled "Every task holds a hub lease from launch to finish." Five steps left to right: Lease (hub grants a slot), Submit (sent to Codex), Bind (task id on lease), Renew (while it runs), Release (slot freed). Below: "You get the status and the diff back. Nothing applies until you choose."

Alt...

Diagram titled "Grok Bot dispatches, then gets woken." An arrow from Grok Bot (dispatches the work) to a T3 Code thread on your machine is labeled "Writes the prompt, picks repo, host and seat." The thread feeds a Watcher that checks on a timer, and an arrow from the Watcher back to Grok Bot is labeled "Wakes on finish or question."

Alt...

Slide titled "Cloud agents stay tracked," subtitled "Leases last 6 hours after bind. Jules PRs land when they merge." Jules row: Launch, Bound with a 6-hour lease, Opens PR, PR merges, Landed. Cursor row: Launch, Bound with a 6-hour lease.

Has anyone come across open source online discussion platform software similar in features to #Discourse but not filled with AI slop?

#LazyFed #AskFedi #OpenSource #FreeSoftware

#COSMIC 1.11 Desktop Environment Released with New Touchpad Settings, Better Support for Hybrid GPU Systems, and More https://9to5linux.com/cosmic-1-11-desktop-environment-released-with-new-touchpad-settings

@system76 #Linux #OpenSource #FOSS

Alt...

A screenshot of the COSMIC desktop environment showing the COSMIC Settings app.

An experimental Wine port brings Windows app and gaming support to OpenBSD, with 64-bit applications and even The Witcher 3 running successfully.
https://linuxiac.com/wine-on-openbsd-yes-and-it-can-already-run-the-witcher-3/

#openbsd #opensource

Alt...

An experimental Wine port brings Windows app and gaming support to OpenBSD, with 64-bit applications and even The Witcher 3 running successfully.

Eureka! Gnumeric has arrived for RISC OS. #OpenSource #Spreadsheet
https://www.riscosopen.org/forum/forums/1/topics/20611

Alt...

Gnumeric is depicted, running on RISC OS

edgie.me Statistics:

👤 Users: 9 (Since yesterday: 0 ➡️)
👥 Remote Accounts: 314.757 (Since yesterday: 1.339 ↗️)

😀 Local Emojis: 270 (Since yesterday: 0 ➡️)
🙃 Remote Emojis: 18.624 (Since yesterday: 131 ↗️)

📡 Instances: 10.512 (Since yesterday: 28 ↗️)

📝 Local Statuses: 25.472 (Since yesterday: 49 ↗️)
❤️️ Likes of local Statuses: 1.186 (Since yesterday: 11 ↗️)
🔁 Boosts of local Statuses: 265 (Since yesterday: -15 ↘️)

🗒️ Remote Statuses: 752.481 (Since yesterday: 4.236 ↗️)

🏷️ Hashtags: 193.398 (Since yesterday: 83 ↗️)

🚫 Blocks:
   - Domain Blocks: 23 (Since yesterday: 0 ➡️)
   - Remote User Blocks: 169.000 (Since yesterday: 54 ↗️)
   - Local User Blocks: 34 (Since yesterday: 0 ➡️)

📡 Top 10 Remote Instances:
   - mastodon.social: 856 posts
   - flipboard.com: 526 posts
   - mstdn.social: 142 posts
   - tomkahe.com: 141 posts
   - infosec.exchange: 133 posts
   - chaos.social: 111 posts
   - mastodon.online: 76 posts
   - derstandard.at: 70 posts
   - troet.cafe: 61 posts
   - social.heise.de: 57 posts

🏷️ Top 10 Hashtags:
   - #steam: 75 posts
   - #news: 56 posts
   - #indie: 45 posts
   - #linux: 33 posts
   - #casual: 29 posts
   - #opensource: 28 posts
   - #fotovorschlag: 26 posts
   - #action: 21 posts
   - #adventure: 20 posts
   - #it: 19 posts

#ServerStatistics #Statistics #GoToSocial

The Xodus Nexus is "an experimental open-source project that aims to allow Linux and SteamOS users to access PC Game Pass."

PC Gamer: Microsoft won't like this open source project to get Game Pass working on SteamOS and Linux, but I think it's pretty neat https://www.pcgamer.com/software/microsoft-wont-like-this-open-source-project-to-get-game-pass-working-on-steamos-and-linux-but-i-think-its-pretty-neat/ #Microsoft #Linux #SteamOS #opensource

https://github.com/macports/macports-ports/pull/35738

It appears as if GitHub's Continuous Integration checks have passed OK!

It's up to someone else with commit access to merge it.

Thanks to you, aleteoryx, Uilebheist, nowster, koru, daltux, pmjv and anyone else who may have contributed to this release whom I may have inadvertently overlooked!

Again, my apologies for the delay! Traveling without a laptop and then realizing I needed to rework MacPorts' Makefile.patch made this take a lot longer than I would customarily prefer as far as down streaming latency goes.

In unrelated news: Denver now has FOUR Wax Trax Records locations! Mile High DJ Supply's spot in Arvada has a turntable set up reminiscent of DJ Q*Bert's Octagon (facilitatin 4 skratch deejays jammin together with 8 turntables and 4 mixers feedin into one sound system). The Colorado Symphony's performance of compositions they commissioned by Joe Hisaishi was wonderful! Though, Hisaishi was apparently unable to travel to conduct. Here's hoping he will not have difficulties with future travel plans and will be conducting at the SF Symphony for "Hisaishi conducts Hisaishi" since I have a ticket to one of those three shows later this week.

#snac #MacPorts #OpenSource #ActivityPub #Mastodon #NoDatabaseNeeded
#NoJavaScript #NoCookiesEither #NotMuchBullShit #snacAnnounces

CC: @grunfink@comam.es

9to5Linux: qBittorrent 5.3 BitTorrent Client Is Out as a Major Update, Here’s What’s New https://9to5linux.com/qbittorrent-5-3-bittorrent-client-is-out-as-a-major-update-heres-whats-new @9to5linux @mariusnestor #opensource

ICYMI: Learn how the Fediverse was built in the latest article from our series on public funding of open source

https://www.linux-magazine.com/Online/Features/How-the-Fediverse-Found-Parts-for-Its-Platforms?utm_source=flm

@nlnet @NGIZero @cwebber @Bonfire
#DigitalAutonomy #ActivityPub #Fediverse #OpenSource #community #FOSS

Alt...

© artemisdian, 123RF.com

RT @tianyi: DeepSeek hat sein hochleistungsfähiges, großskaliges Inferenz-Framework DeepInfer unter der Apache-2.0-Lizenz open source gemacht.

mehr auf Arint.info

#AI #DeepInfer #DeepSeek #Inference #MachineLearning #OpenSource #arint_info

https://x.com/tianyi/status/2112471106426900677

My first open source release: Tiny Tells!

Six small status characters in one <tiny-tell> tag.

They're animated like little cartoon characters, so a state change is a reaction, not an icon swap or a spinner.

MIT licensed, 14 KB, no dependencies. https://tinytells.dev

#WebComponents #WebDev #CSS #OpenSource #a11y

#Firefox 158.0.1 Is Out to Block Compromised eMudhra Intermediate Certificates and Fix Bugs and Security Issues https://9to5linux.com/firefox-158-0-1-is-out-to-block-compromised-emudhra-intermediate-certificates

#OpenSource #FreeSoftware #Linux #FOSS

Alt...

A screenshot of Firefox 158.0.1 showing the main window while browsing the 9to5linux.com website and the About Mozilla Firefox dialog.

In Nov 2023 I visited Django Vienna once as an out-of-town guest. Now Stephan Pötschner is stepping down after 13 years, and the last meetup is on November 17.

It feels like local tech meetups are becoming rarer. Not sure if that's true, but many seem to fade once their one organizer can't keep going.

Know someone in Vienna who works with Django or Python? Maybe they'd like to take over.
https://www.meetup.com/django-vienna/

Thanks, Stephan! 🐍

#Django #Python #Vienna #Meetup #OpenSource

I presented at the lighting talk of @hack_lu the patch2vuln is a command-line tool that turns a git-format patch into a structured draft vulnerability advisory using a locally hosted Ollama model.

🔗 GitHub https://github.com/gcve-eu/gcve-lab-patch2vuln

#cve #gcve #vulnerability #cvd #vulnerabilityManagement #opensource #ai

@gcve

Alt...

`patch2vuln` is a command-line tool that turns a git-format patch into a structured draft vulnerability advisory using a locally hosted Ollama model.

#KDE Plasma 6.8.1 Desktop Environment Released with Various Bug Fixes https://9to5linux.com/kde-plasma-6-8-1-desktop-environment-released-with-various-bug-fixes

@kde #Linux #OpenSource

Alt...

A screenshot of the KDE Plasma desktop environment showing the Kickoff application menu

Zaktualizowałem właśnie Katalog Oprogramowania na eteryu.space. 🛠️

Zamiast rozbudowywać go w nieskończoność, postawiłem na rygorystyczne cięcia i przejrzystość. W duchu filozofii distrust nie ma tu aplikacji idealnych – przy każdej mającej kompromisy wprost opisuję ich wady (zbieranie metadanych, zależności od Firebase itp.).

Wyeliminowałem duplikaty, dodałem rzetelne ostrzeżenia i mocno wyeksponowałem narzędzia w 100% offline. Wszystko po to, by świadomie dobierać soft do własnego modelu zagrożeń, a nie ślepo ufać marketingowym hasłom.

Sprawdź nową wersję:
https://eteryu.space/narzedzia/katalog/

#Prywatność #Cyberbezpieczeństwo #OpenSource #Distrust

A true legend of computer science leaves us, Fortnite is coming to Linux, Steam is finally moving away from 32-bit, Microsoft Defender comes to the Linux Desktop, Adobe’s flagship apps are cloned by AI as open source, and a quick KDE Korner.

https://latenightlinux.com/late-night-linux-episode-408/

#podcast #linux #opensource

Alt...

Late Night Linux artwork

PlanetFOSS ist live!

Ein Linux- und FOSS-Nachrichtensammler im Magazin-Stil, auf Deutsch und Englisch. Er sammelt, was die Community schreibt, bündelt Meldungen zum selben Thema und zeigt nur Überschrift, Anreißer und Bild. Ein Klick führt zur Quelle.

Keine Cookies, kein Algorithmus, der dich wütend macht. Nur Kernel, Desktops und gelegentlich ein Systemd-Streit.

Here we go: https://planetfoss.net

#Linux #FOSS #OpenSource #PlanetFOSS

Alt...

Screenshot der Webseite Planet FOSS mit Nachrichtenübersicht zu Ubuntu 26.10 und KDE Plasma 6.8 in einem Browserfenster

RT @mylifcc: Die gesamte Online-Community macht sich Sorgen, dass KI-Code („AI Slop“) die Open-Source-Welt mit schlechtem Code überschwemmt und zum Einsturz bringt. Das Ergebnis bei der Top-Open-Source-Datenbank PostgreSQL war jedoch völlig anders:

mehr auf Arint.info

#BugFixing #KIKodierung #OpenSource #PostgreSQL #Softwareentwicklung #arint_info

https://x.com/mylifcc/status/2112219727820898384

heise+ | All Systems Go!: Wie #Systemd Image-basierte #Linux -Systeme vorantreibt | c't Magazin https://www.heise.de/hintergrund/All-Systems-Go-Wie-Systemd-Image-basierte-Linux-Systeme-vorantreibt-11482750.html #heiseplus #OpenSource #KDElinux

The GNOME OS preview is now public with GNOME 51.1, offering x64 and Arm64 images for a real PC or a virtual machine.

#GNOME #GNOMEOS #Linux #GNOME511 #Flatpak #systemd #OpenSource #LinuxDesktop

https://securityonline.info/gnome-os-preview/?utm_source=mastodon&utm_medium=jetpack_social

Dutch tax authorities cancel Microsoft 365 cloud rollout – and turn toward open source https://zdnet.com/business/dutch-tax-authorities-cancel-microsoft-365-cloud-rollout/ via @ZDNet & @sjvn

Another European move toward digital sovereignty has curtailed the adoption of the US workplace suite in favor of an #opensource approach.

Looks like Proton with Intel XeSS is set for some improvements, with Intel submitting code directly to Valve.
https://www.gamingonlinux.com/2026/10/intel-submits-code-to-proton-to-improve-xess-to-use-the-fast-upscaler-xmx/

#OpenSource #Wine #Intel #Proton #Misc

As is tradition, a new release of GE-Proton came with issues and so another hotfix is out with GE-Proton 11-11.
https://www.gamingonlinux.com/2026/10/ge-proton-11-11-released-to-fix-more-issues-with-windows-games-on-steamos-linux/

#OpenSource #Proton #Misc #GEProton

If anyone is at the @Nextcloud Enterprise Day in Copenhagen today, come say hi! 👋

#nextcloud #nextcloudconf2026 #opensource #openproject #conference

Alt...

A big banner saying Nextcloud Enterprise Day Copenhagen 2026

Alt...

A selfie with my badge

Anthropic's free OSS Scanner sends enrolled projects model-generated vulnerability reports without human review. It says so itself.

I just enrolled Sulu (PR #597). Getting in took a checklist, a CLA and a case-by-case decision. The reports that follow skip all of that. Finding a vulnerability got nearly free; checking one is still a maintainer's job.

https://johanneswachter.dev/shorts/the-scanner-report-nobody-reviewed-before-sending/

#OpenSource #Security #AI

The Linux Assisted-by tag is going away after maintainers agreed it misreports AI use, but human accountability stays.

#Linux #LinuxKernel #AssistedBy #AIAssistedCoding #OpenSource #LinusTorvalds #KernelDevelopment #Checkpatch

https://securityonline.info/linux-assisted-by-tag/?utm_source=mastodon&utm_medium=jetpack_social

Guten Morgen

Der CachyOS Kernel Manager ist ein grafisches Werkzeug für die verschiedenen Kernel. Du siehst eine Liste der verfügbaren Varianten, etwa den Standardkernel, eine LTS Variante mit längerem Support, einen für Leistung, einen für Echtzeit, einen gehärteten oder einen für Server. Ein Häkchen setzen, auf Ausführen drücken, und das Paket kommt aus den normalen CachyOS Quellen. Beim Entfernen nimmst du das Häkchen wieder weg.

Unter Konfigurieren stellst du dir einen eigenen Kernel zusammen, mit Scheduler, Taktfrequenz und weiteren Optionen. Danach baut das Werkzeug die Pakete und installiert sie nach deiner Bestätigung. Für den Alltag reicht meist der vorhandene Kernel, für Neugierige ist der Baukasten aber interessant.

Hast du schon einmal einen anderen Kernel ausprobiert?

#Linux #morgen #CachyOS #OpenSource

Linux-Kernel 7.3 ist da: Korrekturen quer durch die Bank

Linus Torvalds hat den Linux-Kernel 7.3 veröffentlicht. Die Änderungen sind zahlreich. Zuletzt gab es noch Korrekturen querbeet.

https://www.heise.de/news/Linux-Kernel-7-3-ist-da-Korrekturen-quer-durch-die-Bank-11492655.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#IT #Journal #Linux #OpenSource #LinuxKernel #Updates #news

Spyware Arrived Through an Ad Auction. The AdFection Case Shows How Much Ads Reveal About You

Researchers at Citizen Lab at the University of Toronto published a report on October 15, 2026, according to which spyware from the Israeli company Candiru…

https://vsx.global/adfection-spyware-ads/

#infosec #privacy #opensource #digitalsovereignty

This is my first time manufacturing a circuit board with PCBWay. It's pretty cool how you can see every step of production live. It's a breakout board for flashing the Valetudo firmware onto a vacuum robot. It's supposed to be delivered from China by Friday, which is crazy to me.

I would have preferred to get it done in Europe, but the Chinese were cheaper, faster, and had no issues with manufacturing a non-standard thickness of 1.2 mm. 🤷🏻‍♂️

Any recommendations?

#OpenHardware #OpenSource #PCBWay

Alt...

Screenshot of the PCBWay website listing every step of producing a printed circuit board with a corresponding timestamp. The current step is "AOI", the last step was "Etching".

The Ubuntu 26.10 release delivers GNOME 51, Rust-powered uutils core tools, local Myna voice AI, and expanded TPM hardware encryption.

#Ubuntu #Linux #Canonical #GNOME51 #OpenSource

https://securityonline.info/ubuntu-26-10-release-rust-gnome-51/?utm_source=mastodon&utm_medium=jetpack_social

RT @AntLingAGI: Heute veröffentlichen wir 5 Ming-3.0-Modelle in drei Sprachfamilien.

mehr auf Arint.info

#ASR #AudioTech #Ming3 #OpenSource #SpeechAI #TTS #arint_info

https://x.com/AntLingAGI/status/2112210811997540475

Discover the new ReactOS NTFS installation support. The open-source Windows alternative finally drops its FAT32 limits and moves toward NT 6 architecture.

#ReactOS #NTFS #OpenSource #WindowsAlternative #TechNews

https://dailytechnow.com/reactos-ntfs-installation-support/

Linux users, settle this debate.

Is there any distro that genuinely beats Ubuntu for everyday use?

#Linux #Ubuntu #OpenSource

Prove a file existed, unchanged, by a certain date, or check a proof someone sent you. Free, using OpenTimestamps and Bitcoin, with no coins or wallets involved. The file is fingerprinted in your browser and never uploaded. We've timestamped 978 of our own documents this way, with no failures.
https://makeprivacy.org/tools/timestamp/
#OpenTimestamps #Bitcoin #DigitalEvidence #OpenSource

https://github.com/macports/macports-ports/pull/35701

It has been merged!

I didn't finish my MacPorts' update to snac yet, because the Makefile patch broke and I've been scampering around all day with a rental car more or less putting all the vinyl I purchased from the Kishi Bashi, AMP Festival, and Denver Wax Trax into storage.

I sincerely need to overhaul my storage unit with much better vinyl storage and that requires time and money, neither of which I seem to have in abundance, just the opposite. ;(

I'll hopefully have more opportunity to fix the Makefile patch for MacPorts' snac tomorrow? I'm currently doing laundry (no more clean clothes and I did laundry while I was in Montreal too! I travel lightly, yet that means I don't have an enormous wardrobe either and due to attempting to air dry my clothes to maximize their longevity? I may be wearing the same outfit I am presently wearing for another day or two.)

I'm exceedingly grateful that rueda posted a Got release announcement to undeadly.org at least! I was planning on that yet, clearly have been burning the candle at all ends as it were.

#Got #GameOfTrees #MacPorts #OpenSource #VersionControl #Git

"Hackers hit AI coding tool OpenCode, running up charges on users’ AI accounts"

"OpenCode is an open source AI coding agent that's become a popular alternative to Claude Code and Cursor."

https://techcrunch.com/2026/10/19/hackers-hit-ai-coding-tool-opencode-running-up-charges-on-users-ai-accounts/

#OpenSource

🧵 13/n THIS one is special!

There are proper lyrics in the description - the YT-auto-gen-CC ones are rubbish.

A #Folk #Song type Ode to #FreeSoftware #FreeHackers - it's a proper stand-alone piece, unique lyrics, not the usual RMS remix.

#GNU #OpenSource #Linux #FLOSS #FOSS

I'm actually in tears - amazing grasp on reality! THAT is the point of all the effort!

..from 18 years ago!

That's the best one i've seen tonight: https://www.youtube.com/watch?v=6B8SSKgkALc

The Open Source Accessibility Framework helps open source projects turn accessibility goals into public, trackable progress. https://open-source-accessibility.github.io/Open-Source-Accessibility-Framework/ #OpenSource #Program #Programming #Accessibility #A11y

🚨 Just a few days left to submit your session proposal for DrupalCon Orlando 2027! Deadline is Tuesday, October 20.

🔗 Details: https://events.drupal.org/orlando2027/drupal-day
🔗 Submit here: https://sessionize.com/drupalcon-orlando2027/?e=8e8f61

#Drupal #DrupalCon #DrupalConOrlando #OpenSource

🚀 ONE DAY LEFT! DrupalCon Orlando 2027 session proposals close TOMORROW, October 20!

As Community Speaker Review Chair, I want to see fresh voices, bold ideas, and diverse perspectives!

🎤 First-time speaker? Seasoned pro? Your experiences matter. Submit your session!

#DrupalCon #DrupalConOrlando #OpenSource

#Audacious 4.6.2 Open-Source Media Player Released with Wayland Improvements, Feature Parity for the Qt Winamp UI https://9to5linux.com/audacious-4-6-2-open-source-media-player-released-with-wayland-improvements

#OpenSource #Linux #FreeSoftware #FOSS

Alt...

A screenshot of Audacious 4.6 showing the main window, the plugins dialog, and the About dialog.

proton-ge-custom has updated to version GE-Proton11-11. Check it out here: https://github.com/GloriousEggroll/proton-ge-custom/releases/tag/GE-Proton11-11
#foss #OpenSource #linuxGaming

A critical Laravel authentication bypass (CVSS 9.2) in TokenGuard enables account takeover without a token. Upgrade to 13.29.0 or 12.68.0.

#Laravel #PHP #AuthenticationBypass #AccountTakeover #WebSecurity #OpenSource #PatchNow #CyberSecurity

https://securityonline.info/laravel-authentication-bypass-tokenguard/?utm_source=mastodon&utm_medium=jetpack_social

📡 The RSS Universe directory just grew by 15 tools, all of them suggestions from people who read the site and noticed something missing.

Akregator, Nextcloud News, ReadKit, News Explorer, Reader Ultra, Leed, Salut, Sikio, FeedCity, micro.blog, Feedlynx, Feed Canary and more.

Now 122 apps, tools and standards, every link checked live.

https://toolbox.rss.here.now/

#rss #opensource #feedreader

Alt...

The RSS Universe directory site. The headline reads "RSS isn't dead. It's the resistance." Below it, stats show 122 apps and tools across 13 categories, 100% of links verified live. A "What's new" grid lists the 15 additions from the Oct 19, 2026 update: FeedCity, Micro.blog, Leed, Nextcloud News, Salut, News Explorer, ReadKit, Akregator, Reader Ultra, Sikio, feed-repeat, feed-mixer, Feedlynx, Feed Canary and Feed Key.

The breach was confirmed on October 17.

Infosecurity-Magazine: OpenCode Breach Could Affect OpenAI, Anthropic and Google https://www.infosecurity-magazine.com/news/opencode-breach-openai-anthropic/ #infosec #databreach #opensource #Anthropic #Google #OpenAI

How safe is Proton Pass if installed from the FlatHub?

The ownership of the me.proton.Pass app ID has not been verified and it may be a community package

I usually trust community maintained open source packages. But with the password managers I want to be extra careful. A password manager app is probably the most sensitive piece of software in the PC. So I want to be 100% sure it's safe. Is it safe? Question.

@protonprivacy
#ProtonPass #Flatpak #Flathub #PasswordManager #ArchLinux #GitHub #OpenSource #Proton #Pass #Keepassxc #Bitwarden

Vercel-Index: Open-Weight-Modellnutzung erstmalig über 70 Prozent

Laut Vercels AI Gateway Index verarbeiten Open-Weight-Modelle mittlerweile über 70 Prozent aller Token. Die Wechselbereitschaft steigt.

https://www.heise.de/news/Vercel-Index-Open-Weight-Modellnutzung-erstmalig-ueber-70-Prozent-11488361.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#Anthropic #China #DeepSeek #IT #KünstlicheIntelligenz #OpenSource #OpenAI #news

Rückblick: OpenSSF-Datenbank erweitert GitHubs Malware-Warnungen

Mithilfe eines OpenSSF-Repositorys warnt GitHub seit Juli vor Malware in acht Paket-Ökosystemen. In einer Fallstudie zieht die OpenSSF jetzt Bilanz.

https://www.heise.de/news/Rueckblick-OpenSSF-Datenbank-erweitert-GitHubs-Malware-Warnungen-11492599.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#GitHub #IT #OpenSource #Security #Sicherheitslücken #news

OhMyDebn 4.12.0 is out! 😁

Say hello to the grin: it shimmers, it winks, and it wears your theme's colors.

Also new:
• Claude Desktop as an optional AI app
• The OhMyDebn Menu gets its own button on the panel
• Terminal prompts appear about 3x faster
• Claude Code, Brave and PowerShell keys are checked against the vendors' published fingerprints
• 19 fixes and 12 updated components

Release notes: https://ohmydebn.org/release-notes/

#Linux #Debian #Ubuntu #LinuxMint #Cinnamon #OpenSource

Das neue #Linux 7.3 ist da. Das #Update für den #OpenSource-#Kernel liefert Optimierungen für Dateisysteme sowie eine verbesserte Speicherverwaltung bei AMD-Grafikkarten, erweiterten CPU-Support und mehr. https://winfuture.de/news,162037.html?utm_source=Mastodon&utm_medium=ManualStatus&utm_campaign=SocialMedia

heise+ | Linux-Distribution Ubuntu 26.10 im Test: Linux 7.3 und KI-Funktion

Das diesjährige Herbst-Release von Ubuntu Linux bringt Gnome 51, einen taufrischen Kernel, viel Rust – und macht erste Schritte zum KI-Desktop.

https://www.heise.de/tests/Linux-Distribution-Ubuntu-26-10-im-Test-Linux-7-3-und-KI-Funktion-11489069.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#Canonical #Gnome #IT #KünstlicheIntelligenz #Linux #LinuxDesktop #OpenSource #Rust #Ubuntu #news

New in #LibreOffice 26.8: Better accessibility – LibreOffice continues its accessibility work with improvements that make the interface easier to navigate using assistive technologies. https://wiki.documentfoundation.org/ReleaseNotes/26.8#Accessibility #foss #opensource #freesoftware

We've been tinkering, building, polishing, and probably drinking too much coffee. ☕

The result? Dominion Solutions has a shiny new website!

Same engineers. Same love for solving messy software problems. Better-looking home on the internet.

Custom software, legacy modernization, DevOps, and plenty of code under the hood.

Come have a look! Link in the replies. 👇

#WebDevelopment #SoftwareEngineering #SmallBusiness #OpenSource

github-workflow : une TUI en Rust qui affiche le statut de vos dépôts GitHub et de vos branches directement depuis le terminal Linux.

Elle repose sur Ratatui et se veut légère, avec une consommation de ressources minimale.

Open source sous licence MIT ⬇️
https://github.com/jorgeandrecastro/github-workflow

#Rust #Linux #OpenSource #Programming #WebDev

📬 Ma veille dev, chaque vendredi par email → https://l.camilleroux.com/sig-a9L

Alt...

Capture d'écran d'une interface en ligne de commande affichant un tableau de bord GitHub avec une liste hiérarchisée de dépôts, branches et commits. L'écran montre le projet "GITHUB-WORKFLOW" avec plusieurs branches et leurs descriptions de modifications associées.

🗳️ OWASP Board Election voting is OPEN!

3 Board seats are up for election. Make your voice heard and help shape OWASP’s future!

📩 Check your personal and OWASP email for your ballot.

⏰ Closes Oct 30, midnight UTC.

Vote now: https://owasp.org/board/elections/2026

#community #opensource #boardelections

Discover the major updates in Linux kernel 7.3, featuring advanced security, Rust support, and enhanced hardware compatibility. Download it today.

#LinuxKernel #Linux73 #OpenSource #LinusTorvalds #Rust #CyberSecurity

https://dailytechnow.com/linux-kernel-7-3-released/

Länderbericht #Schweiz 🇨🇭: Von der Akzeptanz zur Verankerung von #OpenSource (Top News)

Open Source: Von Option zu Grundsatz
https://www.ossdirectory.com/de/topnews/details/laenderbericht-schweiz-von-der-akzeptanz-zur-verankerung-von-open-source #DigitalSovereignty

#BleachBit 6.0.6 System Cleaner Adds Support for #Ubuntu 26.10 and #openSUSE Leap 16.1, More Cleaners, and Performance Improvements https://9to5linux.com/bleachbit-6-0-6-system-cleaner-adds-support-for-ubuntu-26-10-opensuse-leap-16-1

#Linux #OpenSource

Alt...

A screenshot of BleachBit 6.0.6 showing the main window and the About dialog.

Guten Morgen

Der CachyOS Paketinstaller ist ein grafisches Werkzeug, das beliebte Anwendungen in einer sortierten Liste zeigt. Du findest ihn im Startmenü unter System, der Eintrag heißt CachyOS Package Installer. Alternativ startest du ihn im Terminal mit cachyos-pi.

Hinter der Oberfläche stecken Kategorien wie Browser, Kommunikation, Grafik oder Virtualisierung. Klappst du eine Kategorie auf, siehst du die enthaltenen Programme, zu vielen gibt es eine kurze Beschreibung und manchmal einen Screenshot. Über das Suchfeld findest du ein Programm auch direkt über seinen Namen. Ein Häkchen setzen, Installieren drücken, und der Installer holt die Pakete über die normalen CachyOS Quellen.

Er ist kein Ersatz für pacman, sondern eine Hilfe für den Einstieg. Wer ein Programm bereits hat, kann es hier auch entfernen oder neu installieren. Für alles, was nicht in der Liste steht, bleibt das Terminal zuständig.

Suchst du neue Programme lieber in einer Liste oder direkt im Terminal?

#Linux #morgen #CachyOS #OpenSource

Does someone share this (kind of weird) feeling?

In opensource projects, if I git-fetch and I see a dozen of branches appear in the upstream repository, I am immediately repelled. Because I expect contributors not to push into the upstream repository, but PR from their "forks".

But in work project, everyone pushing into the same "upstream" repository is perfectly normal for me.

Kind of weird feeling IMO.

#github #gitlab #softwaredevelopment #opensource #work

A triple helping of community Proton builds to report on for you today with Proton-CachyOS 11.0-20261014, DWProton 11.0-15 and GE-Proton 11-10 released.
https://www.gamingonlinux.com/2026/10/proton-cachyos-11-0-20261014-dwproton-11-0-15-and-ge-proton-11-10-released/

#OpenSource #SteamOS #Proton #NewRelease #Misc #SteamDeck #SteamMachine #GEProton

Linux kernel 7.3 has officially been released, bringing with it plenty of improvements for Linux gaming.
https://www.gamingonlinux.com/2026/10/linux-kernel-7-3-is-out-with-some-nice-improvements-for-gaming/

#OpenSource #Kernel #NewRelease #Misc

proton-ge-custom has updated to version GE-Proton11-10. Check it out here: https://github.com/GloriousEggroll/proton-ge-custom/releases/tag/GE-Proton11-10
#foss #OpenSource #linuxGaming

🎵 ffplay als Lösung zwischen mpv und VLC! 🐧

Mein universelles Bash-Skript spielt Musik direkt über FFmpeg im Terminal ab – unkompliziert und skriptbar. Hier läuft Christian Punk & Metal, während FFmpeg die Audioinfos ausgibt. Linux, Shell und Musik vereint! 🤯

#Linux #Bash #FFmpeg #ffplay #OpenSource #CLI #PunkRock #Metal

Alt...

Linux-Desktop mit Terminalfenster: Ein universelles Bash-Skript startet ffplay und spielt eine MP3 von 7 Angels 7 Plagues ab. FFmpeg zeigt Audio-Metadaten. In der Mitte steht ein ASCII-Pinguin, rechts unten eine dunkle Audio-Visualisierung.

Just upgraded the NoiseBox Wyse Appliance. Based on the Dell Wyse 3040, you plug it into your router, power it up and it starts crawling the web. Plug in a USB flash drive, wait a few seconds, and that drive will have a text file giving you the router IP it was assigned. Put that into a browser and you are at its web control panel! A true plug and play data poisoning machine. https://codeberg.org/NoiseBoxWorks/WyseCrawler
#SelfHosted #OpenSource #Python #Homelab #Linux #Makers #WebCrawler #Debian

#Linux Kernel 7.3 Officially Released, This Is What’s New https://9to5linux.com/linux-kernel-7-3-officially-released-this-is-whats-new

#LinuxKernel #OpenSource

Alt...

Linux Kernel 7.3 - What's New

Przy okazji, dziś katalog narzędzi też dostał update. Wśród nowych pozycji jest WG Tunnel, ten sam klient WireGuard, którego użyłem w artykule powyżej.

📚 Katalog Oprogramowania +9

• Proton Pass, Proton Drive
• IVPN, WG Tunnel
• Cryptomator, CryptPad
• Notesnook, Verified Apps
• CoMaps (nowa sekcja: Mapy i nawigacja)

Wszystko open source, z linkami do źródeł. Jeśli szukasz więcej narzędzi prywatnościowych, warto zajrzeć:

https://eteryu.space/narzedzia/katalog/

#prywatność #opensource #foss #cyberbezpieczenstwo #privacy #cybersecurity

Mullvad ogłosił planowane zamknięcie publicznego resolvera DNS. Sam szukałem darmowej alternatywy dla Mullvad VPN i tak powstał ten artykuł.

Bo Proton to chyba jedyny darmowy VPN wart uwagi. A gdy połączysz go z szyfrowanym DNS i filtrowaniem reklam, dostajesz pełny zestaw, za który normalnie trzeba płacić.

Standardowy WireGuard tego nie potrafi. WG Tunnel tak.

Link do artykułu:
https://eteryu.space/poradniki/darmowy-vpn-z-filtrowaniem-dns/?v=3

#Prywatność #Privacy #Cyberbezpieczeństwo #Cybersecurity #VPN
#WireGuard #DoH #DoT #ProtonVPN #Proton #Mullvad
#NextDNS #Hagezi #OpenSource

@anvil_blog I like hardware keys, but I would recommend @nitrokey they are open source and work grate

#OpenSource #HardwareSecurityKeys #2FA

#LinuxKernel: Maintainer wollen „Assisted-by“-Tag streichen | Developer https://www.heise.de/news/Linux-Kennzeichnung-von-KI-Code-soll-entfallen-auch-Torvalds-nutzt-LLMs-11490345.html #Linux #OpenSource #development #ArtificialIntelligence #AI

Linux Mint 27 will include a suite of new software, including a more capable system monitor.

I took a development version for a spin and came away impressed – and with more disk space.

https://www.omgubuntu.co.uk/2026/10/linux-mint-new-system-monitor?v2

#linuxmint #linux #openSource

#Libreboot startet jetzt auch per #UEFI durch | iX Magazin https://www.heise.de/news/Libreboot-startet-jetzt-auch-per-UEFI-durch-11491142.html #Linux #OpenSource

📋 #Pele is a lightweight #opensource library that renders #Mermaid diagrams to SVG, themed with CSS variables. Built by the #Obsidian team to render diagrams fast and match the app's theme #javascript #webdev

⚡ Compared to Mermaid.js: 230 kB gzipped bundle instead of 1.6 MB (6× smaller), 0.05–0.3 ms render time instead of 6–82 ms (up to 500× faster), and zero direct dependencies instead of 23

🧵👇

Vor zwei Wochen habe ich hier mit einem leeren Profil angefangen. Heute sind es über 40 Menschen, die mitlesen, und viel mehr Gespräche, als ich erwartet hatte. Das ist der Teil, der mich am meisten überrascht hat.

Die Themen waren bunt. Dateisysteme, Backups, freie Software, Lizenzen, Kachelfenster. Aber die besten Momente waren nicht die Erklärungen, sondern die Antworten. Jemand erzählt von einer geretteten Platte, jemand anderes von seinem ersten Kernel, und plötzlich wird aus einem Beitrag ein Gespräch. Genau dafür bin ich hier.

Nächste Woche nehme ich mir CachyOS vor. Den Paketinstaller, den KernelManager, Hello, die Einstellungen und die Paketquellen. Dazu wieder eine Frage am Samstag und ein Rückblick am Sonntag.

Was hat dir in dieser Zeit hier am meisten gefallen?

#Linux #CachyOS #Community #OpenSource

Minął weekend. Wczoraj udało się trochę podłubać przy kodzie: dodałem trzecią zasadę do distrust.pl i dopracowałem typografię strony. Dzisiaj dałem sobie na luz, ale kto wie, może przed snem jeszcze coś przysiądę.

Czasem warto poświęcić chwilę, żeby nasze cyfrowe otoczenie było choć odrobinę lepsze. Bo prywatność to nie jednorazowa konfiguracja, tylko ciągła praca.

A jak u Was mijają weekendy z technologią? Też zdarza się Wam dłubać przy projektach?

#prywatność #opensource #buildinpublic

RT @vllm_project: 🚀 vLLM v0.32.0 ist verfügbar! 814 Commits · 363 Mitwirkende · 121 Erstautoren

mehr auf Arint.info

#AI #DeepLearning #MachineLearning #NLP #OpenSource #vLLM #arint_info

https://x.com/vllm_project/status/2111814711956168760

The Document Foundation, the non-profit behind #LibreOffice, now has its own visual identity: https://blog.documentfoundation.org/blog/2026/10/09/tdf-visual-identity/ #foss #openSource #freesoftware

Alt...

TDF logo

Tell me what made you #change to #Linux?

(If you want tell your distro and GUI.)

#meme #story #foss #OpenSource #distro #desktop #gui #os #Software #tux #computer #freedom #distribution

Alt...

Tell me what made you change to Linux?

At our #Proxday, several people came in touch w/ me & said that LVM thin-provisioned with iSCSI, FC or NVMeoF would be a dream. Let me make it become real!

PS: My mate @formorer@rollenspiel.social is also working on something huge! Guess, we should make a special event about storage plugins for Proxmox VE - maybe within the next virtualization gathering at @credativde@mastodon.social or maybe as a special edition. Let's see, stay tuned!

More about it: https://gyptazy.com/blog/proxmox-shared-block-storage-with-lvm-thin-provisioning-provider/
Demo: https://youtu.be/pQHazr50PVg

#PVE #opensource #storage #proxday

Alt...

Adding LVM Thin as shared storage in Proxmox

Alt...

Assigning the LVM Thin to a VG

#Ubuntu 26.10: #Linux 7.3 und KI-Assistent im Gepäck | heise online https://www.heise.de/news/Ubuntu-26-10-Linux-7-3-und-KI-Assistent-im-Gepaeck-11488457.html #ArtificialIntelligence #AI #OpenSource #Linux73 #ubuntu2610

The first week of Djangonaut Space is in the books and it was a brilliant one for me. I had so much fun getting to know people in the community, added a beautiful new hoodie to my swag collection, spoke to two groups of students and started my first contributions to Djangonaut Space and Django Girls projects.

https://hamatti.org/posts/djangonaut-log-1-lift-off-and-first-week-in-djangonaut-space/

@djangonaut #DjangonautSpace #DjangoGirls #Django #Python #OpenSource

Episode 39 of Dark Blue Weekly released

https://darkblueproject.com/sites/news/dbw-e39.php

#darkblueweekly #darkblueproject #ubuntu #ubuntu2610 #lubuntu #kubuntu #xubuntu #ubuntumate #ubuntubudgie #gnomeos #gnome #gnome51 #kdeplasma #kdeplasma68 #kde #linux #linuxdesktop #linuxserver #opensource #freesoftware

#GNOME 51.1 Is Out to Improve Drag and Drop Between #Wayland and Xwayland Clients https://9to5linux.com/gnome-51-1-improves-drag-and-drop-between-wayland-and-xwayland-clients

@gnome #Linux #OpenSource #FOSS

Alt...

GNOME 51.1

Heute so: Migration von TrueNAS CORE -> TrueNAS SCALE bei einem Kunden.
Also quasi der komplette Server – Daten, VMs, das volle Programm.
Wir reden hier immerhin von einem Wechsel von #FreeBSD nach #Linux, was auch eine komplette Änderung des genutzten VM Stacks bedeutet (BHYVE -> KVM)!

Der Plan war simpel: #ZFS-Replikation auf die neue Kiste, Snapshots inklusive. Nach ein paar Anpassungen liefen die VMen einfach wieder an. Einziger manueller Kraftaufwand: Netzwerkschnittstellen – der Klassiker bei jedem Umzug.
Ohne den wär's fast verdächtig glatt gelaufen.

Und mal ehrlich: #ZFS ist bei so was wirklich ein Geschenk des Himmels.
Was woanders ein schweißtreibendes Kopier-Karussell mit Bangen um die Daten wäre, ist mit ZFS-Replikation eher ein gemütliches:

• Replizieren
• Kaffee holen
• Anpassen, starten, fertig

Und falls ihr vor so einem Umzug steht und euch nicht so recht traut: Meldet euch einfach bei mir. Egal ob CORE zu SCALE, ein ganzes NAS oder nur eine kleine ZFS-Frage – ich helfe gerne. Wer noch auf CORE hängt: Die Migration auf SCALE ist weniger dramatisch, als man denkt. Versprochen!

#TrueNAS #ZFS #Homelab #Sysadmin #Migration #OpenSource

@twipped

But FOSS' success up until this point has shown the exact opposite.

FOSS was bootstrapped by using proprietary software every single day for more than a decade, at least.

Most FOSS developers regularly used proprietary technologies daily for their work for the entirety of FOSS' history.

Plus, what @copiesofcopies said:
https://fedi.copyleft.org/@copiesofcopies@social.coop/117457049015278425

Cc: @cwebber

#LLMGenAI #LLM #AI #FOSS #SoftwareFreedom #OpenSource #FreeSoftware

Okay, now this is getting interesting... I admit I haven't tried Linux on my T490s in quite a while, after my earlier attempts to get the built-in 5G modem to work failed.

Following yesterday’s controversy over why, in my attempt to boycott U.S. products and services, I’d choose Microsoft over Fedora of all things (because, as I said, I need Windows for work—just like any other common operating system), I installed a different SSD today just for fun and put the latest beta of Fedora 45 on it. And look at that: the modem works with it! Quite obviously, the kernel finally has the necessary drivers built in.

So now I can use Linux on the ThinkPad again, even if it’s a Linux distribution under IBM’s umbrella… at the end of the day, it’s still a bit better than Microsoft. And so the only Windows device still running is the NUC—that’s more than enough.

#linux #fedora #opensource #freesoftware #windows #thinkpad

FOSS NEWS

Firefox 158 released with JPEG XL support:
https://www.omgubuntu.co.uk/2026/10/firefox-158-released-with-jpeg-xl-support

Mozilla Firefox 159 Enters Public Beta Testing with Wayland Improvements:
https://9to5linux.com/mozilla-firefox-159-enters-public-beta-testing-with-wayland-improvements

Zen Browser 1.23.3b Ships with Firefox 158 Security Fixes:
https://www.linuxcompatible.org/story/zen-browser-1233b-ships-with-firefox-158-security-fixes/

Ungoogled Chromium 155.0.8059.84-1 Releases for Linux with Chrome's 10 Security Fixes:
https://www.linuxcompatible.org/story/ungoogled-chromium-15508059841-releases-for-linux-with-chromes-10-security-fixes/

Proton product roadmaps for autumn and winter 2026:
https://proton.me/blog/2026-autumn-winter-roadmaps

Proton Pass brings folders and detailed autofill controls:
https://alternativeto.net/news/2026/10/proton-pass-brings-folders-and-detailed-autofill-controls/

Mozilla Thunderbird 158 Email Client Improves Quick Filter Responsiveness:
https://9to5linux.com/mozilla-thunderbird-158-email-client-improves-quick-filter-responsiveness

ONLYOFFICE 10.0 is a ‘fully rebuilt app’ with expanded AI tools:
https://www.omgubuntu.co.uk/2026/10/onlyoffice-10-expands-ai-tools

This Dev Built an Office Suite Because His Wife Kept Going Back to Microsoft Office:
https://itsfoss.com/news/elixiroffice-euro-office-fork/

AliasVault 0.31 brings faster vault synchronization and vault sharing with family members:
https://alternativeto.net/news/2026/10/aliasvault-0-31-brings-faster-vault-synchronization-and-vault-sharing-with-family-members/

addy.io Rules now send signed webhooks for incoming email:
https://alternativeto.net/news/2026/10/addy-io-rules-now-send-signed-webhooks-for-incoming-email/

Waterfox 6.7.6 adds feed controls and fixes startup hangs:
https://alternativeto.net/news/2026/10/waterfox-6-7-6-adds-feed-controls-and-fixes-startup-hangs/

Kdenlive 26.08.2 Release: Stability Fixes for Project Handling, Proxies, and Audio:
https://www.linuxcompatible.org/story/kdenlive-26082-release-stability-fixes-for-project-handling-proxies-and-audio/

OBS Studio 33.0.0-RC2 Released: Major CEF and Plugin Overhaul:
https://www.linuxcompatible.org/story/obs-studio-3300rc2-released-major-cef-and-plugin-overhaul/

PhotoFlare 1.7.5 adds ARM packages and macOS fixes:
https://alternativeto.net/news/2026/10/photoflare-1-7-5-adds-arm-packages-and-macos-fixes/

Calibre 9.16 adds Kokoro voices for read aloud, Camoufox integration & updated Kobo driver:
https://alternativeto.net/news/2026/10/calibre-9-16-adds-kokoro-voices-for-read-aloud-camoufox-integration-and-updated-kobo-driver/

PeaZip 11.4 Open-Source Archive Manager Released with Various Improvements:
https://9to5linux.com/peazip-11-4-open-source-archive-manager-released-with-various-improvements

RustGIS is a Desktop GIS Tool That Also Runs in a Browser:
https://itsfoss.com/rustgis-open-source-gis-tool/

(post 5/7)

#WeeklyNews #OpenSource #FOSSNews #FOSS #OpenSourceNews #News #Firefox #ZenBrowser #UngoogledChromium #Proton #ProtonPass #Thunderbird #ONLYOFFICE #ElixirOffice #AliasVault #AddyIO #Waterfox #Kdenlive #OBS #OBSStudio #PhotoFlare #Calibre #PeaZip #RustGIS #GIS #MozillaFirefox #Browser #Email #ContentCreation #EbookManager #FosseryTech

Godot 4.8 Beta 1 Released: Feature Freeze and Final Testing Begin:
https://www.linuxcompatible.org/story/godot-48-beta-1-released-feature-freeze-and-final-testing-begin/

Bevy 0.20 brings major rendering, shading, and UI enhancements to open-source game engine:
https://alternativeto.net/news/2026/10/bevy-0-20-brings-major-rendering-shading-and-ui-enhancements-to-open-source-game-engine/

Zed Editor 1.24.2 Release: Git Tags, Agent Terminal Drag-and-Drop, and a 23% Smaller Linux Build:
https://www.linuxcompatible.org/story/zed-editor-1242-release-git-tags-agent-terminal-draganddrop-and-a-smaller-linux-build/

VSCodium 1.140.06880 Removes Copilot, Claude, and Codex AI SDKs:
https://www.linuxcompatible.org/story/vscodium-114006880-removes-copilot-claude-and-codex-ai-sdks/

Apache NetBeans IDE 32 RC1 Released: Final Testing Phase Begins:
https://www.linuxcompatible.org/story/apache-netbeans-ide-32-rc1-released-final-testing-phase-begins/

Codeberg Pages legacy server to be discontinued in favor of git-pages, hosted pages need to be migrated manually:
https://blog.codeberg.org/migrate-your-site-to-the-new-git-pages-backed-codeberg-pages-now-were-sunsetting-codeberg-pages-v2.html
(Interesting, I ran the migration check, for the two FosseryWeb sites, and it says that they are still on the legacy server, which is weird, because I clearly remember migrating those when the migration option came out earlier, whatever, will take a look at it again.)

Node.js 26.12.0 and 24.22.0 Krypton: What Changed and How to Upgrade:
https://www.linuxcompatible.org/story/nodejs-26120-and-24220-krypton-what-changed-and-how-to-upgrade/

Rust 1.99.1 Released: Three Critical Bugs Fixed in Record Two-Week Turnaround:
https://www.linuxcompatible.org/story/rust-1991-released-three-critical-bugs-fixed-in-record-twoweek-turnaround/

Python 3.16 Alpha 1 Released: What's New and the JIT Debate Ahead:
https://www.linuxcompatible.org/story/python-316-alpha-1-released-whats-new-and-the-jit-debate-ahead/

PHP 8.6.0 RC3 Now Available in Ondřej Surý's Repositories for Debian and Ubuntu:
https://www.linuxcompatible.org/story/php-860-rc3-now-available-in-ond%C5%99ej-sur%C3%BDs-repositories-for-debian-and-ubuntu/

Bootstrap returns with version 6 Alpha, bringing ground-up modernization of the framework:
https://alternativeto.net/news/2026/10/bootstrap-returns-with-version-6-alpha-bringing-ground-up-modernization-of-the-framework/

PostgreSQL 19 RC1 Released: Native REPACK, Parallel Autovacuum, and Upgrades to Watch:
https://www.linuxcompatible.org/story/postgresql-19-rc1-released-native-repack-parallel-autovacuum-and-upgrades-to-watch/

SQLite 3.54.1 Released: Fixes 32-bit Heap-Buffer Overflow:
https://www.linuxcompatible.org/story/sqlite-3541-released-fixes-32bit-heapbuffer-overflow/

OpenCode 2.0 officially launches with background agents, Code Mode, and a rebuilt API:
https://alternativeto.net/news/2026/10/opencode-2-0-officially-launches-with-background-agents-code-mode-and-a-rebuilt-api/

NGINX 1.31.7 and 1.30.6 Patch Five Security Flaws, Two Back to 2009:
https://www.linuxcompatible.org/story/nginx-1317-and-1306-patch-five-security-flaws-two-back-to-2009/

(post 6/7)

#WeeklyNews #OpenSource #FOSSNews #FOSS #OpenSourceNews #News #Godot #Bevy #Zed #ZedEditor #VSCodium #NetBeans #NodeJS #Rust #Python #PHP #Bootstrap #PostgreSQL #SQLite #OpenCode #NGINX #FosseryTech

Heute morgen ging es hier um den unsichtbaren Mitbewohner in meinem Rechner. Jetzt interessiert mich, wann ihr ihn zum ersten Mal wirklich bemerkt habt. Nicht die Installation, nicht der erste Befehl, sondern der Augenblick, in dem ihr wusstet, dass ihr bleibt.

Was war euer schönster Moment mit Linux?

#Linux #Community #OpenSource #FOSS

Self-Host Weekly (16 October 2026)

#Bitwarden license changes, software updates and launches, a spotlight on #Homelable, and more in this week's #selfhosted recap!

https://selfh.st/weekly/2026-10-16/

#selfhost #selfhosting #opensource #foss #homelab #server #newsletter #privacy #fediverse #mastodon #smarthome #gitlab #forgejo #github #sonarr #jellyfin #sysadmin #devops #development #ai #vibecoding #google #apple

Für wen betreiben wir eigentlich noch unsere Webserver?

Manchmal frage ich mich, für wen wir eigentlich Webprojekte entwickeln, betreiben und pflegen.

Ursprünglich ist die Antwort ganz einfach: für Menschen.

Wir stellen Informationen bereit, entwickeln Anwendungen, ermöglichen Kommunikation und schaffen digitale Angebote, die anderen Menschen einen Nutzen bringen sollen.

Doch wenn ich mir heute unsere Serverprotokolle ansehe, entsteht zunehmend ein anderes Bild.

Nach unseren bisherigen Auswertungen sind mindestens 75 % der registrierten Zugriffe verdächtig oder angreiferisch. Und diese Schätzung dürfte eher zurückhaltend sein.

Natürlich ist nicht jeder automatisierte Zugriff ein Angriff. Suchmaschinen, Monitoring und die Kommunikation föderierter Netzwerke gehören ebenso zum Internet. Doch sie ändern nichts an der Entwicklung, die ich in unserer täglichen Arbeit beobachte.

Wir beschäftigen uns immer intensiver mit der Abwehr von Angriffen, der Erkennung verdächtiger Aktivitäten, der Absicherung von Anwendungen und der Überwachung unserer Infrastruktur.

Firewalls, Sperrlisten, Angriffserkennung, Sicherheitsupdates und Protokollanalysen beanspruchen zunehmend unsere Aufmerksamkeit.

All das ist notwendig. Ohne diese Maßnahmen könnten wir unsere Webprojekte kaum noch zuverlässig betreiben.

Aber genau darin liegt das Problem.

Wir investieren immer mehr Arbeit, um unsere Webprojekte vor Missbrauch zu schützen, statt ihre eigentlichen Funktionen für menschliche Besucher weiterzuentwickeln.

Eine ursprünglich unterstützende Tätigkeit beginnt, unsere eigentliche Arbeit zu verdrängen.

Dabei geht es nicht nur um zusätzliche Kosten für Rechenleistung, Speicherplatz oder Datenverkehr. Es geht um unsere begrenzte Arbeitszeit, unsere Konzentration und unsere Möglichkeiten, neue Ideen umzusetzen.

Jede Stunde, die wir mit der Untersuchung automatisierter Angriffe verbringen müssen, steht uns für die Weiterentwicklung unserer Webprojekte nicht zur Verfügung.

Selbstverständlich gehört Sicherheit seit jeher zum Betrieb von IT-Systemen. Aber ich frage mich zunehmend, ob das Verhältnis zwischen der eigentlichen Aufgabe und dem notwendigen Schutz noch angemessen ist.

Denn wir betreiben unsere Server nicht, um Angriffe abzuwehren.

Wir wehren Angriffe ab, damit wir unsere Server für Menschen betreiben können.

Dieser Unterschied erscheint mir wesentlich.

Wie erleben andere Administratoren und Entwickler diese Entwicklung? Wie viel eurer täglichen Arbeit dient noch unmittelbar der Verbesserung eurer Angebote – und wie viel Zeit verbringt ihr inzwischen damit, deren Betrieb gegen Missbrauch abzusichern?

#Webserver #Systemadministration #ITSecurity #OpenSource #Webentwicklung

New in #LibreOffice 26.8: More descriptive fields – Displaying field names now includes clearer descriptions for document statistics fields, making complex documents easier to understand. https://wiki.documentfoundation.org/ReleaseNotes/26.8 #foss #opensource #freesoftware

#GNOME 50.6 Desktop Environment Released with Fixes for Nautilus, GNOME Shell, Mutter, and Orca https://9to5linux.com/gnome-50-6-desktop-environment-released-with-fixes-for-nautilus-gnome-shell

@gnome #Linux #OpenSource #FOSS

Alt...

GNOME 50.6

In front in the beautiful blue color you can see my SBC powering the playback of this Jazz masterpiece

https://mastodon.bsd.cafe/@Dendrobatus_Azureus/117457433608555207

#SBC #Pi5 #Raspberry #Linux #POSIX #opensource #programming

The week, it seems, is getting worse by the second. I will use my magic to curse Torvald, such should be how we deal with the techno-fascists who abet genocide, and shamelessly, gluttonously ruin the entire experience of life for others. He is going to become TorBALD very soon, inshallah.

(Omitting the 'S' from Torvalds because he is only half a man, much less many. Hallelujah.)

#noai #FOSS #linux #ai #generativeAI #llm #fascism #technofascism #opensource #torvalds

ImpressCMS 2.0.4 Beta is now available for testing

What's new:
- Internal link service with a CKEditor plugin
- Session keep-alive for logged-in users

What's fixed:
- Array config values no longer reading as empty
- System module updates resetting the db version to 47
- Login redirect logic
- CSRF protections improved

This is a pre-release. Please back up and test on a staging site, then report issues on GitHub.

More info: https://www.impresscms.org/modules/news/article.php?article_id=1067&title=imprescms-204-beta-released

#ImpressCMS #OpenSource #CMS #PHP #FOSS

Alt...

ImpressCMS logo with an orange speech bubble reading “2.0.4 Beta”. Text: “Pre-release. Ready for testing.” Features: CKEditor internal links, session keep-alive, CSRF hardening, bug fixes.

🎰 Linux kernel devs drop obligatory confession of AI tool usage

"The Maintainers Summit reached consensus to deprecate the Assisted-by Tag," said Sasha Levin, a Linux kernel developer and engineer at Nvidia, in a message to the Linux kernel mailing list last week. "Remove the documentation requiring it."

https://www.theregister.com/ai-and-ml/2026/10/14/linux-kernel-devs-drop-obligatory-confession-of-ai-tool-usage/5303140

#linux #kernel #ai #vibecoding #opensource

Mein Umzug auf einen neuen #PasswortManager (Open Source) | c't Magazin https://www.heise.de/news/Mein-Umzug-auf-einen-neuen-Passwort-Manager-Open-Source-11474408.html #Datenschutz #privacy #Bitwarden #Passbolt #PasswordSafe #Psono #KeePass #ProtonPass #Android #iOS #Windows #macOS #Linux #OpenSource #DigitalSovereignty #PasswordManager

Security Advisory: CVE-2025-60492 - Uncontrolled Recursion in GPAC/MP4Box

Processing a crafted MP4 file with specially constructed BIFS scene data causes unbounded recursion between BIFS decoder functions, exhausting the stack and crashing MP4Box.

Summary:
The `gf_bifs_dec_node` function in `bifs/field_decode.c` decodes MPEG-4 BIFS scene nodes by calling `BD_DecMFFieldList`, `gf_bifs_dec_field`, and `gf_bifs_dec_node_list`, which in turn call back into `gf_bifs_dec_node`. A crafted MP4 file with deeply or cyclically nested BIFS containers triggers this mutual recursion without a depth limit, consuming all available stack memory and crashing the process with a stack-overflow signal.

CWE:
CWE-674 - Uncontrolled Recursion

Affected Component:
```
bifs/field_decode.c:905
Function: gf_bifs_dec_node()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
2.5-DEV-rev1687-ge44a4e2b0-master; commit `e44a4e2b0d193566619ada71599e70255699da94`. Any codebase equivalent to this commit that has not applied the fix commit is affected.

Attack Conditions:
An attacker supplies a crafted MP4 file whose embedded BIFS scene data contains deeply nested or mutually referencing node containers. Local access is required; the victim must invoke `MP4Box -x3d <crafted_file>` or any equivalent BIFS scene export command that triggers the recursive decoder path.

Impact:
The uncontrolled recursion exhausts the process stack, resulting in an immediate crash and Denial of Service. No evidence of arbitrary code execution was observed; stack-exhaustion crashes via recursion do not provide an exploitable control-flow primitive.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
8e7b9a3a04331286b89d1803c65a2d6edc11b4c4
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3324
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/59/59_Anchor_Create_scenegraph_mpeg4_nodes_c_171
- Fix: https://github.com/gpac/gpac/commit/8e7b9a3a04331286b89d1803c65a2d6edc11b4c4

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60488 - NULL Pointer Dereference in GPAC/MP4Box

Processing a crafted MP4 file with a missing Sample Description box triggers a NULL pointer dereference in `dump_isom_saps`, causing MP4Box to crash.

Summary:
The `dump_isom_saps` function in `applications/mp4box/filedump.c` iterates over track metadata to dump SAP (Sync Access Point) information. When the input MP4 contains a corrupted track structure where the Sample Description box (`stsd`) is absent, the function accesses track metadata pointers without prior validation, dereferencing a near-NULL address (0x1c, 28-byte struct offset) and triggering SIGSEGV.

CWE:
CWE-476 - NULL Pointer Dereference

Affected Component:
```
applications/mp4box/filedump.c:1743
Function: dump_isom_saps()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
2.5-DEV-rev1672-gc9a31d0e1-master; commit `c9a31d0e1b649a30814c6d81c5461859ed63d075`. Any codebase equivalent to this commit that has not applied the fix commit is affected.

Attack Conditions:
An attacker supplies a crafted MP4 file whose track structure lacks a valid `stsd` box. Local access is required; the victim must invoke `MP4Box -dsap 1 <crafted_file>` or any equivalent SAP analysis command that exercises the SAP dump path.

Impact:
The near-NULL pointer dereference (READ at address 0x00000000001c) causes an immediate process crash, resulting in Denial of Service. No evidence of arbitrary code execution was observed; the faulting access is a near-NULL read that is not exploitable for control-flow hijacking.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
e6d01820d7bf3967d931fedb379ee5f209bc133b
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3321
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/57/57_dump_isom_saps_filedump_c_1743
- Fix: https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Any #opensource printers yet?

I need a new one but i dont want to be locked in or pay a fortune on ink. Was thinking about those thermal printers bus most if not all require sus apps

#hivemind #printers

Security Advisory: CVE-2025-60487 - NULL Pointer Dereference in GPAC/MP4Box

Processing an empty XML file with the `-dnal` option triggers a NULL pointer dereference in `gf_isom_get_esd`, causing MP4Box to crash.

Summary:
The `gf_isom_get_esd` function in `isomedia/isom_read.c` retrieves an Elementary Stream Descriptor for a given track. When processing an empty file with an `.xml` extension, the ISO media layer lacks a valid media descriptor structure; the function dereferences a near-NULL pointer at address 0x50 (80-byte struct offset) without validating the pointer beforehand, terminating the process with SIGSEGV.

CWE:
CWE-476 - NULL Pointer Dereference

Affected Component:
```
isomedia/isom_read.c:1386
Function: gf_isom_get_esd()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
2.5-DEV-rev1665-g3f20eb0cd-master; commit `3f20eb0cd22116367c036e6ffe6ace299b38d686`. Any codebase equivalent to this commit that has not applied the fix commit is affected.

Attack Conditions:
An attacker supplies an empty or minimal file with an `.xml` extension. Local access is required; the victim must invoke `MP4Box -dnal 1 <crafted_file>.xml` or any equivalent NAL dump command that triggers the ESD retrieval path on an uninitialized media context.

Impact:
The near-NULL pointer dereference (READ at address 0x000000000050) causes an immediate process crash, resulting in Denial of Service. No evidence of arbitrary code execution was observed; the faulting access is a near-NULL read that is not exploitable for control-flow hijacking.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
e6d01820d7bf3967d931fedb379ee5f209bc133b
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3320
- PoC: N/A (see issue)
- Fix: https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60490 - Use-After-Free in GPAC/MP4Box

Processing a crafted MPEG-2 Transport Stream file triggers a heap use-after-free in `gf_filter_pid_send_event_downstream` when a freed PID instance is accessed during event propagation.

Summary:
When parsing a crafted MPEG-2 TS file with malformed PMT descriptors and sync marker violations, `gf_filter_pid_inst_swap_delete` frees a PID instance at `filter_pid.c:551`. A stale reference to this freed 344-byte region is subsequently read in `gf_filter_pid_send_event_downstream` at line 7919 (READ of 8 bytes at offset 0 of the freed object) because the pointer is not cleared after deallocation.

CWE:
CWE-416 - Use After Free

Affected Component:
```
filter_core/filter_pid.c:7919
Function: gf_filter_pid_send_event_downstream()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
2.5-DEV-rev1665-g3f20eb0cd-master; commit `3f20eb0cd22116367c036e6ffe6ace299b38d686`. Any codebase equivalent to this commit that has not applied the fix commit is affected.

Attack Conditions:
An attacker supplies a crafted MPEG-2 TS file containing broken PMT descriptor sizes, unsupported stream types, and missing sync markers. Local access is required; the victim must invoke `MP4Box -add <crafted_file> -new /dev/null` or any equivalent import command that triggers the filter PID event propagation path.

Impact:
The use-after-free (READ of size 8 at offset 0 inside a freed 344-byte heap region) results in process termination, causing Denial of Service. Arbitrary code execution is possible; the first MITRE request explicitly marks code execution impact as true, and use-after-free vulnerabilities at the start of a controlled heap object are a known code-execution primitive.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
d0793f92e04fe284a25c2a9335cc5edc68deb6d4
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3315
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/54/54_gf_filter_pid_send_event_downstream_filter_core_filter_pid_c_7919
- Fix: https://github.com/gpac/gpac/commit/d0793f92e04fe284a25c2a9335cc5edc68deb6d4

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60478 - Heap Use-After-Free in GPAC Packet Destruction

Processing a crafted MPEG-2 TS input with MP4Box DASH segmentation can trigger a heap use-after-free in `gf_filter_packet_destroy()`.

Summary:
Malformed program table data and empty DASH segment state can cause GPAC to mishandle packet ownership. The file output and PID packet drop path later destroy a packet object that has already been invalidated.

AddressSanitizer reports `heap-use-after-free` in `filter_core/filter_pck.c`.

CWE:
CWE-416 - Use After Free

Affected Component:
```
filter_core/filter_pck.c:678
Function: gf_filter_packet_destroy()
```

Relevant ASAN stack:

```
gf_filter_packet_destroy filter_core/filter_pck.c:678
gf_filter_packet_destroy filter_core/filter_pck.c:684
gf_filter_pid_drop_packet filter_core/filter_pid.c:7270
fileout_process filters/out_file.c:933
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
```
GPAC version: 2.5-DEV-rev1617-g856674b22-master
Commit: 856674b226d6cbe28a941ad223be38194cbf7d37
```

Attack Conditions:
An attacker supplies a crafted MPEG-2 TS file that is processed by MP4Box DASH segmentation:

```
./MP4Box -dash 100 47_gf_filter_packet_destroy_filter_core_filter_pck_c_678
```

Impact:
The observed impact is Denial of Service. Because the issue is a heap use-after-free, memory corruption risk is also present.

Fix / mitigation status:
The MITRE response in the local data records the fix as:

```
c592a144bbe339ee581ca88aaa3247362795b742
```

References:

- CVE: https://www.cve.org/CVERecord?id=CVE-2025-60478
- Issue: https://github.com/gpac/gpac/issues/3300
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/47/47_gf_filter_packet_destroy_filter_core_filter_pck_c_678
- Fix: https://github.com/gpac/gpac/commit/c592a144bbe339ee581ca88aaa3247362795b742

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60482 - Use-After-Free in GPAC MP4Box AC-4 Descriptor Cleanup

Processing a crafted AC-4 stream with MP4Box can trigger a heap use-after-free in `gf_odf_ac4_cfg_clean_list()`.

Summary:
The recursive AC-4 descriptor cleanup path can revisit or count a list object that has already been freed. When MP4Box imports a crafted AC-4 input, descriptor destruction reaches `gf_odf_ac4_cfg_clean_list()` and then `gf_list_count()` on stale heap memory.

AddressSanitizer reports `heap-use-after-free`.

CWE:
CWE-416 - Use After Free

Affected Component:
```
odf/descriptors.c:2411
Function: gf_odf_ac4_cfg_clean_list()

utils/list.c:664
Function: gf_list_count()
```

Relevant ASAN stack:

```
gf_list_count utils/list.c:664
gf_odf_ac4_cfg_clean_list odf/descriptors.c:2411
gf_odf_ac4_cfg_clean_list odf/descriptors.c:2400
dac4_box_del isomedia/box_code_base.c:9218
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
```
GPAC version: 2.5-DEV-rev1593-gfe88c3545-master
Commit: fe88c3545aadd597b250ccf23271d5d3de50ccc8
```

Attack Conditions:
An attacker supplies a crafted AC-4 file that is imported by MP4Box:

```
./MP4Box -add 46_gf_odf_ac4_cfg_clean_list_odf_descriptors_c_2411 -new /dev/null
```

Impact:
The observed impact is Denial of Service. Because the bug is a heap use-after-free, memory corruption risk is also present.

Fix / mitigation status:
The MITRE response in the local data records the fix as:

```
e02d1fd24cdc26acb1b236ab38b3832cffcae21b
```

References:

- CVE: https://www.cve.org/CVERecord?id=CVE-2025-60482
- Issue: https://github.com/gpac/gpac/issues/3297
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/46/46_gf_odf_ac4_cfg_clean_list_odf_descriptors_c_2411
- Fix: https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60470 - Out-of-Bounds Read in GPAC MP4Box AC-4 Parser

An out-of-bounds read vulnerability exists in GPAC MP4Box when processing a crafted AC-4 stream. The issue occurs in `gf_ac4_parser_bs()` in `media_tools/av_parsers.c` and is reachable during media import through MP4Box commands such as `-info`.

Summary:
AddressSanitizer confirms a global-buffer-overflow at `media_tools/av_parsers.c:16137`. The parser reads 4 bytes past the end of the global `AC4_SAMPLE_DELTA_TABLE_441` array due to insufficient bounds checking of AC-4 sample delta table indexes.

The crafted AC-4 stream causes the AC-4 parser to access `AC4_SAMPLE_DELTA_TABLE_441` with an out-of-bounds index. The invalid read occurs while probing the AC-4 stream and then propagates through the MP4Box media import path.

Relevant AddressSanitizer trace:

```
==1845261==ERROR: AddressSanitizer: global-buffer-overflow on address 0x7f4214ddf8fc
READ of size 4 at 0x7f4214ddf8fc thread T0
#0 0x... in gf_ac4_parser_bs media_tools/av_parsers.c:16137
#1 0x... in ac4dmx_probe_data filters/reframe_ac4.c:546
#2 0x... in gf_filter_pid_raw_new filter_core/filter.c:4704
#3 0x... in filein_process filters/in_file.c:610
#4 0x... in gf_filter_process_task filter_core/filter.c:3187
#5 0x... in gf_fs_thread_proc filter_core/filter_session.c:2421
#6 0x... in gf_fs_run filter_core/filter_session.c:2728
#7 0x... in gf_media_import media_tools/media_import.c:1278
#8 0x... in convert_file_info applications/mp4box/fileimport.c:131
#9 0x... in mp4box_main applications/mp4box/mp4box.c:6520

0x7f4214ddf8fc is located 36 bytes before global variable 'AC4_SAMPLE_DELTA_TABLE_48'
defined in 'media_tools/av_parsers.c:14246:11' of size 56
0x7f4214ddf8fc is located 4 bytes after global variable 'AC4_SAMPLE_DELTA_TABLE_441'
defined in 'media_tools/av_parsers.c:14263:11' of size 56

SUMMARY: AddressSanitizer: global-buffer-overflow media_tools/av_parsers.c:16137 in gf_ac4_parser_bs
```

CWE:
CWE-125 - Out-of-bounds Read

Affected Component:
```
media_tools/av_parsers.c:16137
Function: gf_ac4_parser_bs()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
```
2.5-DEV-rev1593-gfe88c3545-master
Commit: fe88c3545aadd597b250ccf23271d5d3de50ccc8
```

Attack Conditions:
An attacker supplies a crafted input file that is processed by MP4Box. The issue can be reproduced locally with:
```
./MP4Box -info 43_gf_ac4_parser_bs_media_tools_av_parsers_c_16137
```

Attack vector: local crafted AC-4 file processed by MP4Box
User interaction: required

Impact:
denial of service via application crash

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
e02d1fd24cdc26acb1b236ab38b3832cffcae21b
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3294
- Fix: https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/43/43_gf_ac4_parser_bs_media_tools_av_parsers_c_16137
- CVE: https://www.cve.org/CVERecord?id=CVE-2025-60470

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac