I presented at the lighting talk of @hack_lu the patch2vuln is a command-line tool that turns a git-format patch into a structured draft vulnerability advisory using a locally hosted Ollama model.

🔗 GitHub https://github.com/gcve-eu/gcve-lab-patch2vuln

#cve #gcve #vulnerability #cvd #vulnerabilityManagement #opensource #ai

@gcve

Alt...

`patch2vuln` is a command-line tool that turns a git-format patch into a structured draft vulnerability advisory using a locally hosted Ollama model.

#KDE Plasma 6.8.1 Desktop Environment Released with Various Bug Fixes https://9to5linux.com/kde-plasma-6-8-1-desktop-environment-released-with-various-bug-fixes

@kde #Linux #OpenSource

Alt...

A screenshot of the KDE Plasma desktop environment showing the Kickoff application menu

Zaktualizowałem właśnie Katalog Oprogramowania na eteryu.space. 🛠️

Zamiast rozbudowywać go w nieskończoność, postawiłem na rygorystyczne cięcia i przejrzystość. W duchu filozofii distrust nie ma tu aplikacji idealnych – przy każdej mającej kompromisy wprost opisuję ich wady (zbieranie metadanych, zależności od Firebase itp.).

Wyeliminowałem duplikaty, dodałem rzetelne ostrzeżenia i mocno wyeksponowałem narzędzia w 100% offline. Wszystko po to, by świadomie dobierać soft do własnego modelu zagrożeń, a nie ślepo ufać marketingowym hasłom.

Sprawdź nową wersję:
https://eteryu.space/narzedzia/katalog/

#Prywatność #Cyberbezpieczeństwo #OpenSource #Distrust

A true legend of computer science leaves us, Fortnite is coming to Linux, Steam is finally moving away from 32-bit, Microsoft Defender comes to the Linux Desktop, Adobe’s flagship apps are cloned by AI as open source, and a quick KDE Korner.

https://latenightlinux.com/late-night-linux-episode-408/

#podcast #linux #opensource

Alt...

Late Night Linux artwork

PlanetFOSS ist live!

Ein Linux- und FOSS-Nachrichtensammler im Magazin-Stil, auf Deutsch und Englisch. Er sammelt, was die Community schreibt, bündelt Meldungen zum selben Thema und zeigt nur Überschrift, Anreißer und Bild. Ein Klick führt zur Quelle.

Keine Cookies, kein Algorithmus, der dich wütend macht. Nur Kernel, Desktops und gelegentlich ein Systemd-Streit.

Here we go: https://planetfoss.net

#Linux #FOSS #OpenSource #PlanetFOSS

Alt...

Screenshot der Webseite Planet FOSS mit Nachrichtenübersicht zu Ubuntu 26.10 und KDE Plasma 6.8 in einem Browserfenster

RT @mylifcc: Die gesamte Online-Community macht sich Sorgen, dass KI-Code („AI Slop“) die Open-Source-Welt mit schlechtem Code überschwemmt und zum Einsturz bringt. Das Ergebnis bei der Top-Open-Source-Datenbank PostgreSQL war jedoch völlig anders:

mehr auf Arint.info

#BugFixing #KIKodierung #OpenSource #PostgreSQL #Softwareentwicklung #arint_info

https://x.com/mylifcc/status/2112219727820898384

heise+ | All Systems Go!: Wie #Systemd Image-basierte #Linux -Systeme vorantreibt | c't Magazin https://www.heise.de/hintergrund/All-Systems-Go-Wie-Systemd-Image-basierte-Linux-Systeme-vorantreibt-11482750.html #heiseplus #OpenSource #KDElinux

The GNOME OS preview is now public with GNOME 51.1, offering x64 and Arm64 images for a real PC or a virtual machine.

#GNOME #GNOMEOS #Linux #GNOME511 #Flatpak #systemd #OpenSource #LinuxDesktop

https://securityonline.info/gnome-os-preview/?utm_source=mastodon&utm_medium=jetpack_social

Dutch tax authorities cancel Microsoft 365 cloud rollout – and turn toward open source https://zdnet.com/business/dutch-tax-authorities-cancel-microsoft-365-cloud-rollout/ via @ZDNet & @sjvn

Another European move toward digital sovereignty has curtailed the adoption of the US workplace suite in favor of an #opensource approach.

Looks like Proton with Intel XeSS is set for some improvements, with Intel submitting code directly to Valve.
https://www.gamingonlinux.com/2026/10/intel-submits-code-to-proton-to-improve-xess-to-use-the-fast-upscaler-xmx/

#OpenSource #Wine #Intel #Proton #Misc

As is tradition, a new release of GE-Proton came with issues and so another hotfix is out with GE-Proton 11-11.
https://www.gamingonlinux.com/2026/10/ge-proton-11-11-released-to-fix-more-issues-with-windows-games-on-steamos-linux/

#OpenSource #Proton #Misc #GEProton

If anyone is at the @Nextcloud Enterprise Day in Copenhagen today, come say hi! 👋

#nextcloud #nextcloudconf2026 #opensource #openproject #conference

Alt...

A big banner saying Nextcloud Enterprise Day Copenhagen 2026

Alt...

A selfie with my badge

Anthropic's free OSS Scanner sends enrolled projects model-generated vulnerability reports without human review. It says so itself.

I just enrolled Sulu (PR #597). Getting in took a checklist, a CLA and a case-by-case decision. The reports that follow skip all of that. Finding a vulnerability got nearly free; checking one is still a maintainer's job.

https://johanneswachter.dev/shorts/the-scanner-report-nobody-reviewed-before-sending/

#OpenSource #Security #AI

The Linux Assisted-by tag is going away after maintainers agreed it misreports AI use, but human accountability stays.

#Linux #LinuxKernel #AssistedBy #AIAssistedCoding #OpenSource #LinusTorvalds #KernelDevelopment #Checkpatch

https://securityonline.info/linux-assisted-by-tag/?utm_source=mastodon&utm_medium=jetpack_social

Guten Morgen

Der CachyOS Kernel Manager ist ein grafisches Werkzeug für die verschiedenen Kernel. Du siehst eine Liste der verfügbaren Varianten, etwa den Standardkernel, eine LTS Variante mit längerem Support, einen für Leistung, einen für Echtzeit, einen gehärteten oder einen für Server. Ein Häkchen setzen, auf Ausführen drücken, und das Paket kommt aus den normalen CachyOS Quellen. Beim Entfernen nimmst du das Häkchen wieder weg.

Unter Konfigurieren stellst du dir einen eigenen Kernel zusammen, mit Scheduler, Taktfrequenz und weiteren Optionen. Danach baut das Werkzeug die Pakete und installiert sie nach deiner Bestätigung. Für den Alltag reicht meist der vorhandene Kernel, für Neugierige ist der Baukasten aber interessant.

Hast du schon einmal einen anderen Kernel ausprobiert?

#Linux #morgen #CachyOS #OpenSource

Linux-Kernel 7.3 ist da: Korrekturen quer durch die Bank

Linus Torvalds hat den Linux-Kernel 7.3 veröffentlicht. Die Änderungen sind zahlreich. Zuletzt gab es noch Korrekturen querbeet.

https://www.heise.de/news/Linux-Kernel-7-3-ist-da-Korrekturen-quer-durch-die-Bank-11492655.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#IT #Journal #Linux #OpenSource #LinuxKernel #Updates #news

Spyware Arrived Through an Ad Auction. The AdFection Case Shows How Much Ads Reveal About You

Researchers at Citizen Lab at the University of Toronto published a report on October 15, 2026, according to which spyware from the Israeli company Candiru…

https://vsx.global/adfection-spyware-ads/

#infosec #privacy #opensource #digitalsovereignty

This is my first time manufacturing a circuit board with PCBWay. It's pretty cool how you can see every step of production live. It's a breakout board for flashing the Valetudo firmware onto a vacuum robot. It's supposed to be delivered from China by Friday, which is crazy to me.

I would have preferred to get it done in Europe, but the Chinese were cheaper, faster, and had no issues with manufacturing a non-standard thickness of 1.2 mm. 🤷🏻‍♂️

Any recommendations?

#OpenHardware #OpenSource #PCBWay

Alt...

Screenshot of the PCBWay website listing every step of producing a printed circuit board with a corresponding timestamp. The current step is "AOI", the last step was "Etching".

The Ubuntu 26.10 release delivers GNOME 51, Rust-powered uutils core tools, local Myna voice AI, and expanded TPM hardware encryption.

#Ubuntu #Linux #Canonical #GNOME51 #OpenSource

https://securityonline.info/ubuntu-26-10-release-rust-gnome-51/?utm_source=mastodon&utm_medium=jetpack_social

RT @AntLingAGI: Heute veröffentlichen wir 5 Ming-3.0-Modelle in drei Sprachfamilien.

mehr auf Arint.info

#ASR #AudioTech #Ming3 #OpenSource #SpeechAI #TTS #arint_info

https://x.com/AntLingAGI/status/2112210811997540475

Discover the new ReactOS NTFS installation support. The open-source Windows alternative finally drops its FAT32 limits and moves toward NT 6 architecture.

#ReactOS #NTFS #OpenSource #WindowsAlternative #TechNews

https://dailytechnow.com/reactos-ntfs-installation-support/

Linux users, settle this debate.

Is there any distro that genuinely beats Ubuntu for everyday use?

#Linux #Ubuntu #OpenSource

Prove a file existed, unchanged, by a certain date, or check a proof someone sent you. Free, using OpenTimestamps and Bitcoin, with no coins or wallets involved. The file is fingerprinted in your browser and never uploaded. We've timestamped 978 of our own documents this way, with no failures.
https://makeprivacy.org/tools/timestamp/
#OpenTimestamps #Bitcoin #DigitalEvidence #OpenSource

https://github.com/macports/macports-ports/pull/35701

It has been merged!

I didn't finish my MacPorts' update to snac yet, because the Makefile patch broke and I've been scampering around all day with a rental car more or less putting all the vinyl I purchased from the Kishi Bashi, AMP Festival, and Denver Wax Trax into storage.

I sincerely need to overhaul my storage unit with much better vinyl storage and that requires time and money, neither of which I seem to have in abundance, just the opposite. ;(

I'll hopefully have more opportunity to fix the Makefile patch for MacPorts' snac tomorrow? I'm currently doing laundry (no more clean clothes and I did laundry while I was in Montreal too! I travel lightly, yet that means I don't have an enormous wardrobe either and due to attempting to air dry my clothes to maximize their longevity? I may be wearing the same outfit I am presently wearing for another day or two.)

I'm exceedingly grateful that rueda posted a Got release announcement to undeadly.org at least! I was planning on that yet, clearly have been burning the candle at all ends as it were.

#Got #GameOfTrees #MacPorts #OpenSource #VersionControl #Git

"Hackers hit AI coding tool OpenCode, running up charges on users’ AI accounts"

"OpenCode is an open source AI coding agent that's become a popular alternative to Claude Code and Cursor."

https://techcrunch.com/2026/10/19/hackers-hit-ai-coding-tool-opencode-running-up-charges-on-users-ai-accounts/

#OpenSource

🧵 13/n THIS one is special!

There are proper lyrics in the description - the YT-auto-gen-CC ones are rubbish.

A #Folk #Song type Ode to #FreeSoftware #FreeHackers - it's a proper stand-alone piece, unique lyrics, not the usual RMS remix.

#GNU #OpenSource #Linux #FLOSS #FOSS

I'm actually in tears - amazing grasp on reality! THAT is the point of all the effort!

..from 18 years ago!

That's the best one i've seen tonight: https://www.youtube.com/watch?v=6B8SSKgkALc

The Open Source Accessibility Framework helps open source projects turn accessibility goals into public, trackable progress. https://open-source-accessibility.github.io/Open-Source-Accessibility-Framework/ #OpenSource #Program #Programming #Accessibility #A11y

🚨 Just a few days left to submit your session proposal for DrupalCon Orlando 2027! Deadline is Tuesday, October 20.

🔗 Details: https://events.drupal.org/orlando2027/drupal-day
🔗 Submit here: https://sessionize.com/drupalcon-orlando2027/?e=8e8f61

#Drupal #DrupalCon #DrupalConOrlando #OpenSource

🚀 ONE DAY LEFT! DrupalCon Orlando 2027 session proposals close TOMORROW, October 20!

As Community Speaker Review Chair, I want to see fresh voices, bold ideas, and diverse perspectives!

🎤 First-time speaker? Seasoned pro? Your experiences matter. Submit your session!

#DrupalCon #DrupalConOrlando #OpenSource

#Audacious 4.6.2 Open-Source Media Player Released with Wayland Improvements, Feature Parity for the Qt Winamp UI https://9to5linux.com/audacious-4-6-2-open-source-media-player-released-with-wayland-improvements

#OpenSource #Linux #FreeSoftware #FOSS

Alt...

A screenshot of Audacious 4.6 showing the main window, the plugins dialog, and the About dialog.

proton-ge-custom has updated to version GE-Proton11-11. Check it out here: https://github.com/GloriousEggroll/proton-ge-custom/releases/tag/GE-Proton11-11
#foss #OpenSource #linuxGaming

A critical Laravel authentication bypass (CVSS 9.2) in TokenGuard enables account takeover without a token. Upgrade to 13.29.0 or 12.68.0.

#Laravel #PHP #AuthenticationBypass #AccountTakeover #WebSecurity #OpenSource #PatchNow #CyberSecurity

https://securityonline.info/laravel-authentication-bypass-tokenguard/?utm_source=mastodon&utm_medium=jetpack_social

📡 The RSS Universe directory just grew by 15 tools, all of them suggestions from people who read the site and noticed something missing.

Akregator, Nextcloud News, ReadKit, News Explorer, Reader Ultra, Leed, Salut, Sikio, FeedCity, micro.blog, Feedlynx, Feed Canary and more.

Now 122 apps, tools and standards, every link checked live.

https://toolbox.rss.here.now/

#rss #opensource #feedreader

Alt...

The RSS Universe directory site. The headline reads "RSS isn't dead. It's the resistance." Below it, stats show 122 apps and tools across 13 categories, 100% of links verified live. A "What's new" grid lists the 15 additions from the Oct 19, 2026 update: FeedCity, Micro.blog, Leed, Nextcloud News, Salut, News Explorer, ReadKit, Akregator, Reader Ultra, Sikio, feed-repeat, feed-mixer, Feedlynx, Feed Canary and Feed Key.

The breach was confirmed on October 17.

Infosecurity-Magazine: OpenCode Breach Could Affect OpenAI, Anthropic and Google https://www.infosecurity-magazine.com/news/opencode-breach-openai-anthropic/ #infosec #databreach #opensource #Anthropic #Google #OpenAI

How safe is Proton Pass if installed from the FlatHub?

The ownership of the me.proton.Pass app ID has not been verified and it may be a community package

I usually trust community maintained open source packages. But with the password managers I want to be extra careful. A password manager app is probably the most sensitive piece of software in the PC. So I want to be 100% sure it's safe. Is it safe? Question.

@protonprivacy
#ProtonPass #Flatpak #Flathub #PasswordManager #ArchLinux #GitHub #OpenSource #Proton #Pass #Keepassxc #Bitwarden

Vercel-Index: Open-Weight-Modellnutzung erstmalig über 70 Prozent

Laut Vercels AI Gateway Index verarbeiten Open-Weight-Modelle mittlerweile über 70 Prozent aller Token. Die Wechselbereitschaft steigt.

https://www.heise.de/news/Vercel-Index-Open-Weight-Modellnutzung-erstmalig-ueber-70-Prozent-11488361.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#Anthropic #China #DeepSeek #IT #KünstlicheIntelligenz #OpenSource #OpenAI #news

Rückblick: OpenSSF-Datenbank erweitert GitHubs Malware-Warnungen

Mithilfe eines OpenSSF-Repositorys warnt GitHub seit Juli vor Malware in acht Paket-Ökosystemen. In einer Fallstudie zieht die OpenSSF jetzt Bilanz.

https://www.heise.de/news/Rueckblick-OpenSSF-Datenbank-erweitert-GitHubs-Malware-Warnungen-11492599.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#GitHub #IT #OpenSource #Security #Sicherheitslücken #news

OhMyDebn 4.12.0 is out! 😁

Say hello to the grin: it shimmers, it winks, and it wears your theme's colors.

Also new:
• Claude Desktop as an optional AI app
• The OhMyDebn Menu gets its own button on the panel
• Terminal prompts appear about 3x faster
• Claude Code, Brave and PowerShell keys are checked against the vendors' published fingerprints
• 19 fixes and 12 updated components

Release notes: https://ohmydebn.org/release-notes/

#Linux #Debian #Ubuntu #LinuxMint #Cinnamon #OpenSource

Das neue #Linux 7.3 ist da. Das #Update für den #OpenSource-#Kernel liefert Optimierungen für Dateisysteme sowie eine verbesserte Speicherverwaltung bei AMD-Grafikkarten, erweiterten CPU-Support und mehr. https://winfuture.de/news,162037.html?utm_source=Mastodon&utm_medium=ManualStatus&utm_campaign=SocialMedia

heise+ | Linux-Distribution Ubuntu 26.10 im Test: Linux 7.3 und KI-Funktion

Das diesjährige Herbst-Release von Ubuntu Linux bringt Gnome 51, einen taufrischen Kernel, viel Rust – und macht erste Schritte zum KI-Desktop.

https://www.heise.de/tests/Linux-Distribution-Ubuntu-26-10-im-Test-Linux-7-3-und-KI-Funktion-11489069.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#Canonical #Gnome #IT #KünstlicheIntelligenz #Linux #LinuxDesktop #OpenSource #Rust #Ubuntu #news

New in #LibreOffice 26.8: Better accessibility – LibreOffice continues its accessibility work with improvements that make the interface easier to navigate using assistive technologies. https://wiki.documentfoundation.org/ReleaseNotes/26.8#Accessibility #foss #opensource #freesoftware

We've been tinkering, building, polishing, and probably drinking too much coffee. ☕

The result? Dominion Solutions has a shiny new website!

Same engineers. Same love for solving messy software problems. Better-looking home on the internet.

Custom software, legacy modernization, DevOps, and plenty of code under the hood.

Come have a look! Link in the replies. 👇

#WebDevelopment #SoftwareEngineering #SmallBusiness #OpenSource

github-workflow : une TUI en Rust qui affiche le statut de vos dépôts GitHub et de vos branches directement depuis le terminal Linux.

Elle repose sur Ratatui et se veut légère, avec une consommation de ressources minimale.

Open source sous licence MIT ⬇️
https://github.com/jorgeandrecastro/github-workflow

#Rust #Linux #OpenSource #Programming #WebDev

📬 Ma veille dev, chaque vendredi par email → https://l.camilleroux.com/sig-a9L

Alt...

Capture d'écran d'une interface en ligne de commande affichant un tableau de bord GitHub avec une liste hiérarchisée de dépôts, branches et commits. L'écran montre le projet "GITHUB-WORKFLOW" avec plusieurs branches et leurs descriptions de modifications associées.

🗳️ OWASP Board Election voting is OPEN!

3 Board seats are up for election. Make your voice heard and help shape OWASP’s future!

📩 Check your personal and OWASP email for your ballot.

⏰ Closes Oct 30, midnight UTC.

Vote now: https://owasp.org/board/elections/2026

#community #opensource #boardelections

Discover the major updates in Linux kernel 7.3, featuring advanced security, Rust support, and enhanced hardware compatibility. Download it today.

#LinuxKernel #Linux73 #OpenSource #LinusTorvalds #Rust #CyberSecurity

https://dailytechnow.com/linux-kernel-7-3-released/

Länderbericht #Schweiz 🇨🇭: Von der Akzeptanz zur Verankerung von #OpenSource (Top News)

Open Source: Von Option zu Grundsatz
https://www.ossdirectory.com/de/topnews/details/laenderbericht-schweiz-von-der-akzeptanz-zur-verankerung-von-open-source #DigitalSovereignty

#BleachBit 6.0.6 System Cleaner Adds Support for #Ubuntu 26.10 and #openSUSE Leap 16.1, More Cleaners, and Performance Improvements https://9to5linux.com/bleachbit-6-0-6-system-cleaner-adds-support-for-ubuntu-26-10-opensuse-leap-16-1

#Linux #OpenSource

Alt...

A screenshot of BleachBit 6.0.6 showing the main window and the About dialog.

Guten Morgen

Der CachyOS Paketinstaller ist ein grafisches Werkzeug, das beliebte Anwendungen in einer sortierten Liste zeigt. Du findest ihn im Startmenü unter System, der Eintrag heißt CachyOS Package Installer. Alternativ startest du ihn im Terminal mit cachyos-pi.

Hinter der Oberfläche stecken Kategorien wie Browser, Kommunikation, Grafik oder Virtualisierung. Klappst du eine Kategorie auf, siehst du die enthaltenen Programme, zu vielen gibt es eine kurze Beschreibung und manchmal einen Screenshot. Über das Suchfeld findest du ein Programm auch direkt über seinen Namen. Ein Häkchen setzen, Installieren drücken, und der Installer holt die Pakete über die normalen CachyOS Quellen.

Er ist kein Ersatz für pacman, sondern eine Hilfe für den Einstieg. Wer ein Programm bereits hat, kann es hier auch entfernen oder neu installieren. Für alles, was nicht in der Liste steht, bleibt das Terminal zuständig.

Suchst du neue Programme lieber in einer Liste oder direkt im Terminal?

#Linux #morgen #CachyOS #OpenSource

Does someone share this (kind of weird) feeling?

In opensource projects, if I git-fetch and I see a dozen of branches appear in the upstream repository, I am immediately repelled. Because I expect contributors not to push into the upstream repository, but PR from their "forks".

But in work project, everyone pushing into the same "upstream" repository is perfectly normal for me.

Kind of weird feeling IMO.

#github #gitlab #softwaredevelopment #opensource #work

A triple helping of community Proton builds to report on for you today with Proton-CachyOS 11.0-20261014, DWProton 11.0-15 and GE-Proton 11-10 released.
https://www.gamingonlinux.com/2026/10/proton-cachyos-11-0-20261014-dwproton-11-0-15-and-ge-proton-11-10-released/

#OpenSource #SteamOS #Proton #NewRelease #Misc #SteamDeck #SteamMachine #GEProton

Linux kernel 7.3 has officially been released, bringing with it plenty of improvements for Linux gaming.
https://www.gamingonlinux.com/2026/10/linux-kernel-7-3-is-out-with-some-nice-improvements-for-gaming/

#OpenSource #Kernel #NewRelease #Misc

proton-ge-custom has updated to version GE-Proton11-10. Check it out here: https://github.com/GloriousEggroll/proton-ge-custom/releases/tag/GE-Proton11-10
#foss #OpenSource #linuxGaming

🎵 ffplay als Lösung zwischen mpv und VLC! 🐧

Mein universelles Bash-Skript spielt Musik direkt über FFmpeg im Terminal ab – unkompliziert und skriptbar. Hier läuft Christian Punk & Metal, während FFmpeg die Audioinfos ausgibt. Linux, Shell und Musik vereint! 🤯

#Linux #Bash #FFmpeg #ffplay #OpenSource #CLI #PunkRock #Metal

Alt...

Linux-Desktop mit Terminalfenster: Ein universelles Bash-Skript startet ffplay und spielt eine MP3 von 7 Angels 7 Plagues ab. FFmpeg zeigt Audio-Metadaten. In der Mitte steht ein ASCII-Pinguin, rechts unten eine dunkle Audio-Visualisierung.

Just upgraded the NoiseBox Wyse Appliance. Based on the Dell Wyse 3040, you plug it into your router, power it up and it starts crawling the web. Plug in a USB flash drive, wait a few seconds, and that drive will have a text file giving you the router IP it was assigned. Put that into a browser and you are at its web control panel! A true plug and play data poisoning machine. https://codeberg.org/NoiseBoxWorks/WyseCrawler
#SelfHosted #OpenSource #Python #Homelab #Linux #Makers #WebCrawler #Debian

#Linux Kernel 7.3 Officially Released, This Is What’s New https://9to5linux.com/linux-kernel-7-3-officially-released-this-is-whats-new

#LinuxKernel #OpenSource

Alt...

Linux Kernel 7.3 - What's New

Przy okazji, dziś katalog narzędzi też dostał update. Wśród nowych pozycji jest WG Tunnel, ten sam klient WireGuard, którego użyłem w artykule powyżej.

📚 Katalog Oprogramowania +9

• Proton Pass, Proton Drive
• IVPN, WG Tunnel
• Cryptomator, CryptPad
• Notesnook, Verified Apps
• CoMaps (nowa sekcja: Mapy i nawigacja)

Wszystko open source, z linkami do źródeł. Jeśli szukasz więcej narzędzi prywatnościowych, warto zajrzeć:

https://eteryu.space/narzedzia/katalog/

#prywatność #opensource #foss #cyberbezpieczenstwo #privacy #cybersecurity

Mullvad ogłosił planowane zamknięcie publicznego resolvera DNS. Sam szukałem darmowej alternatywy dla Mullvad VPN i tak powstał ten artykuł.

Bo Proton to chyba jedyny darmowy VPN wart uwagi. A gdy połączysz go z szyfrowanym DNS i filtrowaniem reklam, dostajesz pełny zestaw, za który normalnie trzeba płacić.

Standardowy WireGuard tego nie potrafi. WG Tunnel tak.

Link do artykułu:
https://eteryu.space/poradniki/darmowy-vpn-z-filtrowaniem-dns/?v=3

#Prywatność #Privacy #Cyberbezpieczeństwo #Cybersecurity #VPN
#WireGuard #DoH #DoT #ProtonVPN #Proton #Mullvad
#NextDNS #Hagezi #OpenSource

@anvil_blog I like hardware keys, but I would recommend @nitrokey they are open source and work grate

#OpenSource #HardwareSecurityKeys #2FA

#LinuxKernel: Maintainer wollen „Assisted-by“-Tag streichen | Developer https://www.heise.de/news/Linux-Kennzeichnung-von-KI-Code-soll-entfallen-auch-Torvalds-nutzt-LLMs-11490345.html #Linux #OpenSource #development #ArtificialIntelligence #AI

Linux Mint 27 will include a suite of new software, including a more capable system monitor.

I took a development version for a spin and came away impressed – and with more disk space.

https://www.omgubuntu.co.uk/2026/10/linux-mint-new-system-monitor?v2

#linuxmint #linux #openSource

#Libreboot startet jetzt auch per #UEFI durch | iX Magazin https://www.heise.de/news/Libreboot-startet-jetzt-auch-per-UEFI-durch-11491142.html #Linux #OpenSource

📋 #Pele is a lightweight #opensource library that renders #Mermaid diagrams to SVG, themed with CSS variables. Built by the #Obsidian team to render diagrams fast and match the app's theme #javascript #webdev

⚡ Compared to Mermaid.js: 230 kB gzipped bundle instead of 1.6 MB (6× smaller), 0.05–0.3 ms render time instead of 6–82 ms (up to 500× faster), and zero direct dependencies instead of 23

🧵👇

Vor zwei Wochen habe ich hier mit einem leeren Profil angefangen. Heute sind es über 40 Menschen, die mitlesen, und viel mehr Gespräche, als ich erwartet hatte. Das ist der Teil, der mich am meisten überrascht hat.

Die Themen waren bunt. Dateisysteme, Backups, freie Software, Lizenzen, Kachelfenster. Aber die besten Momente waren nicht die Erklärungen, sondern die Antworten. Jemand erzählt von einer geretteten Platte, jemand anderes von seinem ersten Kernel, und plötzlich wird aus einem Beitrag ein Gespräch. Genau dafür bin ich hier.

Nächste Woche nehme ich mir CachyOS vor. Den Paketinstaller, den KernelManager, Hello, die Einstellungen und die Paketquellen. Dazu wieder eine Frage am Samstag und ein Rückblick am Sonntag.

Was hat dir in dieser Zeit hier am meisten gefallen?

#Linux #CachyOS #Community #OpenSource

Minął weekend. Wczoraj udało się trochę podłubać przy kodzie: dodałem trzecią zasadę do distrust.pl i dopracowałem typografię strony. Dzisiaj dałem sobie na luz, ale kto wie, może przed snem jeszcze coś przysiądę.

Czasem warto poświęcić chwilę, żeby nasze cyfrowe otoczenie było choć odrobinę lepsze. Bo prywatność to nie jednorazowa konfiguracja, tylko ciągła praca.

A jak u Was mijają weekendy z technologią? Też zdarza się Wam dłubać przy projektach?

#prywatność #opensource #buildinpublic

RT @vllm_project: 🚀 vLLM v0.32.0 ist verfügbar! 814 Commits · 363 Mitwirkende · 121 Erstautoren

mehr auf Arint.info

#AI #DeepLearning #MachineLearning #NLP #OpenSource #vLLM #arint_info

https://x.com/vllm_project/status/2111814711956168760

The Document Foundation, the non-profit behind #LibreOffice, now has its own visual identity: https://blog.documentfoundation.org/blog/2026/10/09/tdf-visual-identity/ #foss #openSource #freesoftware

Alt...

TDF logo

Tell me what made you #change to #Linux?

(If you want tell your distro and GUI.)

#meme #story #foss #OpenSource #distro #desktop #gui #os #Software #tux #computer #freedom #distribution

Alt...

Tell me what made you change to Linux?

At our #Proxday, several people came in touch w/ me & said that LVM thin-provisioned with iSCSI, FC or NVMeoF would be a dream. Let me make it become real!

PS: My mate @formorer@rollenspiel.social is also working on something huge! Guess, we should make a special event about storage plugins for Proxmox VE - maybe within the next virtualization gathering at @credativde@mastodon.social or maybe as a special edition. Let's see, stay tuned!

More about it: https://gyptazy.com/blog/proxmox-shared-block-storage-with-lvm-thin-provisioning-provider/
Demo: https://youtu.be/pQHazr50PVg

#PVE #opensource #storage #proxday

Alt...

Adding LVM Thin as shared storage in Proxmox

Alt...

Assigning the LVM Thin to a VG

#Ubuntu 26.10: #Linux 7.3 und KI-Assistent im Gepäck | heise online https://www.heise.de/news/Ubuntu-26-10-Linux-7-3-und-KI-Assistent-im-Gepaeck-11488457.html #ArtificialIntelligence #AI #OpenSource #Linux73 #ubuntu2610

The first week of Djangonaut Space is in the books and it was a brilliant one for me. I had so much fun getting to know people in the community, added a beautiful new hoodie to my swag collection, spoke to two groups of students and started my first contributions to Djangonaut Space and Django Girls projects.

https://hamatti.org/posts/djangonaut-log-1-lift-off-and-first-week-in-djangonaut-space/

@djangonaut #DjangonautSpace #DjangoGirls #Django #Python #OpenSource

Episode 39 of Dark Blue Weekly released

https://darkblueproject.com/sites/news/dbw-e39.php

#darkblueweekly #darkblueproject #ubuntu #ubuntu2610 #lubuntu #kubuntu #xubuntu #ubuntumate #ubuntubudgie #gnomeos #gnome #gnome51 #kdeplasma #kdeplasma68 #kde #linux #linuxdesktop #linuxserver #opensource #freesoftware

#GNOME 51.1 Is Out to Improve Drag and Drop Between #Wayland and Xwayland Clients https://9to5linux.com/gnome-51-1-improves-drag-and-drop-between-wayland-and-xwayland-clients

@gnome #Linux #OpenSource #FOSS

Alt...

GNOME 51.1

Heute so: Migration von TrueNAS CORE -> TrueNAS SCALE bei einem Kunden.
Also quasi der komplette Server – Daten, VMs, das volle Programm.
Wir reden hier immerhin von einem Wechsel von #FreeBSD nach #Linux, was auch eine komplette Änderung des genutzten VM Stacks bedeutet (BHYVE -> KVM)!

Der Plan war simpel: #ZFS-Replikation auf die neue Kiste, Snapshots inklusive. Nach ein paar Anpassungen liefen die VMen einfach wieder an. Einziger manueller Kraftaufwand: Netzwerkschnittstellen – der Klassiker bei jedem Umzug.
Ohne den wär's fast verdächtig glatt gelaufen.

Und mal ehrlich: #ZFS ist bei so was wirklich ein Geschenk des Himmels.
Was woanders ein schweißtreibendes Kopier-Karussell mit Bangen um die Daten wäre, ist mit ZFS-Replikation eher ein gemütliches:

• Replizieren
• Kaffee holen
• Anpassen, starten, fertig

Und falls ihr vor so einem Umzug steht und euch nicht so recht traut: Meldet euch einfach bei mir. Egal ob CORE zu SCALE, ein ganzes NAS oder nur eine kleine ZFS-Frage – ich helfe gerne. Wer noch auf CORE hängt: Die Migration auf SCALE ist weniger dramatisch, als man denkt. Versprochen!

#TrueNAS #ZFS #Homelab #Sysadmin #Migration #OpenSource

@twipped

But FOSS' success up until this point has shown the exact opposite.

FOSS was bootstrapped by using proprietary software every single day for more than a decade, at least.

Most FOSS developers regularly used proprietary technologies daily for their work for the entirety of FOSS' history.

Plus, what @copiesofcopies said:
https://fedi.copyleft.org/@copiesofcopies@social.coop/117457049015278425

Cc: @cwebber

#LLMGenAI #LLM #AI #FOSS #SoftwareFreedom #OpenSource #FreeSoftware

Okay, now this is getting interesting... I admit I haven't tried Linux on my T490s in quite a while, after my earlier attempts to get the built-in 5G modem to work failed.

Following yesterday’s controversy over why, in my attempt to boycott U.S. products and services, I’d choose Microsoft over Fedora of all things (because, as I said, I need Windows for work—just like any other common operating system), I installed a different SSD today just for fun and put the latest beta of Fedora 45 on it. And look at that: the modem works with it! Quite obviously, the kernel finally has the necessary drivers built in.

So now I can use Linux on the ThinkPad again, even if it’s a Linux distribution under IBM’s umbrella… at the end of the day, it’s still a bit better than Microsoft. And so the only Windows device still running is the NUC—that’s more than enough.

#linux #fedora #opensource #freesoftware #windows #thinkpad

FOSS NEWS

Firefox 158 released with JPEG XL support:
https://www.omgubuntu.co.uk/2026/10/firefox-158-released-with-jpeg-xl-support

Mozilla Firefox 159 Enters Public Beta Testing with Wayland Improvements:
https://9to5linux.com/mozilla-firefox-159-enters-public-beta-testing-with-wayland-improvements

Zen Browser 1.23.3b Ships with Firefox 158 Security Fixes:
https://www.linuxcompatible.org/story/zen-browser-1233b-ships-with-firefox-158-security-fixes/

Ungoogled Chromium 155.0.8059.84-1 Releases for Linux with Chrome's 10 Security Fixes:
https://www.linuxcompatible.org/story/ungoogled-chromium-15508059841-releases-for-linux-with-chromes-10-security-fixes/

Proton product roadmaps for autumn and winter 2026:
https://proton.me/blog/2026-autumn-winter-roadmaps

Proton Pass brings folders and detailed autofill controls:
https://alternativeto.net/news/2026/10/proton-pass-brings-folders-and-detailed-autofill-controls/

Mozilla Thunderbird 158 Email Client Improves Quick Filter Responsiveness:
https://9to5linux.com/mozilla-thunderbird-158-email-client-improves-quick-filter-responsiveness

ONLYOFFICE 10.0 is a ‘fully rebuilt app’ with expanded AI tools:
https://www.omgubuntu.co.uk/2026/10/onlyoffice-10-expands-ai-tools

This Dev Built an Office Suite Because His Wife Kept Going Back to Microsoft Office:
https://itsfoss.com/news/elixiroffice-euro-office-fork/

AliasVault 0.31 brings faster vault synchronization and vault sharing with family members:
https://alternativeto.net/news/2026/10/aliasvault-0-31-brings-faster-vault-synchronization-and-vault-sharing-with-family-members/

addy.io Rules now send signed webhooks for incoming email:
https://alternativeto.net/news/2026/10/addy-io-rules-now-send-signed-webhooks-for-incoming-email/

Waterfox 6.7.6 adds feed controls and fixes startup hangs:
https://alternativeto.net/news/2026/10/waterfox-6-7-6-adds-feed-controls-and-fixes-startup-hangs/

Kdenlive 26.08.2 Release: Stability Fixes for Project Handling, Proxies, and Audio:
https://www.linuxcompatible.org/story/kdenlive-26082-release-stability-fixes-for-project-handling-proxies-and-audio/

OBS Studio 33.0.0-RC2 Released: Major CEF and Plugin Overhaul:
https://www.linuxcompatible.org/story/obs-studio-3300rc2-released-major-cef-and-plugin-overhaul/

PhotoFlare 1.7.5 adds ARM packages and macOS fixes:
https://alternativeto.net/news/2026/10/photoflare-1-7-5-adds-arm-packages-and-macos-fixes/

Calibre 9.16 adds Kokoro voices for read aloud, Camoufox integration & updated Kobo driver:
https://alternativeto.net/news/2026/10/calibre-9-16-adds-kokoro-voices-for-read-aloud-camoufox-integration-and-updated-kobo-driver/

PeaZip 11.4 Open-Source Archive Manager Released with Various Improvements:
https://9to5linux.com/peazip-11-4-open-source-archive-manager-released-with-various-improvements

RustGIS is a Desktop GIS Tool That Also Runs in a Browser:
https://itsfoss.com/rustgis-open-source-gis-tool/

(post 5/7)

#WeeklyNews #OpenSource #FOSSNews #FOSS #OpenSourceNews #News #Firefox #ZenBrowser #UngoogledChromium #Proton #ProtonPass #Thunderbird #ONLYOFFICE #ElixirOffice #AliasVault #AddyIO #Waterfox #Kdenlive #OBS #OBSStudio #PhotoFlare #Calibre #PeaZip #RustGIS #GIS #MozillaFirefox #Browser #Email #ContentCreation #EbookManager #FosseryTech

Godot 4.8 Beta 1 Released: Feature Freeze and Final Testing Begin:
https://www.linuxcompatible.org/story/godot-48-beta-1-released-feature-freeze-and-final-testing-begin/

Bevy 0.20 brings major rendering, shading, and UI enhancements to open-source game engine:
https://alternativeto.net/news/2026/10/bevy-0-20-brings-major-rendering-shading-and-ui-enhancements-to-open-source-game-engine/

Zed Editor 1.24.2 Release: Git Tags, Agent Terminal Drag-and-Drop, and a 23% Smaller Linux Build:
https://www.linuxcompatible.org/story/zed-editor-1242-release-git-tags-agent-terminal-draganddrop-and-a-smaller-linux-build/

VSCodium 1.140.06880 Removes Copilot, Claude, and Codex AI SDKs:
https://www.linuxcompatible.org/story/vscodium-114006880-removes-copilot-claude-and-codex-ai-sdks/

Apache NetBeans IDE 32 RC1 Released: Final Testing Phase Begins:
https://www.linuxcompatible.org/story/apache-netbeans-ide-32-rc1-released-final-testing-phase-begins/

Codeberg Pages legacy server to be discontinued in favor of git-pages, hosted pages need to be migrated manually:
https://blog.codeberg.org/migrate-your-site-to-the-new-git-pages-backed-codeberg-pages-now-were-sunsetting-codeberg-pages-v2.html
(Interesting, I ran the migration check, for the two FosseryWeb sites, and it says that they are still on the legacy server, which is weird, because I clearly remember migrating those when the migration option came out earlier, whatever, will take a look at it again.)

Node.js 26.12.0 and 24.22.0 Krypton: What Changed and How to Upgrade:
https://www.linuxcompatible.org/story/nodejs-26120-and-24220-krypton-what-changed-and-how-to-upgrade/

Rust 1.99.1 Released: Three Critical Bugs Fixed in Record Two-Week Turnaround:
https://www.linuxcompatible.org/story/rust-1991-released-three-critical-bugs-fixed-in-record-twoweek-turnaround/

Python 3.16 Alpha 1 Released: What's New and the JIT Debate Ahead:
https://www.linuxcompatible.org/story/python-316-alpha-1-released-whats-new-and-the-jit-debate-ahead/

PHP 8.6.0 RC3 Now Available in Ondřej Surý's Repositories for Debian and Ubuntu:
https://www.linuxcompatible.org/story/php-860-rc3-now-available-in-ond%C5%99ej-sur%C3%BDs-repositories-for-debian-and-ubuntu/

Bootstrap returns with version 6 Alpha, bringing ground-up modernization of the framework:
https://alternativeto.net/news/2026/10/bootstrap-returns-with-version-6-alpha-bringing-ground-up-modernization-of-the-framework/

PostgreSQL 19 RC1 Released: Native REPACK, Parallel Autovacuum, and Upgrades to Watch:
https://www.linuxcompatible.org/story/postgresql-19-rc1-released-native-repack-parallel-autovacuum-and-upgrades-to-watch/

SQLite 3.54.1 Released: Fixes 32-bit Heap-Buffer Overflow:
https://www.linuxcompatible.org/story/sqlite-3541-released-fixes-32bit-heapbuffer-overflow/

OpenCode 2.0 officially launches with background agents, Code Mode, and a rebuilt API:
https://alternativeto.net/news/2026/10/opencode-2-0-officially-launches-with-background-agents-code-mode-and-a-rebuilt-api/

NGINX 1.31.7 and 1.30.6 Patch Five Security Flaws, Two Back to 2009:
https://www.linuxcompatible.org/story/nginx-1317-and-1306-patch-five-security-flaws-two-back-to-2009/

(post 6/7)

#WeeklyNews #OpenSource #FOSSNews #FOSS #OpenSourceNews #News #Godot #Bevy #Zed #ZedEditor #VSCodium #NetBeans #NodeJS #Rust #Python #PHP #Bootstrap #PostgreSQL #SQLite #OpenCode #NGINX #FosseryTech

Heute morgen ging es hier um den unsichtbaren Mitbewohner in meinem Rechner. Jetzt interessiert mich, wann ihr ihn zum ersten Mal wirklich bemerkt habt. Nicht die Installation, nicht der erste Befehl, sondern der Augenblick, in dem ihr wusstet, dass ihr bleibt.

Was war euer schönster Moment mit Linux?

#Linux #Community #OpenSource #FOSS

Self-Host Weekly (16 October 2026)

#Bitwarden license changes, software updates and launches, a spotlight on #Homelable, and more in this week's #selfhosted recap!

https://selfh.st/weekly/2026-10-16/

#selfhost #selfhosting #opensource #foss #homelab #server #newsletter #privacy #fediverse #mastodon #smarthome #gitlab #forgejo #github #sonarr #jellyfin #sysadmin #devops #development #ai #vibecoding #google #apple

Für wen betreiben wir eigentlich noch unsere Webserver?

Manchmal frage ich mich, für wen wir eigentlich Webprojekte entwickeln, betreiben und pflegen.

Ursprünglich ist die Antwort ganz einfach: für Menschen.

Wir stellen Informationen bereit, entwickeln Anwendungen, ermöglichen Kommunikation und schaffen digitale Angebote, die anderen Menschen einen Nutzen bringen sollen.

Doch wenn ich mir heute unsere Serverprotokolle ansehe, entsteht zunehmend ein anderes Bild.

Nach unseren bisherigen Auswertungen sind mindestens 75 % der registrierten Zugriffe verdächtig oder angreiferisch. Und diese Schätzung dürfte eher zurückhaltend sein.

Natürlich ist nicht jeder automatisierte Zugriff ein Angriff. Suchmaschinen, Monitoring und die Kommunikation föderierter Netzwerke gehören ebenso zum Internet. Doch sie ändern nichts an der Entwicklung, die ich in unserer täglichen Arbeit beobachte.

Wir beschäftigen uns immer intensiver mit der Abwehr von Angriffen, der Erkennung verdächtiger Aktivitäten, der Absicherung von Anwendungen und der Überwachung unserer Infrastruktur.

Firewalls, Sperrlisten, Angriffserkennung, Sicherheitsupdates und Protokollanalysen beanspruchen zunehmend unsere Aufmerksamkeit.

All das ist notwendig. Ohne diese Maßnahmen könnten wir unsere Webprojekte kaum noch zuverlässig betreiben.

Aber genau darin liegt das Problem.

Wir investieren immer mehr Arbeit, um unsere Webprojekte vor Missbrauch zu schützen, statt ihre eigentlichen Funktionen für menschliche Besucher weiterzuentwickeln.

Eine ursprünglich unterstützende Tätigkeit beginnt, unsere eigentliche Arbeit zu verdrängen.

Dabei geht es nicht nur um zusätzliche Kosten für Rechenleistung, Speicherplatz oder Datenverkehr. Es geht um unsere begrenzte Arbeitszeit, unsere Konzentration und unsere Möglichkeiten, neue Ideen umzusetzen.

Jede Stunde, die wir mit der Untersuchung automatisierter Angriffe verbringen müssen, steht uns für die Weiterentwicklung unserer Webprojekte nicht zur Verfügung.

Selbstverständlich gehört Sicherheit seit jeher zum Betrieb von IT-Systemen. Aber ich frage mich zunehmend, ob das Verhältnis zwischen der eigentlichen Aufgabe und dem notwendigen Schutz noch angemessen ist.

Denn wir betreiben unsere Server nicht, um Angriffe abzuwehren.

Wir wehren Angriffe ab, damit wir unsere Server für Menschen betreiben können.

Dieser Unterschied erscheint mir wesentlich.

Wie erleben andere Administratoren und Entwickler diese Entwicklung? Wie viel eurer täglichen Arbeit dient noch unmittelbar der Verbesserung eurer Angebote – und wie viel Zeit verbringt ihr inzwischen damit, deren Betrieb gegen Missbrauch abzusichern?

#Webserver #Systemadministration #ITSecurity #OpenSource #Webentwicklung

New in #LibreOffice 26.8: More descriptive fields – Displaying field names now includes clearer descriptions for document statistics fields, making complex documents easier to understand. https://wiki.documentfoundation.org/ReleaseNotes/26.8 #foss #opensource #freesoftware

#GNOME 50.6 Desktop Environment Released with Fixes for Nautilus, GNOME Shell, Mutter, and Orca https://9to5linux.com/gnome-50-6-desktop-environment-released-with-fixes-for-nautilus-gnome-shell

@gnome #Linux #OpenSource #FOSS

Alt...

GNOME 50.6

In front in the beautiful blue color you can see my SBC powering the playback of this Jazz masterpiece

https://mastodon.bsd.cafe/@Dendrobatus_Azureus/117457433608555207

#SBC #Pi5 #Raspberry #Linux #POSIX #opensource #programming

The week, it seems, is getting worse by the second. I will use my magic to curse Torvald, such should be how we deal with the techno-fascists who abet genocide, and shamelessly, gluttonously ruin the entire experience of life for others. He is going to become TorBALD very soon, inshallah.

(Omitting the 'S' from Torvalds because he is only half a man, much less many. Hallelujah.)

#noai #FOSS #linux #ai #generativeAI #llm #fascism #technofascism #opensource #torvalds

ImpressCMS 2.0.4 Beta is now available for testing

What's new:
- Internal link service with a CKEditor plugin
- Session keep-alive for logged-in users

What's fixed:
- Array config values no longer reading as empty
- System module updates resetting the db version to 47
- Login redirect logic
- CSRF protections improved

This is a pre-release. Please back up and test on a staging site, then report issues on GitHub.

More info: https://www.impresscms.org/modules/news/article.php?article_id=1067&title=imprescms-204-beta-released

#ImpressCMS #OpenSource #CMS #PHP #FOSS

Alt...

ImpressCMS logo with an orange speech bubble reading “2.0.4 Beta”. Text: “Pre-release. Ready for testing.” Features: CKEditor internal links, session keep-alive, CSRF hardening, bug fixes.

🎰 Linux kernel devs drop obligatory confession of AI tool usage

"The Maintainers Summit reached consensus to deprecate the Assisted-by Tag," said Sasha Levin, a Linux kernel developer and engineer at Nvidia, in a message to the Linux kernel mailing list last week. "Remove the documentation requiring it."

https://www.theregister.com/ai-and-ml/2026/10/14/linux-kernel-devs-drop-obligatory-confession-of-ai-tool-usage/5303140

#linux #kernel #ai #vibecoding #opensource

Mein Umzug auf einen neuen #PasswortManager (Open Source) | c't Magazin https://www.heise.de/news/Mein-Umzug-auf-einen-neuen-Passwort-Manager-Open-Source-11474408.html #Datenschutz #privacy #Bitwarden #Passbolt #PasswordSafe #Psono #KeePass #ProtonPass #Android #iOS #Windows #macOS #Linux #OpenSource #DigitalSovereignty #PasswordManager

Security Advisory: CVE-2025-60492 - Uncontrolled Recursion in GPAC/MP4Box

Processing a crafted MP4 file with specially constructed BIFS scene data causes unbounded recursion between BIFS decoder functions, exhausting the stack and crashing MP4Box.

Summary:
The `gf_bifs_dec_node` function in `bifs/field_decode.c` decodes MPEG-4 BIFS scene nodes by calling `BD_DecMFFieldList`, `gf_bifs_dec_field`, and `gf_bifs_dec_node_list`, which in turn call back into `gf_bifs_dec_node`. A crafted MP4 file with deeply or cyclically nested BIFS containers triggers this mutual recursion without a depth limit, consuming all available stack memory and crashing the process with a stack-overflow signal.

CWE:
CWE-674 - Uncontrolled Recursion

Affected Component:
```
bifs/field_decode.c:905
Function: gf_bifs_dec_node()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
2.5-DEV-rev1687-ge44a4e2b0-master; commit `e44a4e2b0d193566619ada71599e70255699da94`. Any codebase equivalent to this commit that has not applied the fix commit is affected.

Attack Conditions:
An attacker supplies a crafted MP4 file whose embedded BIFS scene data contains deeply nested or mutually referencing node containers. Local access is required; the victim must invoke `MP4Box -x3d <crafted_file>` or any equivalent BIFS scene export command that triggers the recursive decoder path.

Impact:
The uncontrolled recursion exhausts the process stack, resulting in an immediate crash and Denial of Service. No evidence of arbitrary code execution was observed; stack-exhaustion crashes via recursion do not provide an exploitable control-flow primitive.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
8e7b9a3a04331286b89d1803c65a2d6edc11b4c4
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3324
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/59/59_Anchor_Create_scenegraph_mpeg4_nodes_c_171
- Fix: https://github.com/gpac/gpac/commit/8e7b9a3a04331286b89d1803c65a2d6edc11b4c4

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60488 - NULL Pointer Dereference in GPAC/MP4Box

Processing a crafted MP4 file with a missing Sample Description box triggers a NULL pointer dereference in `dump_isom_saps`, causing MP4Box to crash.

Summary:
The `dump_isom_saps` function in `applications/mp4box/filedump.c` iterates over track metadata to dump SAP (Sync Access Point) information. When the input MP4 contains a corrupted track structure where the Sample Description box (`stsd`) is absent, the function accesses track metadata pointers without prior validation, dereferencing a near-NULL address (0x1c, 28-byte struct offset) and triggering SIGSEGV.

CWE:
CWE-476 - NULL Pointer Dereference

Affected Component:
```
applications/mp4box/filedump.c:1743
Function: dump_isom_saps()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
2.5-DEV-rev1672-gc9a31d0e1-master; commit `c9a31d0e1b649a30814c6d81c5461859ed63d075`. Any codebase equivalent to this commit that has not applied the fix commit is affected.

Attack Conditions:
An attacker supplies a crafted MP4 file whose track structure lacks a valid `stsd` box. Local access is required; the victim must invoke `MP4Box -dsap 1 <crafted_file>` or any equivalent SAP analysis command that exercises the SAP dump path.

Impact:
The near-NULL pointer dereference (READ at address 0x00000000001c) causes an immediate process crash, resulting in Denial of Service. No evidence of arbitrary code execution was observed; the faulting access is a near-NULL read that is not exploitable for control-flow hijacking.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
e6d01820d7bf3967d931fedb379ee5f209bc133b
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3321
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/57/57_dump_isom_saps_filedump_c_1743
- Fix: https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Any #opensource printers yet?

I need a new one but i dont want to be locked in or pay a fortune on ink. Was thinking about those thermal printers bus most if not all require sus apps

#hivemind #printers

Security Advisory: CVE-2025-60487 - NULL Pointer Dereference in GPAC/MP4Box

Processing an empty XML file with the `-dnal` option triggers a NULL pointer dereference in `gf_isom_get_esd`, causing MP4Box to crash.

Summary:
The `gf_isom_get_esd` function in `isomedia/isom_read.c` retrieves an Elementary Stream Descriptor for a given track. When processing an empty file with an `.xml` extension, the ISO media layer lacks a valid media descriptor structure; the function dereferences a near-NULL pointer at address 0x50 (80-byte struct offset) without validating the pointer beforehand, terminating the process with SIGSEGV.

CWE:
CWE-476 - NULL Pointer Dereference

Affected Component:
```
isomedia/isom_read.c:1386
Function: gf_isom_get_esd()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
2.5-DEV-rev1665-g3f20eb0cd-master; commit `3f20eb0cd22116367c036e6ffe6ace299b38d686`. Any codebase equivalent to this commit that has not applied the fix commit is affected.

Attack Conditions:
An attacker supplies an empty or minimal file with an `.xml` extension. Local access is required; the victim must invoke `MP4Box -dnal 1 <crafted_file>.xml` or any equivalent NAL dump command that triggers the ESD retrieval path on an uninitialized media context.

Impact:
The near-NULL pointer dereference (READ at address 0x000000000050) causes an immediate process crash, resulting in Denial of Service. No evidence of arbitrary code execution was observed; the faulting access is a near-NULL read that is not exploitable for control-flow hijacking.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
e6d01820d7bf3967d931fedb379ee5f209bc133b
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3320
- PoC: N/A (see issue)
- Fix: https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60490 - Use-After-Free in GPAC/MP4Box

Processing a crafted MPEG-2 Transport Stream file triggers a heap use-after-free in `gf_filter_pid_send_event_downstream` when a freed PID instance is accessed during event propagation.

Summary:
When parsing a crafted MPEG-2 TS file with malformed PMT descriptors and sync marker violations, `gf_filter_pid_inst_swap_delete` frees a PID instance at `filter_pid.c:551`. A stale reference to this freed 344-byte region is subsequently read in `gf_filter_pid_send_event_downstream` at line 7919 (READ of 8 bytes at offset 0 of the freed object) because the pointer is not cleared after deallocation.

CWE:
CWE-416 - Use After Free

Affected Component:
```
filter_core/filter_pid.c:7919
Function: gf_filter_pid_send_event_downstream()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
2.5-DEV-rev1665-g3f20eb0cd-master; commit `3f20eb0cd22116367c036e6ffe6ace299b38d686`. Any codebase equivalent to this commit that has not applied the fix commit is affected.

Attack Conditions:
An attacker supplies a crafted MPEG-2 TS file containing broken PMT descriptor sizes, unsupported stream types, and missing sync markers. Local access is required; the victim must invoke `MP4Box -add <crafted_file> -new /dev/null` or any equivalent import command that triggers the filter PID event propagation path.

Impact:
The use-after-free (READ of size 8 at offset 0 inside a freed 344-byte heap region) results in process termination, causing Denial of Service. Arbitrary code execution is possible; the first MITRE request explicitly marks code execution impact as true, and use-after-free vulnerabilities at the start of a controlled heap object are a known code-execution primitive.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
d0793f92e04fe284a25c2a9335cc5edc68deb6d4
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3315
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/54/54_gf_filter_pid_send_event_downstream_filter_core_filter_pid_c_7919
- Fix: https://github.com/gpac/gpac/commit/d0793f92e04fe284a25c2a9335cc5edc68deb6d4

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60478 - Heap Use-After-Free in GPAC Packet Destruction

Processing a crafted MPEG-2 TS input with MP4Box DASH segmentation can trigger a heap use-after-free in `gf_filter_packet_destroy()`.

Summary:
Malformed program table data and empty DASH segment state can cause GPAC to mishandle packet ownership. The file output and PID packet drop path later destroy a packet object that has already been invalidated.

AddressSanitizer reports `heap-use-after-free` in `filter_core/filter_pck.c`.

CWE:
CWE-416 - Use After Free

Affected Component:
```
filter_core/filter_pck.c:678
Function: gf_filter_packet_destroy()
```

Relevant ASAN stack:

```
gf_filter_packet_destroy filter_core/filter_pck.c:678
gf_filter_packet_destroy filter_core/filter_pck.c:684
gf_filter_pid_drop_packet filter_core/filter_pid.c:7270
fileout_process filters/out_file.c:933
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
```
GPAC version: 2.5-DEV-rev1617-g856674b22-master
Commit: 856674b226d6cbe28a941ad223be38194cbf7d37
```

Attack Conditions:
An attacker supplies a crafted MPEG-2 TS file that is processed by MP4Box DASH segmentation:

```
./MP4Box -dash 100 47_gf_filter_packet_destroy_filter_core_filter_pck_c_678
```

Impact:
The observed impact is Denial of Service. Because the issue is a heap use-after-free, memory corruption risk is also present.

Fix / mitigation status:
The MITRE response in the local data records the fix as:

```
c592a144bbe339ee581ca88aaa3247362795b742
```

References:

- CVE: https://www.cve.org/CVERecord?id=CVE-2025-60478
- Issue: https://github.com/gpac/gpac/issues/3300
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/47/47_gf_filter_packet_destroy_filter_core_filter_pck_c_678
- Fix: https://github.com/gpac/gpac/commit/c592a144bbe339ee581ca88aaa3247362795b742

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60482 - Use-After-Free in GPAC MP4Box AC-4 Descriptor Cleanup

Processing a crafted AC-4 stream with MP4Box can trigger a heap use-after-free in `gf_odf_ac4_cfg_clean_list()`.

Summary:
The recursive AC-4 descriptor cleanup path can revisit or count a list object that has already been freed. When MP4Box imports a crafted AC-4 input, descriptor destruction reaches `gf_odf_ac4_cfg_clean_list()` and then `gf_list_count()` on stale heap memory.

AddressSanitizer reports `heap-use-after-free`.

CWE:
CWE-416 - Use After Free

Affected Component:
```
odf/descriptors.c:2411
Function: gf_odf_ac4_cfg_clean_list()

utils/list.c:664
Function: gf_list_count()
```

Relevant ASAN stack:

```
gf_list_count utils/list.c:664
gf_odf_ac4_cfg_clean_list odf/descriptors.c:2411
gf_odf_ac4_cfg_clean_list odf/descriptors.c:2400
dac4_box_del isomedia/box_code_base.c:9218
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
```
GPAC version: 2.5-DEV-rev1593-gfe88c3545-master
Commit: fe88c3545aadd597b250ccf23271d5d3de50ccc8
```

Attack Conditions:
An attacker supplies a crafted AC-4 file that is imported by MP4Box:

```
./MP4Box -add 46_gf_odf_ac4_cfg_clean_list_odf_descriptors_c_2411 -new /dev/null
```

Impact:
The observed impact is Denial of Service. Because the bug is a heap use-after-free, memory corruption risk is also present.

Fix / mitigation status:
The MITRE response in the local data records the fix as:

```
e02d1fd24cdc26acb1b236ab38b3832cffcae21b
```

References:

- CVE: https://www.cve.org/CVERecord?id=CVE-2025-60482
- Issue: https://github.com/gpac/gpac/issues/3297
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/46/46_gf_odf_ac4_cfg_clean_list_odf_descriptors_c_2411
- Fix: https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60470 - Out-of-Bounds Read in GPAC MP4Box AC-4 Parser

An out-of-bounds read vulnerability exists in GPAC MP4Box when processing a crafted AC-4 stream. The issue occurs in `gf_ac4_parser_bs()` in `media_tools/av_parsers.c` and is reachable during media import through MP4Box commands such as `-info`.

Summary:
AddressSanitizer confirms a global-buffer-overflow at `media_tools/av_parsers.c:16137`. The parser reads 4 bytes past the end of the global `AC4_SAMPLE_DELTA_TABLE_441` array due to insufficient bounds checking of AC-4 sample delta table indexes.

The crafted AC-4 stream causes the AC-4 parser to access `AC4_SAMPLE_DELTA_TABLE_441` with an out-of-bounds index. The invalid read occurs while probing the AC-4 stream and then propagates through the MP4Box media import path.

Relevant AddressSanitizer trace:

```
==1845261==ERROR: AddressSanitizer: global-buffer-overflow on address 0x7f4214ddf8fc
READ of size 4 at 0x7f4214ddf8fc thread T0
#0 0x... in gf_ac4_parser_bs media_tools/av_parsers.c:16137
#1 0x... in ac4dmx_probe_data filters/reframe_ac4.c:546
#2 0x... in gf_filter_pid_raw_new filter_core/filter.c:4704
#3 0x... in filein_process filters/in_file.c:610
#4 0x... in gf_filter_process_task filter_core/filter.c:3187
#5 0x... in gf_fs_thread_proc filter_core/filter_session.c:2421
#6 0x... in gf_fs_run filter_core/filter_session.c:2728
#7 0x... in gf_media_import media_tools/media_import.c:1278
#8 0x... in convert_file_info applications/mp4box/fileimport.c:131
#9 0x... in mp4box_main applications/mp4box/mp4box.c:6520

0x7f4214ddf8fc is located 36 bytes before global variable 'AC4_SAMPLE_DELTA_TABLE_48'
defined in 'media_tools/av_parsers.c:14246:11' of size 56
0x7f4214ddf8fc is located 4 bytes after global variable 'AC4_SAMPLE_DELTA_TABLE_441'
defined in 'media_tools/av_parsers.c:14263:11' of size 56

SUMMARY: AddressSanitizer: global-buffer-overflow media_tools/av_parsers.c:16137 in gf_ac4_parser_bs
```

CWE:
CWE-125 - Out-of-bounds Read

Affected Component:
```
media_tools/av_parsers.c:16137
Function: gf_ac4_parser_bs()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
```
2.5-DEV-rev1593-gfe88c3545-master
Commit: fe88c3545aadd597b250ccf23271d5d3de50ccc8
```

Attack Conditions:
An attacker supplies a crafted input file that is processed by MP4Box. The issue can be reproduced locally with:
```
./MP4Box -info 43_gf_ac4_parser_bs_media_tools_av_parsers_c_16137
```

Attack vector: local crafted AC-4 file processed by MP4Box
User interaction: required

Impact:
denial of service via application crash

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
e02d1fd24cdc26acb1b236ab38b3832cffcae21b
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3294
- Fix: https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/43/43_gf_ac4_parser_bs_media_tools_av_parsers_c_16137
- CVE: https://www.cve.org/CVERecord?id=CVE-2025-60470

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60476 - Heap Use-After-Free in GPAC MP4Box AC-4 Descriptor Cleanup

A heap use-after-free vulnerability exists in GPAC MP4Box when processing a crafted AC-4 file. The issue occurs in `gf_odf_ac4_cfg_clean_list()` in `odf/descriptors.c` during recursive cleanup of AC-4 configuration lists.

Summary:
AddressSanitizer confirms a heap-use-after-free at `odf/descriptors.c:2419`. The cleanup code accesses a list node after it has already been freed in a recursive cleanup path, causing MP4Box to crash.

The crafted AC-4 stream contains malformed configuration list data. During parsing and cleanup, `gf_odf_ac4_cfg_clean_list()` recursively destroys AC-4 configuration structures. A node is freed in a deeper cleanup level and later accessed again by the caller, resulting in a read from freed heap memory.

Relevant AddressSanitizer trace:

```
[AC4] Don't support presentation_version 0.
==1841011==ERROR: AddressSanitizer: heap-use-after-free on address 0x508000000470
READ of size 8 at 0x508000000470 thread T0
#0 0x... in gf_odf_ac4_cfg_clean_list odf/descriptors.c:2419
#1 0x... in gf_odf_ac4_cfg_clean_list odf/descriptors.c:2400
#2 0x... in gf_ac4_parser_bs media_tools/av_parsers.c:16101
#3 0x... in ac4dmx_process filters/reframe_ac4.c:388
#4 0x... in gf_filter_process_task filter_core/filter.c:3187
#5 0x... in gf_fs_thread_proc filter_core/filter_session.c:2421
#6 0x... in gf_fs_run filter_core/filter_session.c:2728
#7 0x... in gf_media_import media_tools/media_import.c:1278
#8 0x... in convert_file_info applications/mp4box/fileimport.c:131
#9 0x... in mp4box_main applications/mp4box/mp4box.c:6520

0x508000000470 is located 80 bytes inside of 88-byte region [0x508000000420,0x508000000478)
freed by thread T0 here:
#0 0x... in free
#1 0x... in gf_odf_ac4_cfg_clean_list odf/descriptors.c:2432
#2 0x... in gf_odf_ac4_cfg_clean_list odf/descriptors.c:2400

previously allocated by thread T0 here:
#0 0x... in malloc
#1 0x... in gf_ac4_raw_frame media_tools/av_parsers.c:15938
#2 0x... in gf_ac4_parser_bs media_tools/av_parsers.c:16113

SUMMARY: AddressSanitizer: heap-use-after-free odf/descriptors.c:2419 in gf_odf_ac4_cfg_clean_list
```

CWE:
CWE-416 - Use After Free

Affected Component:
```
odf/descriptors.c:2419
Function: gf_odf_ac4_cfg_clean_list()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
```
2.5-DEV-rev1593-gfe88c3545-master
Commit: fe88c3545aadd597b250ccf23271d5d3de50ccc8
```

Attack Conditions:
An attacker supplies a crafted input file that is processed by MP4Box. The issue can be reproduced locally with:
```
./MP4Box -info 42_gf_odf_ac4_cfg_clean_list_odf_descriptors_c_2419
```

Attack vector: local crafted AC-4 file processed by MP4Box
User interaction: required

Impact:
denial of service via application crash; local MITRE data also identifies potential arbitrary code execution risk

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
e02d1fd24cdc26acb1b236ab38b3832cffcae21b
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3293
- Fix: https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/42/42_gf_odf_ac4_cfg_clean_list_odf_descriptors_c_2419
- BDU: https://bdu.fstec.ru/vul/2025-08612
- CVE: https://www.cve.org/CVERecord?id=CVE-2025-60476

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

A new issue of This Week In GNOME is now online!

#270 Visualized Community
https://thisweek.gnome.org/posts/2026/10/twig-270/

#ThisWeekInGNOME #FreeSoftware #FOSS #OpenSource

Security Advisory: CVE-2025-60469 - NULL Pointer Dereference in GPAC MP4Box AC-4 Parser

A NULL pointer dereference vulnerability exists in GPAC MP4Box when processing a crafted AC-4 stream. The issue occurs in `gf_ac4_presentation_ch_mode()` in `media_tools/av_parsers.c` and can be triggered by running MP4Box with the `-info` option on a malformed input file.

Summary:
AddressSanitizer confirms a segmentation fault at `media_tools/av_parsers.c:15641`. The parser attempts to read through a NULL or invalid pointer while handling an AC-4 stream with unsupported `presentation_version` and missing substream group information.

The crafted AC-4 stream declares an unsupported presentation version and omits required substream group data. MP4Box reports that `presentation_version 0` is unsupported and that substream group `1` cannot be found for presentation `0`. The error path then reaches `gf_ac4_presentation_ch_mode()` and dereferences an invalid pointer, resulting in a segmentation fault.

Relevant AddressSanitizer trace:

```
[AC4] Don't support presentation_version 0.
[AC4] Cannot find substream group 1 for presentation 0
AddressSanitizer:DEADLYSIGNAL
==1829578==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000048
==1829578==The signal is caused by a READ memory access.
==1829578==Hint: address points to the zero page.
#0 0x... in gf_ac4_presentation_ch_mode media_tools/av_parsers.c:15641
#1 0x... in gf_ac4_raw_frame media_tools/av_parsers.c:15976
#2 0x... in gf_ac4_parser_bs media_tools/av_parsers.c:16113
#3 0x... in ac4dmx_process filters/reframe_ac4.c:388
#4 0x... in gf_filter_process_task filter_core/filter.c:3187
#5 0x... in gf_fs_thread_proc filter_core/filter_session.c:2421
#6 0x... in gf_fs_run filter_core/filter_session.c:2728
#7 0x... in gf_media_import media_tools/media_import.c:1278
#8 0x... in convert_file_info applications/mp4box/fileimport.c:131
#9 0x... in mp4box_main applications/mp4box/mp4box.c:6520

SUMMARY: AddressSanitizer: SEGV media_tools/av_parsers.c:15641 in gf_ac4_presentation_ch_mode
```

CWE:
CWE-476 - NULL Pointer Dereference

Affected Component:
```
media_tools/av_parsers.c:15641
Function: gf_ac4_presentation_ch_mode()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
```
2.5-DEV-rev1593-gfe88c3545-master
Commit: fe88c3545aadd597b250ccf23271d5d3de50ccc8
```

Attack Conditions:
An attacker supplies a crafted input file that is processed by MP4Box. The issue can be reproduced locally with:
```
./MP4Box -info 41_gf_ac4_presentation_ch_mode_media_tools_av_parsers_c_15641
```

Attack vector: local crafted AC-4 file processed by MP4Box
User interaction: required

The prepared CVSS vector in the local data is:
```
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
```

Impact:
denial of service via application crash

Base score: 5.5, Medium.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
e02d1fd24cdc26acb1b236ab38b3832cffcae21b
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3292
- Fix: https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/41/41_gf_ac4_presentation_ch_mode_media_tools_av_parsers_c_15641
- CVE: https://www.cve.org/CVERecord?id=CVE-2025-60469

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

🐧 Artikelreihe: Der Umstieg von TUXEDO OS auf Debian Testing

Ihr möchtet mehr über TUXEDO OS erfahren? Wir haben unsere bisherigen Artikel für euch zusammengestellt!

🔎 Was interessiert euch besonders: TUXEDO OS für Entwickler oder digitale Souveränität?

Viel Spaß beim Lesen!

👉 https://www.tuxedocomputers.com/de/Infos/News.tuxedo?tuxpage=1&tuxsort=false,true#2296,12591

#TUXEDO #Linux #Debian #OpenSource

Alt...

Schwarzer Kreis mit einem weißen, geometrisch stilisierten X in der Mitte, umgeben von einer breiten roten Pinselspirale, die teilweise überlappt.

Ich habe einen neuen Podcast: NET⫽SPLIT

Jetzt ist es offiziell, @daniel und ich haben zusammen einen #Podcast, @netsplit \o/

Geplant ist ein Laberpodcast rund um #OpenSource und Dezentralität, auch wenn die ganz genaue Ausrichtung noch nicht 100% fest steht.

Den Podcast veröffentlichen wir als Video- und Audio-Format über #PeerTube und natürlich auch #RSS und es kommt jeden Monat eine neue Folge raus.

Ich bin mega happy mit dem Projekt und ich hoffe, ihr schaut oder hört mal rein. Alle Abo-Möglichkeiten findet ihr auf unserer Website zusammen gefasst:

https://netsplit.fm/

P.S.: An alle @rebootpolitics -Fans, keine Sorge, mein geliebter Politik-Podcast läuft natürlich auch weiter und wir planen aktuell wieder neue Interviews und anderen Schabernack.

#NetSplit #RebootPolitics #Fediverse #XMPP

Alt...

Das NET⫽SPLIT-Cover. Links stehe ich, rechts Daniel und wir lächeln beide in dieKamera. Im Vordergrund ein weißer Schriftzug auf beerenfarbenen und mittelgrünem Grund: "NET⫽SPLIT, Ein Podcast mit Ückück und Daniel". Der Hintergrund ist leicht geblurt und in dunkelgrau gefärbt.

Dzięki za głosy w ankiecie! Wyniki są jasne: 75% z Was woli zostawić komentowanie na Mastodonie.

Myślałem o opcji hybrydowej z użyciem `mastodon-comments` (osadzenie dyskusji pod artykułem), ale idąc za Waszym głosem, po prostu odpuszczam temat.

Dyskusja kwitnie w Fediwersum i niech tam zostanie. Dzięki za pomoc w decyzji! 👋

#prywatność #opensource #privacy

🗳️ OWASP Board Election voting is OPEN!

3 Board seats are up for election. Make your voice heard and help shape OWASP’s future!

📩 Check your personal and OWASP email for your ballot.

⏰ Closes Oct 30, midnight UTC.

Vote now: https://owasp.org/board/elections/2026

#community #opensource #boardelections

Wine 11.20 brings more improvements for ARM64EC, XML validation and CDROMs https://www.gamingonlinux.com/2026/10/wine-11-20-brings-more-improvements-for-arm64ec-xml-validation-and-cdroms/

#Wine #OpenSource #Linux

Ich habe in den letzten zwei Monaten eine #Skill Suite für Continuous Refactoring gebaut. Sie funktioniert mit allen gängigen Agenten von #OpenCode, #ClaudeCode, #Cursor usw. Version 0.7.0 hat einen guten Schritt nach vorne gemacht, weshalb ich sie euch heute vorstellen möchte.

Schaut sie euch an unter https://continuous-refactoring.de/

#OpenSource #AgenticEngineering

There are decisions you don’t like to make—and you like implementing them even less. Take choosing an operating system, for example. Unfortunately, it’s not very productive to insist on open-source systems if they don’t work flawlessly on your own hardware.

Take, for example, my new Asus NUC 16 Pro with an Intel Ultra X7 processor and its built-in (soldered) components. The only Linux distribution that runs smoothly on it is Fedora. However, for political reasons (the U.S.), I no longer want to use it (although, from a user’s perspective, I do miss it—it’s simply the best Linux, period). But I haven’t been able to get U.S.-independent distributions like Debian to run properly on it; in some cases, the system wasn’t even recognized when I tried installing them from a USB drive. Another new experience… but then again, I’ve never had such relatively brand-new hardware that also requires a cutting-edge kernel. Maybe Ubuntu would work, but I don’t like Ubuntu or Canonical. That’s why I’m running Windows 11 Pro on it. Reluctantly, but everything works.

The same goes for my old ThinkPad T490s. Everything works wonderfully with any Linux distribution—except for the 5G modem. And I need that when I’m on the go. There’s no workaround for it either; I’ve probably scoured the entire web for one, but not a single tip helped. So here, too: Windows...

Now I actually have two Windows computers running again, for the sake of my sanity and to save time. At least I’m using only local accounts and the strictest possible privacy settings and tweaks you can apply to Windows. And I only use those two computers when necessary.

Most of my work continues to run on my two Debian systems, the FreeBSD computer, and, when necessary, on the Mac as well.

Still, it leaves a bad taste in my mouth, but I don’t want to let the devices sit around unused.

Is it just me, or are there others who feel torn like this???

#linux #opensource #freesoftware #windows #fedora #debian #freebsd #ubuntu #apple #usa

🚀 Fusion 1.2 is here!

What if your Laravel Eloquent models could work with Markdown files, not just database tables?

With Fusion, you can bring the power of Eloquent to Markdown-based content while keeping the Laravel experience you already know.

🔗 https://github.com/Hi-Folks/fusion

#laravel #markdown #eloquent #model #opensource #programming

#Ubuntu Touch OTA 2.1 Rolls Out with Support for Volla Tablet and Various Improvements https://9to5linux.com/ubuntu-touch-ota-2-1-rolls-out-with-support-for-volla-tablet-various-updates

@ubports #Linux #OpenSource #UbuntuTouch

Alt...

A screenshot of Ubuntu Touch's boot splash screen

30 Jahre #KDE : Plasma 6.8 setzt komplett auf #Wayland | heise online https://www.heise.de/news/KDE-Plasma-6-8-offeriert-nur-noch-Wayland-Sitzung-11487974.html #Linux #OpenSource

#PeaZip 11.4 Open-Source Archive Manager Released with Various Improvements and Bug Fixes https://9to5linux.com/peazip-11-4-open-source-archive-manager-released-with-various-improvements

#OpenSource #Linux #FreeSoftware

Alt...

A screenshot of PeaZip showing the built-in file manager.

The Wine 11.20 development release is out now bringing another set of improvements for running Windows apps / games on SteamOS / Linux.
https://www.gamingonlinux.com/2026/10/wine-11-20-brings-more-improvements-for-arm64ec-xml-validation-and-cdroms/

#OpenSource #Wine #Misc

Guten Morgen

Manchmal denke ich, mein Rechner hat einen unsichtbaren Mitbewohner. Er räumt auf, während ich schlafe, sortiert den Arbeitsspeicher und hält die Lüfter leise. Ich sehe ihn nie, aber ich merke, dass er da ist. Sein Name steht ganz klein in der Ecke des Anmeldebildschirms, und wenn ich genauer hinsehe, steht dort Linux.

Vielleicht ist das der schönste Trick an freier Software. Sie arbeitet so unauffällig, dass man sie erst bemerkt, wenn man weiß, wonach man sucht. Kennst du das Gefühl, dass da jemand mitarbeitet, den man nie zu Gesicht bekommt?

#Linux #OpenSource #FOSS #FreieSoftware

Come find us today in Open Source Conference in Tokyo!!

Thank you to our community who have organised a booth for our first time in the conference!!

https://event.ospn.jp/osc2026-fall/

#tokyo #conference #opensource

Linus Torvalds nutzt jetzt KI für den Linux-Kernel. Seine erste mit einem Sprachmodell entwickelte Patch-Serie beschleunigt bestimmte Lesezugriffe im Benchmark um den Faktor 23, enthielt bei der Prüfung aber direkt eine gefährliche Race Conditoin. Die Projektbetreuer streichen parallel die KI-Kennzeichnungspflicht, weil am Ende ohnehin der Mensch für seinen Code haftet. #Linux #OpenSource #KI #Programmierung

https://www.all-ai.de/news/news26/linux-ki-patch

If you ship open source to DoW: DoWI 8430.01 (effective September 8, 2026) requires SBOMs for all covered software, including transitive dependencies (§3.5.b), and a risk review of third-party and open source components (§3.5.i(2)).

On our side, Anchore Enterprise generates SBOMs at every build and imports vendor SBOMs. Here's the mapping:

https://anchore.com/blog/dow-instruction-8430-01-makes-software-evidence-a-condition-to-operate/

#SBOM #OpenSource #SoftwareSupplyChain

Linux users, let’s settle this.

Name one distro better than Arch Linux.

#Linux #LinuxDistro #OpenSource

Le teasing est terminé : ça pique, comme promis ! 🔥🚀
Mon nouveau service auto-hébergé est en ligne : Notesnook, des notes chiffrées de bout en bout, synchronisées sur tous vos appareils (navigateur, ordinateur, Android).

👉 Utiliser mon instance : https://wiki.blablalinux.be/fr/tutoriels-notesnook-utiliser-instance-blablalinux
🛠️ L'installer chez vous : https://wiki.blablalinux.be/fr/tutoriels-notesnook-installer-sur-son-serveur
🌐 Tous mes services : https://blablalinux.be/mes-services-publics/

#Notesnook #SelfHosting #AutoHébergement #OpenSource

Wine has updated to version wine-11.20. Check it out here: https://gitlab.winehq.org/wine/wine/-/releases/wine-11.20
#linux #foss #OpenSource

💾 Neue Möglichkeiten fürs N64!
Das SummerCart64 ist eine günstige, offene Alternative zu EverDrive & Co. – inkl. 64DD-Support, USB-Funktion, mp3-Player & mehr!
Für alle Bastler und Retro-Fans ein echter Geheimtipp 💡
➡️ Jetzt mehr erfahren: https://www.jungsi.de/summercart64-nintendo-64/
#Nintendo64 #Flashcart #RetroGaming #SummerCart64 #64DD #OpenSource #N64 #EverDriveAlternative

cve-watch 0.1.0

Fiz um monitor de vulnerabilidades críticas pra infra bolha-gcn e abri o código.

Ele consulta NVD, CISA KEV, avisos de segurança do GitHub e o tracker do Debian, e só avisa quando aparece algo crítico (CVSS ≥ 9 ou algo com exploração ativa confirmada) nos produtos que você lista.

Cada alerta diz:

• quando a falha foi publicada e há quantos dias
• se já existe versão corrigida (upstream e Debian)
• o link do aviso oficial

Notificações:

• Suporte a Mastodon (DM)
• Mattermost (canal)
• E-mail

Características:

• Python puro, sem dependências;
• Roda no cron
• Arquivo de configuração TOML para produtos e canais de monitoramento

Opcional:

• Heartbeat no Uptime Kuma, pra você saber se ele parou de funcionar

Monitores Bolha/GCN:

Aqui ele monitora vulnerabilidades do kernel linux, Proxmox, QEMU, Rancher/RKE2, Mastodon, Docker, nginx e cia.

Liçenca

• MIT

Source

• https://gitlab.gutocarvalho.net/open/cve-watch

#selfhosting #security #opensource #sysadmin

Kachelfenster und ich sind nie richtig Freunde geworden. Ich habe es mehrfach probiert, jedes Mal mit der besten Absicht, aber nach ein paar Tagen bin ich wieder bei den schwebenden Fenstern gelandet. Der Einstieg ist steil, bis die vielen Tastenkürzel im Kopf bleiben, vergeht eine Weile, und in dieser Zeit fühlt sich jeder Handgriff wie Suchen an. Ständig fehlte mir die gewohnte Bewegung mit der Maus, mit der ich ein Fenster einfach greife und dorthin ziehe, wo ich es gerade brauche. Bei mehreren Monitoren wurde es dann endgültig unübersichtlich, ich verlor den Überblick, auf welchem Bildschirm ein Fenster gerade liegt.

Den Reiz sehe ich trotzdem. Für jemanden, der den ganzen Tag im Terminal arbeitet, viele Fenster gleichzeitig offen hält und alles über die Tastatur steuert, ist so ein festes Raster ein echter Gewinn. Da sitzt jeder Handgriff, nichts verdeckt etwas anderes, und die Effizienz ist deutlich höher. Mein Alltag ist aber breiter gestreut, mal Browser, mal Bildbearbeitung, mal ein kurzer Blick in eine Datei. Da war mir das strenge Raster zu sehr auf einen Arbeitsstil zugeschnitten. Vielleicht ist es eine Frage der Gewohnheit, doch ich glaube inzwischen, dass ein Kachelsystem eher etwas für Profis ist, die ihren Rechner beruflich auf ein Ziel hin nutzen. Für mich als Privatanwender war die Umstellung zu groß und der Gewinn zu selten.

Wie nutzt du deinen Bildschirm, lieber gekachelt und aufgeräumt oder frei und schwebend?

#Linux #TilingWM #OpenSource #FOSS

As Microsoft ends support for Publisher, The Document Foundation offers a seamless solution. Learn how LibreOffice can open and edit your legacy PUB files.

#LibreOffice #MicrosoftPublisher #OpenSource #DocumentFoundation #TechNews

https://dailytechnow.com/libreoffice-rescues-microsoft-publisher-users/

RE: https://nrw.social/@41352_Einfach_besser_leben/117434345795993586

Morgen bin ich auch mit am Start und unterstütze in der Linux-Sonderschicht. Interessierten Leuten Linux näher bringen und auf dem eigenen System installieren. So ist die Befreiung von der Seuche (aka Windows) etwas leichter.

Mein kleiner Beitrag an die Community.

#foss #opensource #ehrenamt #noBigTech #unterstützung #EndofLife #linux #windows

Wazuh (open-source XDR & SIEM) in v4.14.9 released

https://secburg.com/posts/wazuh-4149-released/

#Wazuh #SIEM #XDR #InfoSec #OpenSource

Security Advisory: CVE-2025-60479 - NULL Pointer Dereference in GPAC/MP4Box

Processing a crafted MPEG-4 file with broken BIFS vector fields triggers a NULL pointer dereference in `StatSFVec2f`, causing MP4Box to crash during scene statistics collection.

Summary:
The `StatSFVec2f` function in `scene_manager/scene_stats.c` collects statistics for SFVec2f fields in an MPEG-4 BIFS scene. When the scene contains a crafted broken vector field, the statistics traversal passes a NULL pointer to `StatSFVec2f` without validation. The function dereferences the pointer at address 0x0, terminating the process with SIGSEGV.

CWE:
CWE-476 - NULL Pointer Dereference

Affected Component:
```
scene_manager/scene_stats.c:192
Function: StatSFVec2f()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
2.5-DEV-rev1678-gb7ffd9f96-master; commit `b7ffd9f96bc188dde148300d8c4e510b557563aa`. Any codebase equivalent to this commit that has not applied the fix commit is affected.

Attack Conditions:
An attacker supplies a crafted MPEG-4 file containing a malformed BIFS scene with invalid SFVec2f vector field structures. Local access is required; the victim must invoke `MP4Box -nstat <crafted_file>` or any equivalent scene statistics command that triggers the scene analysis path.

Impact:
The NULL pointer dereference (READ at address 0x000000000000) causes an immediate process crash, resulting in Denial of Service. No evidence of arbitrary code execution was observed; the faulting access is a NULL read that is not exploitable for control-flow hijacking.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
75786eb61b7cc838b57c3d4f8004b4f13b5b724c
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3322
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/58/58_StatSFVec2f_scene_manager_scene_stats_c_192
- Fix: https://github.com/gpac/gpac/commit/75786eb61b7cc838b57c3d4f8004b4f13b5b724c

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60489 - NULL Pointer Dereference in GPAC/MP4Box

Processing a crafted MP4 file with corrupted DTS timing metadata triggers a NULL pointer dereference in `dasher_insert_timeline_entry`, causing MP4Box to crash during DASH timeline construction.

Summary:
The `dasher_insert_timeline_entry` function in `filters/dasher.c` accesses timeline entry structures during DASH segment processing. When the input MP4 has corrupted DTS sequence data that produces empty DASH segments, the dasher fails to validate a timeline entry pointer before dereferencing it at address 0xc (12-byte struct offset), leading to a near-NULL read and SIGSEGV.

CWE:
CWE-476 - NULL Pointer Dereference

Affected Component:
```
filters/dasher.c:7760
Function: dasher_insert_timeline_entry()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
2.5-DEV-rev1692-g23819fdc0-master; commit `23819fdc02be8d3e92f0ef84831625d51981d7d2`. Any codebase equivalent to this commit that has not applied the fix commit is affected.

Attack Conditions:
An attacker supplies a crafted MP4 file whose DTS timing metadata produces empty segments during DASH packaging. Local access is required; the victim must invoke `MP4Box -segment-timeline -dash 10000 <crafted_file>` or any equivalent DASH segmentation command using segment timeline mode.

Impact:
The near-NULL pointer dereference (READ at address 0x00000000000c) causes an immediate process crash, resulting in Denial of Service. No evidence of arbitrary code execution was observed; the faulting access is a near-NULL read that is not exploitable for control-flow hijacking.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
4860a1a6f128ccc9ae37b4b738d22029f9672457
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3325
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/60/60_dasher_insert_timeline_entry_filters_dasher_c_7760
- Fix: https://github.com/gpac/gpac/commit/4860a1a6f128ccc9ae37b4b738d22029f9672457

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60491 - Use-After-Free in GPAC/MP4Box

Processing a crafted MPEG-2 TS file with corrupted PMT descriptors triggers a heap use-after-free in `dasher_flush_segment`, causing MP4Box to crash during DASH segmentation.

Summary:
The `dasher_configure_pid` function in `filters/dasher.c` frees a PID context structure at line 986 when reconfiguring a stream from a crafted MPEG-TS input. The freed pointer is not nullified, and `dasher_flush_segment` subsequently reads 4 bytes at offset 336 within that freed 1096-byte region at line 8062 during the segment flush cycle, constituting a heap-use-after-free.

CWE:
CWE-416 - Use After Free

Affected Component:
```
filters/dasher.c:8062
Function: dasher_flush_segment()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
2.5-DEV-rev1698-gfc2009fa7-master; commit `fc2009fa75631960743f8f7855dda8998167b5ab`. Any codebase equivalent to this commit that has not applied the fix commit is affected.

Attack Conditions:
An attacker supplies a crafted MPEG-2 TS file containing broken PMT descriptor sizes, reused PIDs, and sync marker violations. Local access is required; the victim must invoke `MP4Box -dash 1000 <crafted_file>` or any equivalent DASH segmentation command that triggers PID reconfiguration in the dasher module.

Impact:
The use-after-free (READ of size 4 at 336 bytes into a freed 1096-byte heap region) causes process termination, resulting in Denial of Service. Code execution cannot be ruled out; use-after-free vulnerabilities allow an attacker to control freed memory contents and potentially redirect execution flow.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
f6128214feb69cd689e4b9944a2621bc4ad8faf0
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3326
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/61/61_dasher_flush_segment_filters_dasher_c_8062
- Fix: https://github.com/gpac/gpac/commit/f6128214feb69cd689e4b9944a2621bc4ad8faf0

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac