AT2k Design BBS - Computer Support/Help/Discussion

Critical security vulnerability affects OpenSSH on Alpine Linux

Thu, 05 Nov 2026 06:40:10 -0600

From: LWN.net @3345.min_comp *61
To: All @Echomail *61
Subject: Critical security vulnerability affects OpenSSH on Alpine Linux

Version 10.6p2 of
OpenSSH has been released with a workaround for a critical vulnerability that
affects Linux systems that use musl libc
with PAM disabled, such as Alpine
Linux. OpenSSH developer Damien Miller said:

If you operate a Linux system that uses musl libc without PAM (Alpine Linux
is one example) then stop reading and set PasswordAuthentication=no or disable
SSH for these systems IMMEDIATELY.

This vulnerability does not exist on non-Linux systems, Linux/glibc systems
and Linux systems that use PAM for password authentication.

We consider the root cause of this bug to be outside OpenSSH itself, but
we're in a good position to deliver a mitigation quickly.

The Alpine Linux project has announced that
it will be backporting the OpenSSH fix "all the way back to Alpine 3.16",
which was released in May
2022.

https://lwn.net/Articles/1105464/
--- SBBSecho 3.38-Linux
* Origin: Palantir * palantirbbs.ddns.net * Pensacola, FL * (618:250/24)

[$] LWN.net Weekly Edition for November 5, 2026

Thu, 05 Nov 2026 06:40:10 -0600

From: LWN.net @3344.min_comp *61
To: All @Echomail *61
Subject: [$] LWN.net Weekly Edition for November 5, 2026

Inside this week's LWN.net Weekly Edition:

Front: Kernel cells; Debian LLM reviews; glibc system-call wrappers; Binder in
Rust; Kernel CVE flood; Fedora KDE and X11 removal; 7.4 merge window part two;
Portable Python.
Briefs: MTCP RCE; Bash security; XCPE botnet; Bazzite 45; Fedora
45; openSUSE Leap 16.1; Tor Browser 16.0; Quotes; ...
Announcements: Newsletters, conferences, security updates, patches,
and more.

https://lwn.net/Articles/1103480/
--- SBBSecho 3.38-Linux
* Origin: Palantir * palantirbbs.ddns.net * Pensacola, FL * (618:250/24)

[$] Plasma X11 session removal surprises some Fedora users

Thu, 05 Nov 2026 06:40:10 -0600

From: LWN.net @3343.min_comp *61
To: All @Echomail *61
Subject: [$] Plasma X11 session removal surprises some Fedora users

The KDE Project announced, in∩┐╜2025, that Plasma∩┐╜6.7 would
be the last version of the desktop environment that would support X11
sessions. Those who keep up with KDE's announcements no doubt expected it when
Plasma∩┐╜6.8
dropped X11 support as promised. What seems to have come as a surprise, at
least to a number of Fedora KDE Plasma
Desktop users, is that the Fedora∩┐╜44 release-which shipped in
April with Plasma∩┐╜6.6-received
an update to Plasma∩┐╜6.8 that swept away the X11 session without much warning.
Despite the surprise, it is gone for good: the Fedora Engineering Steering
Committee (FESCo) has voted
against a request to revert the update for Fedora 44 and the just-released
Fedora 45.

https://lwn.net/Articles/1105130/
--- SBBSecho 3.38-Linux
* Origin: Palantir * palantirbbs.ddns.net * Pensacola, FL * (618:250/24)

Bazzite 45 released

Thu, 05 Nov 2026 06:40:10 -0600

From: LWN.net @3342.min_comp *61
To: All @Echomail *61
Subject: Bazzite 45 released

Version
45 of Bazzite, the image-based gaming distribution based on
Fedora∩┐╜Linux, has been released. Notable changes in this release include a
rebase to Fedora∩┐╜45, updated Open Gaming Collective (OGC)
kernels, support for Logitech TrueWheel devices, and more.

LWN covered Bazzite in
December∩┐╜2025.

https://lwn.net/Articles/1105395/
--- SBBSecho 3.38-Linux
* Origin: Palantir * palantirbbs.ddns.net * Pensacola, FL * (618:250/24)

[$] Portable Python scripts with dependencies

Thu, 05 Nov 2026 06:40:10 -0600

From: LWN.net @3341.min_comp *61
To: All @Echomail *61
Subject: [$] Portable Python scripts with dependencies

A basic Python script is portable: it can be copied between machines with little
concern about compatibility.
A script that depends on third-party packages requires quite a bit more
care and consideration, however.
In 2023, PEP
723 ("Inline script metadata") introduced a standard for declaring a Python
script's
dependencies inside the script itself.
Several third-party tools can now automatically install and manage those
dependencies, but there is still little official support for this standard
within Python itself.

https://lwn.net/Articles/1104646/
--- SBBSecho 3.38-Linux
* Origin: Palantir * palantirbbs.ddns.net * Pensacola, FL * (618:250/24)

Security updates for Wednesday

Thu, 05 Nov 2026 06:40:10 -0600

From: LWN.net @3340.min_comp *61
To: All @Echomail *61
Subject: Security updates for Wednesday

Security updates have been issued by AlmaLinux (cockpit, dpdk, fence-agents,
firefox, freerdp, gimp, opentelemetry-collector, python-dns, qemu-kvm, and
raptor2), Debian (apt and squid), Fedora (ags, apptainer, chromium, fractal,
mingw-harfbuzz, mingw-qt5-qtwebkit, mingw-qt6-qt5compat, python-mistune,
python3-docs, python3.14, python3.9, rubygem-gist, rust-app-store-connect,
rust-qemu-rdp, rust-redlib, and selenium-manager), Mageia (java-latest-openjdk,
java-17-openjdk, java-21-openjdk, timezone), Oracle (.NET 10.0, .NET 8.0, .NET
9.0, bind, bind9.16, cockpit, firefox, freerdp, gcc, ghostscript, glibc,
grafana, java-17-openjdk, java-21-openjdk, kernel, kernel-uek, libXi, pipewire,
pki-deps:10.6, podman, python-jwt, python-pillow, python-pyasn1, qt5-qtbase,
thunderbird, tomcat, util-linux, and wireshark), Red Hat (dnsmasq, fence-agents,
freerdp, pki-core:10.6, and thunderbird), SUSE (amazon-ssm-agent, aom-tools,
apache2, brotli, cadvisor, chromium, cups, curl, distribution-registry, eog, gh,
go-containerregistry, google-guest-agent, gvfs, haproxy, hauler, helm3, kernel,
libBasicUsageEnvironment2, libcdio, libinstpatch-1_0-2, libosmocore,
libreoffice, libX11, nodejs22, nvidia-open-driver-G06-signed, openssh, parted,
perl-DBI, perl-mime-tools, python-pypdf, rootlesskit, rqlite, rsyslog, sssd,
tomcat10, warewulf4, and xen), and Ubuntu (apt-cacher, bind9, bitlbee, cakephp,
deluge, dmitry, e17, feh, gnome-shell, golang-github-gin-contrib-cors, gvfs,
haproxy, jabberd2, libmspack, libnet-easytcp-perl, libphp-swiftmailer,
libsoup2.4, libsoup3, libuser, pcre2, rear, ruby-rack, ruby-sprockets,
rxvt-unicode, shapelib, sogo, vips, and yaws).

https://lwn.net/Articles/1105378/
--- SBBSecho 3.38-Linux
* Origin: Palantir * palantirbbs.ddns.net * Pensacola, FL * (618:250/24)

Latest Distro Releases

Thu, 05 Nov 2026 06:40:08 -0600

From: Distro Watcher @3339.min_comp *61
To: All @Echomail *61
Subject: Latest Distro Releases

DistroWatch.com: Distributions
Mainstream 4.0.0
ShrikeLinux 2026.11.04
Artix 20261102
PH4NTXM 3.5.3
StratOS 2026.11.04
NebiOS 10.3
Omarchy 4.5.0
MocaccinoOS 26.11
ML4W 2.17
RakuOS 2026.11.04
Calculate 20261103
CapivaraOS 2.0.0
--- SBBSecho 3.38-Linux
* Origin: Palantir * palantirbbs.ddns.net * Pensacola, FL * (618:250/24)

OpenSUSE Leap 16.1

Wed, 04 Nov 2026 06:40:09 -0600

From: LWN.net @3338.min_comp *61
To: All @Echomail *61
Subject: OpenSUSE Leap 16.1

The openSUSE project has announced the release of openSUSE Leap 16.1. The
release is notable for allowing both traditional installations and immutable
images with transactional updates. While immutable images had previously been
available for Leap Micro, they are now available across all platforms that Leap
supports, including servers, desktops, and virtual machines.

"Leap's image gives the best of both for traditional and immutable users, and we
expect that Tumbleweed will follow when Agama becomes the default installer for
Tumbleweed as well." said Leap release manager Lubos Kocman. "The Leap Micro
experience people relied on is still here, but now it shares the same release,
the same life cycle and the same maintenance updates as the rest of Leap, so
users only have to pick the mode that fits their workload."

https://lwn.net/Articles/1105131/
--- SBBSecho 3.38-Linux
* Origin: Palantir * palantirbbs.ddns.net * Pensacola, FL * (618:250/24)

[$] LLM reviews for Debian's new queue spark debate

Wed, 04 Nov 2026 06:40:09 -0600

From: LWN.net @3337.min_comp *61
To: All @Echomail *61
Subject: [$] LLM reviews for Debian's new queue spark debate

The Debian project has wrestled with the topic of LLM usage for years, which
culminated in a general-resolution
vote this August. The project voted in favor of the fifth, out of
eight, option: "Responsible Use of
Generative AI". With the door open to LLM use, the DFSG, Licensing & New
Packages
Team (usually shortened to "DFSG team"), which is relatively new, has started to
employ LLMs in
sending out reviews of packages entering Debian's new queue. The practice has
raised a number of objections and questions about where lines should be drawn in
the use of LLM-generated output.

https://lwn.net/Articles/1103674/
--- SBBSecho 3.38-Linux
* Origin: Palantir * palantirbbs.ddns.net * Pensacola, FL * (618:250/24)

Fedora Linux 45 released

Wed, 04 Nov 2026 06:40:09 -0600

From: LWN.net @3336.min_comp *61
To: All @Echomail *61
Subject: Fedora Linux 45 released

Fedora Linux
45 has been released. This includes all editions: Fedora Workstation, Fedora KDE
Plasma Desktop, Fedora Server, Fedora Cloud, Fedora CoreOS, and Fedora IoT, as
well as the Atomic Desktops and Spins.

This release adds support for installation
on Stratis storage using Anaconda or Kickstart installs, retires
unmaintained VPN plugins for NetworkManager, and updates Fedora's desktop
environments, developer toolchains, and system packages. See the Fedora wiki
ChangeSet page for a list of major changes.

https://lwn.net/Articles/1105121/
--- SBBSecho 3.38-Linux
* Origin: Palantir * palantirbbs.ddns.net * Pensacola, FL * (618:250/24)

Security updates for Tuesday

Wed, 04 Nov 2026 06:40:09 -0600

From: LWN.net @3335.min_comp *61
To: All @Echomail *61
Subject: Security updates for Tuesday

Security updates have been issued by AlmaLinux (bind, bind9.16, firefox, freerdp, ghostscript, kernel, kernel-rt, libXi, perl-YAML:1.24, perl:5.32, pipewire, qt5-qtbase, redis:6, tomcat, and wireshark), Debian (chromium, git-annex, incus, kernel, and strongswan), Fedora (barman, erlang-hex_core, glib-networking, kernel, knot, liblerc, libsoup3, mingw-cfitsio, openjpeg, perl-libnet, pipx, python-pillow, python-uv-build, radicale, ruff, rust-archive-trait, rust-astral-ini, rust-astral-mail-headers, rust-astral-pubgrub, rust-astral-version-ranges, rust-astral_async_zip, rust-quick-junit, rust-tar-codec, rust-tar-framing, tpm2-tss, ty, uv, and zvbi), Mageia (unbound), Red Hat (buildah, compat-openssl10, compat-openssl11, container-tools:rhel8, delve, golang-github-openprinting-ipp-usb, grafana, grafana-pcp, kernel, oci-seccomp-bpf-hook, openssl, opentelemetry-collector, osbuild-composer, podman, rhc, and skopeo), Slackware (expat), SUSE (ansible-core, apache-arrow, apache-commons-codec, apache-commons-io, apache-commons- logging, avalon-framework, avalon-logkit, glassfish-jsp, jsch, maven-file- management, opentest4j, aws-nitro-enclaves-cli, bouncycastle, chromedriver, chromium, cifs-utils, expat, firefox, gcc48, ghostscript, GraphicsMagick, guava, j2objc-annotations, gvfs, ImageMagick, in-toto, libsoup, nodejs22, nodejs24, praat, python-Pillow, python-PyJWT, python-soupsieve, python-sqlparse, python313-OpenEXR, python313-vllm, rootlesskit, and rqlite), and Ubuntu (kernel, linux, linux-aws, linux-aws-5.15, linux-aws-fips, linux-azure, linux-azure-5.15, linux-azure-fde-5.15, linux-azure-fips, linux-fips, linux-gcp, linux-gcp-5.15, linux-gcp-fips, linux-gke, linux-gkeop, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-intel-iot-realtime, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle,
linux-oracle-5.15, linux-realtime, linux, linux-aws, linux-aws-fips,
linux-azure, linux-azure-5.4, linux-azure-fips, linux-fips, linux-gcp,
linux-gcp-5.4, linu

x-gcp-fips, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-iot, linux-kvm,
linux-oracle, linux-oracle-5.4, linux-xilinx-zynqmp, linux, linux-aws,
linux-fips, linux-kvm, linux-lts-xenial, linux, linux-aws, linux-gcp,
linux-hwe-7.0, linux-ibm, linux-oracle, linux-aws, linux-azure-fde,
linux-bluefield, linux-nvidia-tegra, linux-nvidia-tegra-5.15,
linux-nvidia-tegra-igx, and linux-oem-7.0).

https://lwn.net/Articles/1105111/
--- SBBSecho 3.38-Linux
* Origin: Palantir * palantirbbs.ddns.net * Pensacola, FL * (618:250/24)

Latest Distro Releases

Wed, 04 Nov 2026 06:40:07 -0600

From: Distro Watcher @3334.min_comp *61
To: All @Echomail *61
Subject: Latest Distro Releases

DistroWatch.com: Distributions
Calculate 20261103
CapivaraOS 2.0.0
Ludora 45.0
Chimera 20261103
CentOS 10-20261103.0
umbrelOS 2.1.0-beta1
HAOS 18.5-rc1
NetBSD 11.1
IPFire 2.29-core205
FlickOS 3.0-alpha1
openSUSE 16.1
Kiro 26.11.03
--- SBBSecho 3.38-Linux
* Origin: Palantir * palantirbbs.ddns.net * Pensacola, FL * (618:250/24)

[$] The second part of the 7.4 merge window

Tue, 03 Nov 2026 06:40:09 -0600

From: LWN.net @3333.min_comp *61
To: All @Echomail *61
Subject: [$] The second part of the 7.4 merge window

The 7.4 merge window, which
closed on November 1,
included a record-breaking 18,591 non-merge changesets.
That is almost as many as the entire 7.3 development cycle, which had 18,765,
itself a record breaker. Of
those, 11,838 landed after the article covering the
first part of the merge window. Most of those were bug fixes of
various forms; it seems as though bug fixes may be crowding out feature
additions across the open-source ecosystem to
some extent. Still, a good number of new features were included, and a handful
removed, in the tail end of the merge window.

https://lwn.net/Articles/1102739/
--- SBBSecho 3.38-Linux
* Origin: Palantir * palantirbbs.ddns.net * Pensacola, FL * (618:250/24)

Shutting the Door on the XCPE Botnet (Threat Intelligence)

Tue, 03 Nov 2026 06:40:09 -0600

From: LWN.net @3332.min_comp *61
To: All @Echomail *61
Subject: Shutting the Door on the XCPE Botnet (Threat Intelligence)

The Google Threat Intelligence blog describes,
in great detail, the XCPE botnet, which has just been taken down.

Last week, Google and industry partners dismantled the XCPE
backdoor which enrolled more than 1.3 million set-top boxes into a
botnet. We assess with high confidence that the backdoor and botnet
were intentionally developed, deployed, and operated for financial
gain by Videostrong Technology Co., an Android Original Equipment
Manufacturer (OEM) and Original Device Manufacturer (ODM).

Videostrong monetized the backdoor by selling access to criminal
affiliates and loading those affiliates' malware modules onto
infected devices. These secondary modules were conducting ad-fraud;
silently enrolling infected devices into residential proxy
networks; and loading additional malware onto XCPE-compromised
devices.

https://lwn.net/Articles/1104847/
--- SBBSecho 3.38-Linux
* Origin: Palantir * palantirbbs.ddns.net * Pensacola, FL * (618:250/24)

[$] Managing the kernel CVE flood

Tue, 03 Nov 2026 06:40:09 -0600

From: LWN.net @3331.min_comp *61
To: All @Echomail *61
Subject: [$] Managing the kernel CVE flood

We recently looked at how the
kernel community is dealing with the firehose of vulnerability reports, but
said little about how users of the kernel are responding. At the 2026 Linux
Plumbers Conference, Amazon employees
Dylan Johnson and Justinien Bouron discussed the problem from the point of
view of engineers trying to keep AWS running and secure in the face of a
storm of CVE disclosures. The kernel community's longstanding advice is to
run current kernels, and that turns out to work - sort of.

https://lwn.net/Articles/1100894/
--- SBBSecho 3.38-Linux
* Origin: Palantir * palantirbbs.ddns.net * Pensacola, FL * (618:250/24)